Edesy number masking protects data with Bearer API keys that are shown once and can be revoked, HMAC-SHA256 signed webhooks, recordings in encrypted cloud storage opened through signed links, workspace roles, and sessions that expire. Edesy does not claim SOC 2 or ISO 27001 certification. Here is what we provide and what you should do.
Number masking at a glance
Requests use Authorization: Bearer with a vp_ key. The full key is shown only once; revoke and replace it from the portal if it leaks.
Event and routing webhooks are signed with HMAC-SHA256 over the raw body (X-Edesy-Signature). Verify before you trust a payload. The routing secret can be rotated.
Recordings are kept in encrypted cloud storage and served through short-lived signed links.
Members are owners, admins or members. Only owners and admins can invite people.
Sessions end after expiry_minutes, after max_calls, or when you end them, so masked links do not live forever.
Numbers are issued only after business KYC, so every masked number belongs to a verified account.
Keep API keys in environment variables or a secrets manager, never in source control or client apps.
Recompute the HMAC on the raw body and compare it before acting on an event or routing request.
Turn recording on only for numbers where you need audio.
Remove members who leave and rotate keys they had access to.
Get started on the self-serve portal. Rs 1.50 per minute plus number rental. New accounts get a Rs 20 welcome credit; no card needed to sign up.