RMT Engineering Logo
Cloud telephony

Cloud Telephony

Every Client conversation through voice raises questions like which carrier the call arrives on, how the audio is carried, where the recording is written , who holds the key that opens it and many more. Sll such queries are seamlessly addressed though OptiML Cloud Telephony Solution.

  • Allows to bring your own carrier
  • Open standards on the media plane
  • Recordings encrypted with your key
We reply within one business day. No newsletter.
99.9% Monthly uptime commitment
4 Telephony providers, SIP both ways
AES-256-GCM Encryption, a key per recording
SIP both ways Ingress and egress, on your account

What's in a conversation

Cloud telephony here means three specific things. The carrier connection, which is SIP ingress and egress, on a provider account that stays in your name. WebRTC media plane, open and standards-based rather than a proprietary tunnel nobody outside RMT gets to look inside. And custody of what a call leaves behind, where every recording is encrypted under a tenant key that lives in Clients own KMS. What the agent says during the call has its own page.

Nil Dependancy

OptiML runs in Client preferred Cloud solution and region, everything from infra to telecom is provisioned for a smother connectivity and call landing experience. Implementation to upgrade all-in-one solution extended with no hassles at Client end. Complete solution of a contact center requirement like call origination ,call termination to call recording to call storage, call encryption and data handover becomes a managed offering for integrated experience.

How it fits together

The path a conversation takes through Cloud Telephony

A call arrives over SIP from a telephony provider account the customer holds, is carried on a WebRTC media plane inside OptiML Cloud in the region the customer chose, passes through turn-taking and the speech and model layer, and is recorded under envelope encryption with the tenant key held in a KMS the customer controls YOUR TELEPHONY PROVIDER ACCOUNT SIP trunk · LiveKit, Twilio, Telnyx or Vonage SIP INGRESS AND SIP EGRESS OPTIML CLOUD · YOUR CHOSEN REGION Media plane · WebRTC, open and standards-based Turn-taking SILERO VAD · 300 / 700 / 1200MS Conversation layer 8 STT · 11 LLM · 8 TTS · FAILOVER Recording · AES-256-GCM envelope, a key per recording TENANT KEY IN YOUR KMS · YOURS TO ROTATE OR REVOKE PER-STAGE LATENCY TRACES FROM TRANSCRIPTION TO SYNTHESIS TRACES, METRICS AND PII-REDACTED LOGS EXPORTED INTO YOUR OWN STACK NOT OFFERED: INSTALLATION INSIDE YOUR OWN PERIMETER

The Call Carrier layer

SIP ingress and egress. Calls arrive and leave over a provider account that stays in Clients name, on terms agreed upon.

The Media layer

WebRTC carries the audio, open and standards-based. Turn-taking sits on top of it, with endpointing set per agent rather than guessed once for everyone who rings in.

The Custody layer

Each recording gets its own AES-256-GCM key, wrapped by a tenant key held in your KMS. Revoke that key and the audio is unreadable, through an action you take rather than one you request.

The process

How It Works

The four stages, end to end

Four stages between a ringing trunk and a trace somebody can read the next morning. Only the first two belong to this page. The third is the conversation layer, which has a page of its own, and the fourth is what the call leaves behind.

  1. Connect the carrier

    A call arrives over SIP, or leaves over it. LiveKit, Twilio, Telnyx and Vonage are the providers the platform speaks to, with ingress and egress both configured, so inbound and outbound run over one route rather than two arrangements that drift apart. The provider account stays in your name and nothing about those commercial terms has to change hands.

  2. Media on open standards

    Audio is carried on WebRTC. Silero voice activity detection and end-of-utterance detection work out when a caller has actually finished rather than paused for breath, at an endpointing eagerness set per agent: 300ms eager, 700ms normal, 1200ms patient. Barge-in is gated, so speaking over the agent stops it, and false-interruption resume means a cough does not.

  3. The conversation layer on top

    From here the call either goes straight to a person or runs through speech-to-text, a model and speech synthesis. Eight engines on each speech side, eleven model providers, and a speech-to-speech route through OpenAI Realtime where the round trip matters more than the choice of parts. Failover between providers is automatic, so an outage at one of them does not drop the call.

  4. Recorded, traced and reported

    The recording is written under envelope encryption. Every stage of the turn is timed on its own, from transcription through to synthesis, and a turn that breaks its sub-second target is flagged with the stage responsible. Traces, metrics and PII-redacted logs are exported into your own monitoring stack with no access to anyone.

Features

Every capability you need in one module

1. One adapter, many providers

Eleven model providers, eight speech-to-text engines and eight text-to-speech engines sit behind a single adapter layer, with a speech-to-speech route through the OpenAI Realtime low-latency path for the cases where the round trip matters more than the choice of parts. Failover is automatic, and a provider outage does not drop a call. That is the only property of this arrangement a caller would ever notice. The rest of it is procurement: changing an engine is configuration rather than a rebuild, and no single vendor gets to be the reason your voice operation stops.

11 LLM providers 8 speech-to-text engines 8 text-to-speech engines OpenAI Realtime speech-to-speech

Where the per-stage latency traces are read

Behind one adapter layer
Speech-to-textDeepgram, Whisper, AssemblyAI, Google, Azure, AWS Transcribe, Bhashini, Sarvam
Text-to-speechElevenLabs, OpenAI, Azure, Google, PlayHT, Cartesia, Bhashini, Sarvam
Speech-to-speechOpenAI Realtime low-latency path
Large language models11 providers
FailoverAutomatic. A provider outage does not drop the call
Latency evidencePer-stage traces from transcription to synthesis, with sub-second target-breach flagging

2. Recordings, and the key that opens them

Custody is the part of a security review that cannot be talked around. Either you can make the audio unreadable without asking us, or you cannot.

Recordings are held under AES-256-GCM envelope encryption, with a key generated per recording and wrapped by a tenant key that lives in KMS. That tenant key is yours. Rotate it or revoke it and the recordings become unreadable through an action you take, not a request you raise and then chase. Traffic is TLS in transit and mTLS between services. Underneath, tenant isolation is enforced by PostgreSQL row-level security across 231 tables, which means the database refuses the row rather than the application remembering to.

  • AES-256-GCM envelope encryption, a key per recording
  • Tenant key held in your own KMS, yours to rotate or revoke
  • TLS in transit, mTLS between services
  • Row-level security on 231 tables, so isolation is enforced by the database

The controls a security reviewer asks for

3. Where it runs

OptiML Cloud, multi-tenant, in a region you name, with the first tenant up in minutes. On the Enterprise plan there is a dedicated single-tenant instance, and there is customer-managed data residency, which puts the database and object storage in your own cloud account while the application and the media plane keep running in OptiML Cloud. That option has consequences worth reading in full, so it is set out on the hosting page rather than compressed into something reassuring here. Uptime carries a 99.9% monthly commitment with published credits, held up by multi-region failover, autoscaling and restores somebody has verified. Regional compliance packs, sixteen and counting, carry the jurisdiction-specific rules.

  • OptiML Cloud, multi-tenant, in your chosen region, first tenant in minutes
  • Dedicated single-tenant instance on Enterprise
  • Customer-managed data residency on Enterprise, described in full on the hosting page
  • 99.9% monthly uptime commitment, with a published credit schedule
  • 16+ regional compliance packs

Hosting, residency and the shared-responsibility line

What we do not do

On-premises or customer-perimeter installation of the platform itself is not offered. That is a deliberate choice rather than a gap in the roadmap: one release train for every tenant is what keeps upgrades continuous and what makes a 99.9% monthly commitment something RMT can be held to. If your obligation is about where conversation data rests, customer-managed data residency answers it. If it is about where the software executes, we are not the right vendor for you.

Read the residency option in full

4. Configured as code

A Terraform provider covers agents, flows, knowledge sources, phone numbers, integrations, users and roles, so a change to the telephony configuration is reviewed like any other change and reverted the same way. Around it sit a REST API with OpenAPI, eleven client SDKs, a CLI, HMAC-signed webhooks and an MCP server SDK. The telemetry runs in the other direction: OpenTelemetry traces, Prometheus metrics and PII-redacted structured logs are exported into your own Datadog, Honeycomb or Sentry, alongside per-stage latency traces from transcription to synthesis that flag a turn breaking its sub-second target. Managed does not have to mean opaque.

  • Terraform provider for agents, flows, knowledge sources, phone numbers, integrations, users and roles
  • REST API with OpenAPI, 11 client SDKs and a CLI
  • HMAC-signed webhooks and an MCP server SDK
  • OpenTelemetry, Prometheus and PII-redacted logs into Datadog, Honeycomb or Sentry

What the platform looks like to an engineering team

Use Cases

Where Cloud Telephony delivers value

SIP ingress and egress, on your own provider account

The carrier contract nobody wants to reopen

A retail bank replacing an ageing voice bot (illustrative)

Scenario

The telephony arrangement has two years left to run and was negotiated by people who have since moved on. Rather than unpick it to buy software, the existing trunk is routed to the platform over SIP, with egress configured at the same time so campaigns dial out over the same path the inbound calls arrive on.

Outcome

The software decision stops depending on the carrier decision. Inbound and outbound share one route, which means one recording store, one encryption arrangement and one set of latency traces instead of two that have to be reconciled.

Envelope encryption with a customer-held tenant key

A key revoked without raising a ticket

An insurer under a domestic data mandate (illustrative)

Scenario

The security review ends where these reviews always end. If we tell you to stop being able to read our recordings, what do we have to do, and how long does it take. The tenant key already sits in a KMS the insurer runs, and every recording carries its own AES-256-GCM key wrapped by that one.

Outcome

The answer is a KMS operation on their side rather than a request to RMT. Rotation and revocation are theirs to perform, which is a shorter thing to put in front of a regulator than a paragraph about our internal access controls.

Automatic failover behind one adapter layer

A provider has a bad afternoon

A regional telecom operator at evening peak (illustrative)

Scenario

A speech or model provider begins degrading during the busiest two hours of the day. Eleven model providers and eight engines on each speech side sit behind one adapter, so the call moves rather than ends, and the per-stage latency trace records which stage the time went to.

Outcome

Nobody has to explain to the floor why calls stopped at seven in the evening. The next morning the trace says whether it was transcription, the model or synthesis, and the question is settled by a number rather than by whoever is most confident.

FAQ

Questions,
answered

What teams ask us before they roll out Cloud Telephony — how it works, what it needs from your side, and what happens when it gets something wrong

Still not sure?

Talk to a specialist and get a straight answer.

Ask our team

Nothing. There is no appliance, no media server and no software of ours running on your network. OptiML Cloud Telephony is a managed service in the region you name, and the only thing that reaches your side is the SIP route between your provider account and the platform. That is the whole of it, and it is also why the answer to the datacentre question below is no.

Yes, and that is the assumption the whole layer is built on. The platform speaks SIP to LiveKit, Twilio, Telnyx and Vonage, ingress and egress both, so calls arrive and leave over a provider account that stays in your name and on your own commercial terms. Outbound is not a separate arrangement bolted on afterwards, which is what keeps one recording store and one set of latency traces behind both directions.

No. On-premises or customer-perimeter installation of the platform itself is not offered, and that is a deliberate choice rather than a gap in the roadmap. One release train for every tenant is what makes upgrades continuous and what makes a 99.9% monthly commitment something RMT can be held to. What can move is the data. On the Enterprise plan, customer-managed data residency puts the database and object storage in your own cloud account, while the application and the media plane keep running in OptiML Cloud. The hosting page sets out what that covers and what it does not.

Each recording is encrypted with its own AES-256-GCM key under envelope encryption, and that key is wrapped by a tenant key held in KMS. The tenant key is yours. Rotate it or revoke it and the recordings become unreadable through something you do, rather than something you ask us to do. Traffic is TLS in transit and mTLS between services, and tenant isolation underneath is enforced by PostgreSQL row-level security across 231 tables rather than by application code.

At the provider layer, failover is automatic — eleven model providers and eight engines on each speech side sit behind one adapter, so an outage at one of them moves the call instead of ending it. At the platform layer, the SLA carries a 99.9% monthly uptime commitment with a published credit schedule, backed by multi-region failover, autoscaling and restores that have been verified rather than assumed. Either way you are not depending on us to tell you first. OpenTelemetry traces, Prometheus metrics and PII-redacted logs land in your own Datadog, Honeycomb or Sentry, and a turn that breaches its sub-second target is flagged with the stage that caused it.

Keep exploring

Additional supporting modules

Native modules that share the same record, knowledge and governance

Platform module

Voice AI Agents

What happens once the call connects: turn-taking, endpointing and the speech and model layer sitting above this one.

Explore
Platform module

Deployment & Hosting

Where the platform runs, what customer-managed data residency actually moves, and the shared-responsibility line in full.

Explore
Platform module

Inbound Contact Centre

What the platform does with a call once it has arrived: routing, resolution and handover to a person.

Explore
Platform module

Outbound & Dialer

The other direction over the same SIP egress, with dialing modes and campaign control.

Explore
Talk to a specialist

Bring the carrier, and the questionnaire

Two things settle this page faster than a demo does. Tell us which telephony provider you are on and how your trunks are arranged today, and send the security questionnaire before the call. The encryption, custody and hosting answers come back in writing, which usually leaves two or three questions specific to your own jurisdiction. Those are the ones worth an hour of somebody senior.

  • 30 minutes
  • Questionnaire answered in writing beforehand
  • Your carrier account, your keys

Book your slot

Leave your email and our team will come back to you within one business day.

or reach us directly
Call our team Email us

Your details stay private. We never share them.

This website uses cookies.

Cookies are small text files that allow us to create the best browsing experience for you on our site. By continuing to use this website or clicking "Accept & Close", you are agreeing to our use of cookies. To understand how we use cookies or how to manage them, please see our cookies policy.

Ask OptiML

Powered by RMT Engineering