SRTP vs TLS: Which Encryption Does Your VoIP Provider Actually Use?

The Two-Sentence Version

TLS encrypts the signaling — the messages that say “ring this extension,” “the call is connecting,” “the call ended.” SRTP encrypts the audio itself — the actual conversation, byte by byte, as it crosses the network.

You need both. Many providers turn on one and quietly skip the other. That’s the whole article in a nutshell, but the details matter because they determine whether someone with the right tools and the wrong intentions can record your CEO’s conversations off your office Wi-Fi.

Why VoIP Calls Have Two Streams in the First Place

A traditional landline used one continuous circuit. VoIP doesn’t. Every call uses two parallel conversations between your phone and the provider’s network:

1. Signaling traffic (SIP) — short, frequent messages: “I’m here, register me.” “Please ring extension 102.” “The other side picked up.” “Hanging up now.”
2. Media traffic (RTP) — the actual voice, packetized and streamed, usually on different ports than the signaling.

That split is what makes VoIP fast and flexible. It’s also what makes it tricky to secure: you have to encrypt both streams independently, and many vendors only do one cleanly.

This is part of why the evolution from landlines to internet telephony changed the security model so much. The old wire-tap model assumed physical access to a copper pair. The new model assumes someone is already on your network.

TLS: The Envelope Around the Signaling

TLS stands for Transport Layer Security. It’s the same encryption layer that puts the lock icon next to URLs in your browser. On a VoIP system, TLS wraps the SIP signaling so an attacker watching the network can’t see:

• Your extension number and SIP credentials when your phone registers
• Who you’re calling and who’s calling you
• The duration and frequency of calls
• Caller-ID information, transfer destinations, and presence updates

Without TLS, SIP runs in cleartext on UDP port 5060. A laptop on the same Wi-Fi network with Wireshark can capture every registration message — and replay it. That’s how SIP brute-force and registration-hijack attacks work.

What to verify with your provider:

• TLS 1.2 minimum (1.3 strongly preferred)
• All endpoints required to use TLS (not just “supported”)
• Certificate verification enabled — not “accept any certificate”
• Port 5061 (SIP-over-TLS), not 5060 (plain SIP), is what your phones actually connect to

If your provider tells you SIP-over-TLS is “available on request,” that’s not security. That’s a checkbox.

SRTP: The Lock on the Audio Itself

SRTP stands for Secure RTP. RTP is the protocol that streams the audio packets that make up the actual voice on a call. SRTP encrypts those packets so even if someone captures the media stream, they can’t reassemble it into listenable audio.

Here’s the part that surprises most buyers: TLS does not encrypt the audio. TLS protects the call setup. The audio is a completely separate stream, and unless SRTP is explicitly enabled, that stream is just unencrypted voice flying across the internet in standard codecs that any commodity tool can decode.

What to verify:

• SRTP enabled by default on all endpoints
• AES-128 minimum encryption (most providers use AES-128 or AES-256)
• Key exchange via SDES over TLS, DTLS-SRTP, or ZRTP — not via cleartext SIP (which defeats the point)
• Failover behavior: if SRTP negotiation fails, does the call drop, or does it silently downgrade to unencrypted RTP? The right answer is drop.

That last one is critical. A provider that “supports SRTP” but quietly falls back to unencrypted RTP when negotiation fails is, in practice, an unencrypted provider for any call where the negotiation has a hiccup.

The Combinations You’ll Actually See in the Wild

If you’re in a regulated industry — healthcare, legal, finance, education — the bottom row isn’t a nice-to-have. It’s the floor. Our hub on HIPAA-compliant business phone systems for healthcare providers goes into the HIPAA-specific overlay.

Where Encryption Actually Lives (and Where It Doesn’t)

A common misconception: “encrypted phone service” means the call is encrypted end-to-end between the two parties. It almost never does.

What you actually get with SIP-TLS + SRTP is encryption between:

• Your phone and your provider’s session border controller
• Your provider’s edge and any peer provider’s edge

What happens inside the provider’s network — call recording, transcription, AI summaries, CRM write-back — is up to the provider’s internal controls. Which is exactly why SOC 2 audits and BAAs matter alongside encryption. We cover the provider-side controls more in how VoIP providers ensure call quality and security.

For PSTN calls (calls to or from a regular phone number), the moment the call leaves your provider’s network and lands on the traditional phone network, the encryption ends. That’s not a vendor failure — it’s how the PSTN works. The mitigation isn’t more encryption; it’s not putting sensitive identifiers (full SSNs, credit card numbers, PHI) on PSTN calls in the first place.

A 10-Minute Self-Audit

If you want to know whether your existing phone service uses real encryption, you can usually figure it out in ten minutes:

1. Open your provider’s admin portal. Look for a “security” or “encryption” section. Note whether SRTP is enabled and at what level.
2. Check your desk phone’s web UI. Most Yealink, Grandstream, Polycom, and Snom phones expose the current transport in the status page. You want to see TLS for signaling and SRTP for media.
3. Look at your softphone settings. Most softphone apps show the connection method in the account settings.
4. Ask your provider for a screenshot of the policy. If they can’t produce one, that tells you something.
5. If you have a network team, ask them to run a packet capture during a test call. SRTP packets are easy to identify — they have encrypted payloads. Unencrypted RTP shows up as plain G.711 or G.722 codec data.

If steps 1–4 don’t give you confidence, step 5 will give you certainty.

The Settings That Often Get Forgotten

Even on a properly encrypted provider, a few settings still trip people up:

Voicemail-to-email. Your audio is encrypted in transit, but if voicemails are emailed as plain MP3 attachments, they sit in inboxes and email backups indefinitely. Look at the voicemail-to-email transcription configuration and consider link-based access with expiring URLs instead.

Call recording storage. SRTP protects audio in flight. It doesn’t say anything about how recordings are stored at rest. Verify AES-256 at rest, customer-controlled retention, and audited access. Our VoIP call recording for small business overview is a good baseline.

Mobile apps on personal Wi-Fi. A mobile app on home Wi-Fi or a coffee-shop network is still subject to the same TLS/SRTP rules. If the app downgrades when on cellular vs Wi-Fi, you have a problem.

Fax over IP. Fax doesn’t use RTP — it uses T.38. Encryption for T.38 is its own story and frequently isn’t implemented.

What This Means When You’re Shopping

When you’re evaluating any phone service for business, the encryption conversation should take five minutes and produce documentation. If a sales rep deflects, hedges, or says “our network is private so encryption isn’t needed,” that is the moment to politely end the call. There is no network so private that internal encryption is unnecessary.

A good buyer’s framework includes:

• Explicit confirmation of TLS 1.2+ for signaling
• Explicit confirmation of SRTP for media with no silent downgrade
• A written description of at-rest encryption for recordings, voicemails, and transcripts
• Identification of where data is stored (data residency

For more general buying criteria, our VoIP buyer’s guide and the broader complete guide to business telephone services in 2026 cover the wider scope.

The Bottom Line

TLS and SRTP aren’t interchangeable. They protect different parts of the same call. A vendor that only does TLS is encrypting the envelope and leaving the letter unread on the table. A vendor that does both — with no silent downgrade, with verified certificates, and with auditable configuration — is doing the minimum required to call themselves secure.

If you’re not sure where your current provider stands, run the 10-minute audit above. The answer will either confirm your confidence or hand you a clear reason to consider switching your business phone system.

When you’re ready to compare options, the team at Vistanet is happy to walk through your current setup line by line. You can reach us through our contact page — and the broader pillar guide to secure business phone service covers the rest of the security stack beyond encryption.