CPaaS LabFree University

T11 · T11-R31 · Compliance and migration

Compliance starts by not pasting a secret

The practical rule is small. Tokens, signing keys, and message bodies stay out of git and out of this lab. The Twilio security title shows there is a docs section. It does not, in what this session read, list certificate identifiers. Those identifiers stay confirm.

ExportSVGFlowSheet

Counts on this page

4boxes
7opened sources
2confirm rows
5study lines

Opened sources

Confirm rows, no URL

Learn it in 5 minutes

  • Twilio's webhook docs name signing with shared keys, and the security page opened with the title Security.
  • The Telnyx guide uses a Bearer API key and tells you to copy it from API Keys. The key is not in this repository.
  • Bandwidth does not store message text, on the messaging guide. Your own logs might. Do not put a customer's message in a study note.
  • The Twilio article records data breaches in 2022 and 2024. That is a history sentence, not a hardening guide.
  • Certificate names, a SOC report, and a HIPAA opinion were not read.

Visual

Compliance starts by not pasting a secret Secrets. Teaching sketch. Confirm a live system. Sign Bearer No body Confirm Names come from pages opened in 2026-10. A missing name stays confirm.

Count the boxes: 4. Each label is a name from a page or a study label marked on the drawing.

Flow

Compliance starts by not pasting a secret Caller SIP Called session setup session setup RTP, not required to hairpin Teaching sketch from RFC 3261 and RFC 3550. Not a packet capture.

What is going on

The practical rule is small. Tokens, signing keys, and message bodies stay out of git and out of this lab. The Twilio security title shows there is a docs section. It does not, in what this session read, list certificate identifiers. Those identifiers stay confirm.

Recording laws are not in this room. No statute page opened. Call recording appears as a Twilio verb, Record, and as a Jami feature on the Jami site. Whether you may record is confirm, and it is not legal advice.

Worked example

Before a screenshot, search the image for the words Bearer, api_key, and a phone number that belongs to a person. If any appear, crop them. Then write confirm next to any compliance badge you have not opened.

Quiz

1. This repository includes a Telnyx API key from the guide.

2. The Twilio article mentions data breaches in 2022 and 2024.

Ecosystem

Sister pieces sit on the ecosystem page: the glossary, the mind map, the integration map, and the bridges.

  • Shared key — What Twilio's webhook docs say you can use to sign webhooks. The key itself is not published here.
  • Record — A TwiML verb, and also a Jami feature. Neither is a legal permission.

Config. Use the vendor's secret store or your own. Reference the secret by name, never by value.

Troubleshooting. A webhook you cannot authenticate is a signing problem. Rotate the key in the portal. Do not commit the new one to fix the test.

Bridge. Verify APIs send codes to end users. Those codes are secrets too. The verify room names the channels. It does not store a code.

Mind map, sister technologies, and future hooks live on the ecosystem page.

Sources and go deeper

Opened 2026-10. A row marked confirm has no link, because that page was not verified.

sources.json Markdown