SRTP
SRTP, or Secure Real-time Transport Protocol, is a security profile for real-time media that encrypts RTP payloads and helps a receiver detect tampered or replayed packets. It protects call audio while that media travels between endpoints that share the required cryptographic keys.
How SRTP works
The sender encrypts the media payload and adds authentication data before transmitting each protected packet. The receiver verifies the packet, rejects invalid or replayed data, and decrypts the audio for playback or processing. This preserves the low-delay behavior needed for live speech while adding confidentiality and integrity controls to RTP.
SRTP does not decide how endpoints obtain their keys. A separate negotiation mechanism establishes the cryptographic material used by the media session. WebRTC commonly pairs SRTP with a handshake performed over the live connection, while SIP-based systems can negotiate protected media in several ways. Both endpoints must agree on compatible methods.
The protection applies to the media path, not automatically to every part of a call. SIP signaling, phone numbers, call metadata, application events, recordings, and transcripts require their own controls. SRTP also protects a particular media leg. If a gateway terminates browser media and creates a new telephone-network leg, the gateway can access the decoded audio and must secure the next leg separately.
Why SRTP matters for AI phone calls
AI phone calls often cross several components: a caller endpoint, a carrier or browser gateway, real-time processing services, and an agent endpoint. Security reviews should map where each encrypted media leg starts and ends rather than accepting a broad statement that “the call is encrypted.” That map reveals where audio is decrypted for processing and which systems can access it.
SRTP is an important transport control, but it is not a complete privacy or compliance program. Storage encryption, access permissions, retention rules, recording notices, integration security, and incident handling remain separate decisions. During deployment, verify that fallback routes do not silently move from protected media to plain RTP and that monitoring can identify negotiation failures without exposing sensitive audio.