SIP.IO
Start free

Acceptable Use Policy

Version 2026-11-06 · Effective 2026-11-06

This Acceptable Use Policy (“AUP”) forms part of the Terms of Service. It applies to you, your End Users and anyone else who uses the Services through your Account. Capitalised terms not defined here have the meaning given in the Terms. More detailed rules for specific products are in the Voice Services Policy, the Messaging Policy, the BYOC Terms and the AI and MCP Services Addendum.

1. General principles

1.1 You must use the Services only for lawful purposes and in line with the laws of every country from, to and through which your calls and messages travel, the rules of upstream carriers and messaging channels, and industry codes of conduct.

1.2 You are responsible for every call, message, API request and AI action that originates from your Account, whether made by you, your End Users, your systems or a third party using your Credentials.

1.3 Where this AUP gives examples, they are illustrative and not exhaustive. We decide, acting reasonably, whether a use breaches this AUP.

2. Unsolicited, unlawful and abusive communications

You must not use the Services to:

  • place calls or send messages to people who have not given the consent the law requires, or who have withdrawn it;
  • make robocalls, pre-recorded or artificial-voice calls, or automated texts, except in full compliance with applicable law and with the consent that law requires;
  • send bulk unsolicited messages (“spam”) or make high-volume unsolicited calls;
  • conduct campaigns designed to evade carrier filtering, for example by rotating numbers (“snowshoeing”), using URL shorteners to disguise links, or varying content to avoid detection;
  • harass, threaten, stalk, intimidate or abuse any person, including through repeated calls or messages; or
  • transmit content that is unlawful in the origin or destination country.

3. Caller ID, spoofing and STIR/SHAKEN

3.1 You may present as caller ID only a number that is assigned to your Account on the platform, or a number that you own or are authorised to use and that you have verified with us through the console process. You must not present a number you are not authorised to use, a number belonging to an emergency service or government agency without authorisation, or any caller ID intended to mislead, defraud or cause harm.

3.2 You must not manipulate, remove or falsify signalling information, including caller ID, P-Asserted-Identity, Diversion headers, redirecting numbers or original called numbers, except as technically required for legitimate forwarding and in line with law.

3.3 In the United States and other jurisdictions that use STIR/SHAKEN or similar frameworks, we sign calls with an attestation level that reflects what we can verify:

  • A (full attestation): the number is assigned to your Account on our platform and you are authorised to use it;
  • B (partial attestation): we know you, but cannot verify your right to use the specific number, for example a verified external number;
  • C (gateway attestation): we are passing a call that entered our network from elsewhere and cannot verify its origin.

Calls with lower attestation are more likely to be labelled or blocked by terminating carriers. Attempting to obtain a higher attestation than your number entitlement supports is a breach of this AUP.

4. Telemarketing law and do-not-call

4.1 If you make marketing or informational calls or send marketing messages, you are solely responsible for compliance with telemarketing laws, including, where applicable, the US Telephone Consumer Protection Act (TCPA) and FCC rules, the Telemarketing Sales Rule (TSR), US state telemarketing and “mini-TCPA” laws, Canada’s Unsolicited Telecommunications Rules and CASL, the EU ePrivacy rules and GDPR, the UK PECR, and Israel’s Communications Law (Telecommunications and Broadcasting) anti-spam provisions.

4.2 Before calling or messaging, you must scrub your lists against applicable national, state and internal do-not-call registries (for example, the US National Do Not Call Registry, the UK Telephone Preference Service and the Israeli “Do Not Call” registry) and against the Do Not Call lists you maintain in the Services. You must honour opt-out requests promptly and within the time the law requires.

4.3 You must comply with calling-hour restrictions in the called party’s local time zone, including stricter state and national rules, and with rules on caller identification, call abandonment, and answering-machine messages.

4.4 You must obtain, record and retain evidence of consent (who consented, when, how, for what and to whom), and produce it to us within five business days on request. Our dialer and Do Not Call tools assist compliance but do not guarantee it.

5. Fraudulent and artificially inflated traffic

You must not use the Services for, participate in, or knowingly allow:

  • traffic pumping or access stimulation: generating calls to inflate termination revenue, including calls to free conference, chat or premium-rate services designed for revenue share;
  • International Revenue Share Fraud (IRSF): calls to high-cost or premium numbers to obtain a share of termination revenue;
  • artificially inflated traffic (AIT) in voice or messaging, including SMS pumping and one-time-password abuse;
  • wangiri: short “one-ring” calls designed to provoke call-backs to premium numbers;
  • SIM-box, bypass or grey-route termination: terminating international traffic onto mobile or local networks in a way that avoids applicable interconnect or regulatory charges, or reorigination of traffic to disguise its origin;
  • auto-generated calls with no meaningful human or business purpose, such as test calls at scale to a destination without our agreement; or
  • any scheme to obtain Services without paying, including through chargebacks, stolen payment methods or multiple trial accounts.

See the Fraud and Toll-Fraud Policy for your liability for fraudulent traffic.

6. Security abuse

You must not, and must not use the Services to:

  • scan, probe or test the vulnerability of any system or network, including ours, without written authorisation (to report a vulnerability, see the Security page);
  • attempt brute-force or credential-stuffing attacks against SIP registrars, endpoints, the console, the API or the MCP server;
  • launch or participate in denial-of-service attacks, SIP floods, or reflection or amplification attacks;
  • gain or attempt to gain unauthorised access to any Account, system or data, or bypass authentication, rate limits or account isolation;
  • distribute malware or use the Services as a command-and-control channel; or
  • interfere with other customers’ use of the Services.

7. Rate limits, capacity and CPS

7.1 Accounts, trunks, numbers, campaigns and API keys are subject to limits on concurrent channels, calls per second (CPS), messages per second, API requests and similar capacity. Limits are shown in the console or set by agreement.

7.2 You must not attempt to circumvent limits, for example by spreading traffic across Accounts or Credentials. Traffic that exceeds a limit may be rejected, queued or throttled. We may lower limits where needed to protect the network or comply with carrier or regulatory requirements.

8. High-risk destinations

8.1 We may block, restrict or require pre-approval for calls and messages to destinations that are frequently used for fraud, including certain international premium, satellite, and high-cost mobile ranges. New Accounts may start with international calling disabled or limited.

8.2 If you enable a high-risk destination, you accept full liability for traffic to it. We may disable any destination at any time without notice if we detect suspicious traffic or receive a carrier or regulatory warning.

9. Prohibited content and purposes

You must not use the Services to create, store or transmit, or to facilitate:

  • child sexual abuse material or any content that sexualises minors (we report such material to the relevant authorities);
  • content that incites violence, terrorism or hatred against protected groups;
  • harassment, threats, doxxing or non-consensual intimate content;
  • fraud, scams, phishing, smishing, vishing, impersonation of banks, government bodies, carriers or other organisations, and fake technical-support schemes;
  • sale of illegal goods or services, or of regulated goods (such as firearms, controlled substances, tobacco or gambling) where unlawful or not permitted by carrier rules;
  • content that infringes intellectual property, privacy or publicity rights;
  • unlawful collection of personal data, including covert recording or surveillance of individuals; or
  • any other illegal activity.

10. Messaging registration

10.1 For application-to-person messaging in the US, you must register your brand and campaigns for 10DLC, complete toll-free verification for toll-free senders, and use short codes only after approval, as described in the Messaging Policy. Unregistered or unverified traffic may be blocked or heavily filtered by carriers and may incur carrier fines that we will pass on to you.

10.2 Sender IDs, templates and use cases must match what was registered. Alphanumeric sender IDs must follow the rules in each destination country, as summarised in Country Requirements.

11. AI voice, synthetic media and impersonation

11.1 You must not use AI-generated or cloned voices, synthetic media or AI agents to impersonate a real person or organisation without their documented consent, or to mislead a call recipient about who is calling or whether they are speaking to a human.

11.2 Where the law requires it, and in any case where a reasonable person would expect to know, you must disclose that a call or message uses an AI or artificial voice. In the US, AI-generated voices in calls are treated as “artificial” voices under the TCPA, so the TCPA consent rules for artificial or pre-recorded voice calls apply.

11.3 You must not use the Services to produce deepfakes of candidates, public officials or private individuals, or to interfere with elections. See the AI and MCP Services Addendum for further rules.

12. Monitoring and enforcement

12.1 We do not routinely listen to calls or read messages. We monitor traffic patterns, signalling, CDRs, metadata, complaint data and carrier reports to detect abuse and fraud, and we may review Customer Content where needed to investigate a suspected breach, respond to a complaint, or comply with law, in line with the Privacy Policy.

12.2 If we believe this AUP has been breached, we may take any of the following steps, in any order and without prior notice where we consider it necessary:

  • issue a warning and request remediation;
  • request information, such as consent records, call scripts or KYC documents;
  • throttle traffic or reduce limits;
  • block specific numbers, destinations, sender IDs, campaigns, trunks or API keys;
  • remove or release numbers;
  • suspend a sub-account or the whole Account;
  • terminate the Account; and
  • recover from you any fines, carrier penalties, chargebacks and costs we incur.

12.3 We cooperate with upstream carriers, industry traceback groups (such as the US Industry Traceback Group), regulators and law enforcement in investigating abuse, and we may share relevant information with them as permitted by law and described in the Law Enforcement Guidelines. We respond to traceback requests and may be required to identify you as the originator of traffic.

12.4 Enforcement action does not limit your liability for Usage or our other rights under the Terms.

13. Reporting abuse

If you believe the Services are being used in breach of this AUP, including unwanted calls or messages from a sip.io number, please tell us through the Report Abuse page or at abuse@sip.io. Include the calling or sending number, the number called or messaged, the date and time with time zone, and a description.

14. Changes

We may update this AUP to reflect changes in law, carrier rules or abuse patterns. Changes are recorded in the Legal Changelog and take effect as described in the Terms of Service.