CPNI Policy

Version 2026-11-06 · Effective 2026-11-06

1. Purpose and scope

This policy describes how Voxgrid Inc (“sip.io”) protects Customer Proprietary Network Information (“CPNI”) as required by section 222 of the Communications Act of 1934, as amended (47 U.S.C. § 222), and the Federal Communications Commission’s rules at 47 C.F.R. §§ 64.2001–64.2011 (the “CPNI Rules”). It applies to our interconnected VoIP and other telecommunications services provided in the United States.

This policy supplements our Privacy Policy.

2. What CPNI is

CPNI is information that relates to the quantity, technical configuration, type, destination, location and amount of use of a telecommunications service subscribed to by a customer, that is available to us solely because of the customer relationship, together with information in bills for those services. Examples include:

the numbers a customer calls or is called from, and the time, date and duration of calls;
call detail records (CDRs) and message metadata;
the services, numbers and trunks a customer subscribes to;
usage volumes, rates and charges on invoices and wallet statements.

CPNI does not include subscriber list information (name, address and number published in a directory), or aggregate customer information from which individual identities and characteristics have been removed.

“Call detail information” is a subset of CPNI: any information about the numbers called or received, and the time, location or duration of any call.

3. How we protect CPNI

We protect CPNI with the measures described in our Security Overview, including:

per-account isolation on every database query;
role-based access in the console and scoped API keys;
least-privilege, MFA-protected access for our personnel, with logging of access to customer records;
encryption in transit and at rest;
monitoring for unusual access patterns and attempts to obtain CPNI by pretexting.

4. Authentication before disclosure

We disclose CPNI only to the customer of record or to a person the customer has authorised.

Online access. Access to CPNI through the console, API or MCP server requires authentication with a password, single sign-on, or a scoped API key. Passwords are not based on readily available biographical information or account information. If a password is forgotten, we use a reset method that does not rely on readily available biographical or account information, such as a link sent to the email address of record.
Telephone requests. We do not disclose call detail information over an inbound telephone call unless the caller provides a password set up for that purpose. Without the password, we will provide call detail information only by sending it to the address of record (postal or email) or by calling the telephone number of record. If the customer provides the call detail information during the call themselves, we may discuss that information without further authentication.
In person. Where we have a retail location or in-person meeting, we disclose CPNI only after the customer presents valid government-issued photo identification matching the account.
Business customers. As permitted by 47 C.F.R. § 64.2010(g), business customers with a dedicated account representative and a contract that specifically addresses the protection of CPNI may be subject to authentication terms set out in that contract.

5. Notification of account changes

We notify the customer immediately when any of the following is created or changed: a password, a customer response to a back-up means of authentication, an online account, or an address of record. Notice is sent to the telephone number or address of record (not the new contact information) and does not reveal the changed information.

6. Use of CPNI

6.1 Permitted uses without consent. We use, disclose or permit access to CPNI without customer approval only as permitted by law, including to:

provide, bill and collect for the services the customer subscribes to;
protect our rights and property, our customers and other carriers from fraudulent, abusive or unlawful use of the services, including toll fraud and illegal robocalling;
provide inside wiring installation, maintenance and repair;
respond to emergency calls and provide location information to emergency services;
comply with lawful process (see our Law Enforcement Guide) and industry traceback requests.

6.2 No marketing without consent. We do not use, disclose or permit access to CPNI to market services outside the categories of service to which a customer already subscribes, and we do not sell CPNI or share it with third parties for their marketing. If we ever wish to do so, we will first obtain the customer’s opt-in or opt-out approval as required by the CPNI Rules, provide the required notices, record the approval, and maintain records of it for at least one year.

6.3 Records. We maintain a record of any sales and marketing campaigns that use CPNI, and of any instances where CPNI was disclosed to or accessed by third parties, for at least one year. Marketing campaigns that use CPNI require supervisory review and approval.

7. CPNI breaches

7.1 A “breach” occurs when a person, without authorisation or exceeding authorisation, intentionally gains access to, uses or discloses CPNI.

7.2 Notice to law enforcement. As soon as practicable, and in no event later than seven business days after reasonable determination of a breach, we will notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility designated by the FCC.

7.3 Notice to customers. We will notify affected customers after the waiting period required by the CPNI Rules, unless law enforcement directs us to delay notice. If we believe there is an extraordinarily urgent need to notify customers sooner to avoid immediate and irreparable harm, we will consult the relevant investigating agency before doing so.

7.4 Records. We maintain records of breaches discovered and notifications made, including dates, a description of the CPNI involved and the circumstances, for at least two years.

7.5 Customer personal data breaches under other laws are handled as described in the Data Processing Addendum.

8. Annual certification

An officer of sip.io, acting as an agent of the company, will sign and file with the FCC an annual compliance certificate by March 1 of each year, together with a statement explaining how our operating procedures ensure compliance with the CPNI Rules, an explanation of any actions taken against data brokers, and a summary of customer complaints received in the prior year concerning unauthorised release of CPNI.

9. Employee training and discipline

All personnel with access to CPNI are trained on when they may and may not use or disclose CPNI, how to authenticate customers, and how to recognise and report pretexting. Training occurs at onboarding and at least annually. Violations of this policy are subject to disciplinary action, up to and including termination of employment or contract.

10. Resellers and white-label partners

Resellers and white-label partners that provide services to their own customers using sip.io are themselves responsible, to the extent they are carriers or interconnected VoIP providers under US law, for complying with the CPNI Rules for their customers, including authentication, notices, consent, breach notification and annual certification. Resellers must:

not access or use CPNI of their sub-account customers except as permitted by the CPNI Rules;
apply authentication controls at least as strong as those in section 4 when disclosing CPNI to their customers;
notify sip.io at legal@sip.io promptly, and in any event within 72 hours, of any suspected CPNI breach involving the Services; and
cooperate with sip.io’s investigation and notification.

11. Contact

Questions about this policy, or requests relating to CPNI, can be sent to privacy@sip.io.