Summary
All calls aren’t all the same. Modern voice (VoLTE/VoNR) uses encryption by default: signaling is typically TLS, and voice media is SRTP. Weak links appear when a call downgrades (e.g., to 2G/legacy interconnects) or when the other device is compromised. Encrypted calling feature is a protection against man in the middle snooping (e.g. malicious actors attempting to intercept communications between hops). It does very little to hide the contents from the infrastructure owners.
What REALLY adds:
REALLY enables VoLTE etc. for all new customers automatically
Anti-downgrade policies where devices/networks support them (prefer VoLTE/VoNR, avoid 2G; reduce 3G/CS fallback).
Tighter interconnect controls and audits to minimize legacy legs.
SIM-swap protections and account hardening (attackers love voice/SMS to pivot).
Built-in VPN for data sessions (helps apps that use data calling).
No giant identity-linked archive of your call metadata sitting around.
Limits (honest view): Carrier voice must interoperate with the public phone network, so it’s not end-to-end encrypted like Signal/WhatsApp. If the other party’s phone is infected (e.g., Pegasus-style), content can leak at the endpoint.
The Critic’s Question
“If you still use the regular phone network, can someone listen in? What exactly do you encrypt, and where can it fail?”
How Phone Calls Actually Travel (Plain English)
When everything is modern (best case):
Your phone places a call over VoLTE/VoNR (4G/5G).
Signaling (call setup) travels over TLS within the IMS (IP Multimedia Subsystem).
Voice audio travels as SRTP (Secure Real-time Transport Protocol).
On-net or via secure interconnect, the session stays encrypted hop-to-hop.
Where the weak links show up (reality check):
Downgrade to legacy (no/weak encryption): poor coverage or an external carrier may push a leg to 3G/2G (CS voice).
Legacy interconnects: some partners still stitch calls through older gear that strips or never had SRTP/TLS.
Endpoint compromise: malware on either phone can capture audio before it is encrypted or after it’s decrypted.
Lawful intercept: in any network, targeted, valid legal process can enable capture at specific choke points (not mass dragnet by default).
Big Wireless vs. REALLY; What’s Different for Voice
Communications Layer (in transit)
Big Wireless (typical defaults):
VoLTE/VoNR where available, but more permissive downgrades to 3G/2G and legacy interconnects (for reach/compatibility).
Limited visibility for consumers into when/why downgrades happen.
REALLY (what we do):
REALLY's PrivateCore™ includes VPN and privacy protocols to better protect subscriber privacy
VoLTE/VoNR-first routing and anti-downgrade policies where devices and roaming contexts support them.
Audit and reduce legacy interconnect legs; prefer secure trunks where feasible.
Device guidance: we provide steps for disabling 2G (on supported devices) and keeping firmware updated.
Built-in VPN helps app-based calls (VoIP) ride an encrypted tunnel when you choose apps instead of PSTN.
Data Layer (metadata & retention)
Big Wireless (typical):
Large, identity-linked CDRs (call detail records) retained long-term; broad partner/vendor access paths.
REALLY:
No centralized, identity-linked archive at our layer.
Hosts don’t receive our identifier mapping.
Short-lived, minimal records—so there’s less to expose, sell, or seize in bulk.
What We Encrypt (and What We Can’t)
Encrypted by the network (when on VoLTE/VoNR):
Signaling: SIP/IMS over TLS.
Media: voice packets via SRTP.
Not end-to-end:
The public telephone system must interoperate across many carriers and lawful regimes. That means carrier voice is not e2e like Signal/WhatsApp; it’s encrypted in transit across network segments we (and partners) control.
Where you still need to be careful:
Downgrade paths (2G/3G) → we work to avoid; you can disable 2G where supported.
Interconnects you don’t see → we push for secure trunks and document exceptions.
Compromised endpoints → keep OS updated; use device-level protections.
Who you call matters → your security is only as strong as the more vulnerable end.
Practical Protections You’ll Notice
Anti-downgrade stance (policy + device guidance) to keep calls on VoLTE/VoNR.
2G-off guidance for supported Android devices; iOS relies on carrier/device capabilities.
SIM-swap protection and strong account recovery to prevent takeover.
Built-in VPN for your data traffic; pairs well with app-based calling (when you choose to use it).
Spam/call screening (powered by Aura) to shrink social-engineering risk around calls.
Number valet (coming soon): keep your long-held number shielded behind additional controls to reduce exposure during provider changes or recovery events.
FAQs (Fast, Plain Answers)
Q: Is carrier calling end-to-end encrypted?
A: No. It’s encrypted in transit (TLS/SRTP) on modern legs, but must interoperate with the public phone system. For true e2e, use apps like Signal/WhatsApp—your data VPN can add protection for those data sessions.
Q: Can a Stingray/IMSI catcher get my call?
A: Those tactics rely on forcing 2G/legacy behavior. Our stance is to prefer LTE/5G, offer 2G-off guidance, and reduce downgrade windows. Staying on VoLTE/VoNR and updated devices reduces exposure.
Q: What about Pegasus-style spyware?
A: That’s endpoint compromise—no carrier can “encrypt away” a hijacked microphone. We focus on reducing network-side risk and provide device security guidance; if you’re high-risk, consider hardened devices and app e2e.
Q: Do you allow mass surveillance?
A: No. We don’t centralize identity-linked archives, and we don’t send identifier mapping to hosts. Targeted lawful access is possible; dragnets are frustrated by design.
Wrap-Up
On modern paths, your calls ride TLS/SRTP—that’s encrypted signaling + media in transit.
We push to avoid downgrades, reduce legacy interconnects, and harden accounts, while keeping your metadata footprint small.
For e2e calling, use secure apps; our built-in VPN helps those data sessions, too.
Bottom line: we raise the floor for everyday voice privacy and make mass surveillance harder, without pretending carrier voice is perfect.
Honest limits
Limits (honest view): Carrier voice must interoperate with the public phone network, so it’s not end-to-end encrypted like Signal/WhatsApp. If the other party’s phone is infected (e.g., Pegasus-style), content can leak at the endpoint.
Proof & verification (in progress)
Policy:
Voice security stance (VoLTE/VoNR-first, anti-downgrade, 2G-off guidance).
Lawful-process policy (targeted, case-based; no dragnet).
Architecture:
IMS/voice call-path diagram identifying where TLS/SRTP apply and where legacy interconnects can appear.
Interconnect inventory with security posture (secure trunks, exceptions noted).
Audit:
Third-party review of IMS/voice security configuration.
SOC 2 / ISO 27701 control IDs covering logging, access, and change management for voice systems.
Tests:
Lab packet captures (sanitized) showing TLS/SRTP on VoLTE/VoNR legs.
Downgrade tests: device matrices demonstrating conditions that force 3G/2G, plus mitigation steps.
Interconnect spot checks with results.
Transparency:
Known-limitations page (devices/regions where downgrades may occur).
Changelog noting security improvements (e.g., “2G disabled by default on X devices/regions”).
Contracts:
Partner/interconnect agreements prioritizing secure trunks; language restricting unnecessary retention or re-routing via legacy paths where avoidable.
Join the only carrier that makes privacy non-negotiable.
