Session Border Controller, as a service
A secure, smart SIP edge in front of your existing PBX, softswitch or trunks: fraud protection, multi-carrier routing, built-in trace and real-time quality monitoring. No appliance to run, and we keep the connectivity and the quality, so your calls stay crystal clear.
- No appliance to run
- SIP firewall
- Built-in SIP trace
- Multi-tenant
See every call, route and endpoint, live
Gauges for ASR, MOS and capacity, a live global edge map, per-carrier quality and the SIP trace behind any call, all on one dashboard.
A security and visibility layer at the edge of your voice network
A Session Border Controller secures, normalizes and controls the SIP traffic between the internet, your carriers and your phone system. Owning one means an appliance, a SIP/RTP specialist and a 24/7 patching treadmill, which is why most teams can no longer justify it.
SBC as a Service puts that edge in front of your existing infrastructure as a managed, multi-tenant service, so you get the protection, the interworking and the call tracing, with nothing to deploy.
The SBC you do not have to run
Two things no one else markets well together: no appliance to run, and every call traceable.
No hardware, no VM to patch
Incumbents ship an appliance or a VM image you size, license, certify and patch. We run the SBC, the HA and the lifecycle. You get the capability, not the project.
In front of your existing stack
It is an edge layer, not a forklift. Keep your Asterisk, FreeSWITCH, BroadWorks, 3CX, Cisco or SIP trunks. We add the security, trace and analytics perimeter.
Multi-tenant by design
Onboard the next customer with a config change, not a new box. Per-tenant isolation makes self-serve and per-tenant economics possible.
Observability built in
Per-call SIP ladder diagrams, PCAP export and MOS, native to the product. No separate Homer or monitoring stack to stand up and feed.
Live in minutes
Point your trunk or PBX at us and we front it. API-driven provisioning, not a six-week professional-services engagement.
Carrier-grade, proven
The same multi-tenant SBC estate that already powers our softphone bridge and Teams Direct Routing, now available standalone.
A SIP firewall, not a feature checkbox
SIP was built for interoperability, not security. We put the threats you actually face in 2026 behind a hardened edge.
SIP firewall & DDoS shield
Topology hiding plus mitigation for SIP/UDP floods, INVITE and REGISTER storms, and TDoS, so your softswitch and registrar are never exposed to the public internet.
Toll-fraud protection
Call admission control, per-endpoint spend and concurrency caps, premium-rate and international blocking, and anomaly detection that stops a five-figure overnight bill.
Rate limiting & auto-banning
Line-rate CPS and registration rate limits, plus dynamic IP blacklisting that blocks SIPVicious scanning and brute-force on the first abnormal burst.
Encryption & compliance
TLS 1.3 and WSS signalling, SRTP and DTLS media, mutual TLS where needed. Encrypted end to end, terminated and managed for you.
Finally, see why a call failed
The hardest question in VoIP is "why did this call drop?" Standing up Homer or VoIPmonitor is a project, and it still chokes on TLS and video. We make every call traceable, natively.
- Per-call SIP ladder diagrams, search by Call-ID, From or To
- Full-fidelity capture and PCAP export, encrypted calls included
- MOS, jitter and packet-loss scoring on every leg
- CDRs and real-time registration and reachability dashboards
We take the connectivity and the quality, so your calls stay crystal clear
Beyond securing the edge, we route every call across your carriers for the best path and price, watch quality in real time, and tell you the moment anything drifts.
Multi-carrier routing engine
Route every call across carriers with least-cost and quality-based selection on ASR, ACD and MOS. If a route degrades or a carrier fails, traffic moves in real time, with no dropped calls.
Quality monitoring
Live ASR, ACD, MOS and round-trip time on every call, route and carrier, plus jitter and packet loss, so a quality or completion problem shows on a dashboard, not in a complaint.
Proactive alerts
Thresholds on ASR, MOS, registration, fraud and capacity push to email, Slack or webhook, so your team acts before a ticket is even opened.
Rating, billing & cost control
Rate and bill calls per tenant, and watch carrier spend by route and destination, so a cost spike is caught early. Available as an add-on.
An edge in front of your voice, in three steps
Point your trunk or PBX at us
Send your SIP toward the Spanvox edge, or have your carrier peer with us. No rip-and-replace.
We front and secure it
Topology hiding, firewall, fraud caps, rate limits and TLS/SRTP, with SIP normalized between every carrier and your core.
Trace and analyze every call
Ladder diagrams, PCAP, MOS and CDRs in real time, so you secure and troubleshoot from one portal.
Sits in front of the SIP infrastructure you already run
Protect your margin, multi-tenant and white-label
Secure carrier interconnects and subscriber-facing infra, stop fraud that hits your P&L, and front hundreds of customers from one platform. Resell the SIP trace and analytics dashboard under your own brand.
For ITSPsA perimeter for your PBX, in minutes
Put security and tracing in front of your existing phone system, SIP trunks or Teams Direct Routing without owning an SBC or hiring a voice-security specialist. Pass the security review, cut troubleshooting time.
For enterprisesCarrier-grade under the hood, watched around the clock
The parts that decide whether you can build a business on us: a globally redundant network, real security, and a team that never sleeps. Serious infrastructure for serious operators.
Globally redundant node pool
Registrations and calls run on a pool of redundant nodes across regions, on an anycast backbone. There is no single point of failure: if a node degrades, traffic shifts the same second.
GeoDNS routing & failover
GeoDNS steers every device to the nearest healthy node and reroutes automatically on failure, so latency stays low and outages stay invisible to your customers.
VoIP security, end to end
TLS and WSS signalling, SRTP and DTLS media, terminated on hardened Session Border Controllers. Credentials are encrypted at rest and never exposed to the device.
Toll-fraud protection
Per-endpoint concurrency caps, registration rate-limiting and automatic IP banning contain abuse before it ever reaches a bill, the number-one worry for any ITSP.
Observability as standard
A real-time view of every registration leg, live device, call and CDR with MOS scoring. It ships with the platform, not as a paid add-on.
24/7 NOC
A network operations centre watches the platform around the clock, with proactive response, so problems are caught and fixed before your customers ever feel them.
SBC as a Service, answered
What is SBC as a Service (SBCaaS)?
A cloud-hosted Session Border Controller delivered as a managed, multi-tenant service that secures, normalizes and traces your SIP traffic, with no hardware or VM for you to deploy.
How is SBCaaS different from a hardware or cloud SBC?
A hardware or VM SBC is something you buy, size, certify and patch yourself. SBCaaS is fully operated by us, multi-tenant, and turned on in minutes, with observability built in.
Do I have to replace my PBX or SIP trunks?
No. Spanvox sits in front of your existing PBX, softswitch or trunks as an edge layer. You keep Asterisk, FreeSWITCH, BroadWorks, 3CX, Cisco or Teams.
How does it stop toll fraud and DDoS?
Topology hiding plus a SIP firewall, line-rate rate limiting, dynamic IP blacklisting, INVITE and REGISTER flood mitigation, call admission control, and premium-rate and international blocking.
What is SIP trace and why does it matter?
Per-call signalling capture with ladder diagrams and PCAP that shows exactly why a call failed. It is built in, including for encrypted calls, so there is no separate monitoring stack to run.
Does it support Microsoft Teams Direct Routing?
Yes. You can front Teams Direct Routing and pure-SIP or BYOD endpoints without running your own certified SBC.
Is it multi-tenant and can ITSPs white-label it?
Yes, multi-tenant by design with per-tenant isolation and white-label options for resellers and carriers.
Can you route calls across multiple carriers?
Yes. The routing engine does least-cost and quality-based routing across your carriers with automatic failover, so if a route degrades or a carrier goes down, traffic reroutes in real time with no dropped calls.
Which call-quality metrics do you track?
Per call, route and carrier we track ASR (answer-seizure ratio), ACD (average call duration), MOS (mean opinion score) and RTT (round-trip time), plus jitter, packet loss and registration health, live and in CDRs.
How will I know if call quality drops?
Real-time ASR, MOS and round-trip-time monitoring with threshold alerts by email, Slack or webhook, so you find a quality or completion problem before your customers do.
Can I rate and bill calls and monitor costs?
Yes, as an add-on. Rate and bill calls per tenant and track carrier spend by route and destination, so you can price your service and catch cost spikes early.
How is SBCaaS priced?
Pay as you go per channel or per tenant, free to try on one trunk, with no CapEx and no appliance lifecycle costs.
Put a secure edge in front of your voice
Tell us your SIP setup. We will front a test trunk, free, and show you every call traced end to end.