Network design for voice AI in your VPC
One inbound path from the internet, AWS services over private endpoints, and an allow-list for everything else. Agent tools reach your internal systems without the public internet.
One inbound path
The media load balancer is the only part of the call plane the internet can reach. It checks three things.
Carrier address ranges
Call events are accepted only from the address ranges Telnyx publishes. Anything else gets a 403.
Signed events
Each call event is checked against Telnyx's Ed25519 signature before anything acts on it.
Signed audio streams
An audio stream is accepted only with an expiring token that names the call, the worker and its slot.
Egress allow-list
Outbound traffic passes AWS Network Firewall in our accounts, or your own egress controls in yours.
| Destination | Purpose | Protocol |
|---|---|---|
| Telnyx call control API (api.telnyx.com) | Answer, transfer and end calls | HTTPS |
| Deepgram Sydney (api.au.deepgram.com) | Speech-to-text and text-to-speech | WSS and HTTPS |
| Deepgram licence server (license.deepgram.com) | Licence checks for self-hosted speech, from one proxy host | HTTPS |
| Your agent tools | The APIs your agents call | HTTPS, or PrivateLink |
| Our paging service | Alarm names for the on-call engineer | HTTPS |
| ElevenLabs, Cartesia or Fish Audio | Text-to-speech, only for an agent that uses their voices | WSS |
AWS services over VPC endpoints
Calls to AWS never cross the public internet.
Interface endpoints
Bedrock runtimeKMSSQSECRCloudWatch LogsSTSSystems ManagerGateway endpoints
S3DynamoDBPrivate links to your systems
Shared and Dedicated
You expose an internal API as a VPC endpoint service, and the call plane reaches it through AWS PrivateLink in Sydney. A site-to-site VPN or a Transit Gateway attachment covers routed access.
Hybrid and Your account
The call plane sits inside your network, so agent tools call internal systems over your own routing and security groups.
Phone lines
Numbers on our carrier
Telnyx, a licensed Australian carrier, provides or ports local, national and toll-free numbers, with media anchored in Sydney.
SIP from your phone system
Your PBX or session border controller connects to a Telnyx SIP connection by credentials, IP address or FQDN. Calls reach the agent, and transfers go back to your phone system over SIP.
Security questionnaires
We answer security questionnaires in writing and take your team through the architecture on a call. Send yours to hello@verticalai.com.au.