Trust
Security and compliance, in the open.
What is in place today, and what is still on the roadmap, for a carrier-grade AI mobile network.
Posture
Where things stand.
A short map of what is running today and what is still in progress. Each line opens the detail below.
Compliance
A monitored program, with certifications underway.
The compliance program runs on Vanta with continuous control monitoring. Certifications below are in progress. Controls already in place are mapped to the frameworks customers ask about.
5 in place4 in progress
Continuous control monitoring
The compliance program runs on Vanta, with continuous control monitoring.
Framework mapping
Controls are mapped to the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality), ISO 27001 Annex A, NIST CSF 2.0, and CIS Controls v8.
SOC 2 TSCISO 27001 Annex ANIST CSF 2.0CIS Controls v8
Enterprise vetting
Telegent has passed T-Mobile's enterprise vetting and several enterprise customer security reviews.
Inherited partner controls
Telegent inherits independently audited controls from upstream partners, including enterprise hosting providers and cloud providers.
SOC 1SOC 2SOC 3ISO 27001ISO 27017ISO 27018PCI DSS Level 1
Policy review
Policies are reviewed and approved at least annually and on material change.
SOC 2 Type I
SOC 2 Type I is in progress, with a target of Q1 2027.
SOC 2 Type II
SOC 2 Type II follows after a 6 to 12 month observation period.
ISO/IEC 27001:2022
ISO/IEC 27001:2022 certification is in progress.
HIPAA Security Rule
HIPAA Security Rule attestation is in progress.
Infrastructure
An owned edge, connected in private.
Production runs across an owned edge and multi-provider cloud and hosted edge facilities. Partner connectivity stays off the public internet.
4 in place
Owned edge
Telegent operates an owned edge, with multi-provider cloud and hosted edge facilities.
Private interconnects
Mobile network operator partner connectivity uses dedicated private interconnects from tier-1 carriers, not the public internet.
Restricted exposure
Internal services are not publicly exposed. Outbound traffic is restricted to approved destinations.
Private service access
Private endpoints connect to managed cloud services, and all traffic is encrypted in transit.
Data protection
Minimized, isolated, and encrypted.
Customer data is limited to what the service needs, stored in cloud-hosted infrastructure, and protected in transit and at rest.
6 in place
Data minimization
Collection follows data minimization.
Tenant isolation
Data is stored within cloud-hosted infrastructure, with least-privilege, tenant-isolated access.
Encryption
Data in transit uses TLS 1.2+. Data at rest uses AES-256.
TLS 1.2+AES-256
Keys and secrets
Keys are held in FIPS 140-validated cloud key management. Secrets are kept in a managed secrets vault, never in code.
Retention and deletion
Data is retained per contractual and regulatory requirements and securely deleted. Telegent supports data-subject deletion and export requests.
Carrier records
Carrier voice, SMS, and call records remain subject to retention and lawful-process obligations.
Privacy
Privacy duties, matched to the use case.
Telegent supports the privacy obligations that apply to a deployment, including healthcare arrangements that are evaluated one by one.
4 in place
GDPR and CCPA/CPRA
Telegent supports GDPR and CCPA/CPRA obligations.
Data processing agreements
DPAs are executed based on the customer use case.
Telecom conduit exception
Core telecom services operate under the telecom conduit exception.
Healthcare use cases
For healthcare use cases, dedicated-infrastructure deployments cover stored data and AI data processing, with BAAs evaluated case by case.
Access control
Least privilege, reviewed on a schedule.
People and services authenticate through a centralized identity provider. Access is limited to each role, and reviews run on a schedule and when something changes.
5 in place
SSO and MFA
SSO with MFA is provided through a centralized identity provider.
Least privilege
Access is role-based and follows least privilege.
Service identities
Each service has a dedicated managed identity. Deployments use short-lived federated credentials.
Access reviews
Automated access reviews run hourly, daily, and on triggering events.
Password policy
The password policy follows NIST SP 800-63B (length, compromised-password screening, and lockout).
Secure development
Reviewed before merge. Scanned in the pipeline.
Changes pass peer and automated security review before they merge. Dependencies and images are scanned in CI/CD, and findings are fixed by risk.
3 in place1 in progress
Review before merge
Peer and automated security review run before merge, including secret scanning.
Pipeline scanning
Dependency and container image scanning run in CI/CD.
Risk-based remediation
Findings are remediated on a risk basis.
Penetration testing
Third-party penetration testing is part of the SOC 2 and ISO program. Results are shared under NDA once available.
To report a vulnerability, use the coordinated disclosure program.
Monitoring
Seen quickly, handled on a plan.
The platform is observed from one place. Incidents follow a documented plan through recovery and a post-incident review.
4 in place
Observability
Enterprise observability covers centralized logs, metrics, tracing, and anomaly alerting.
On-call paging
On-call paging includes escalation.
Incident response plan
The documented plan covers roles, severity, and the steps to detect, triage, contain, eradicate, recover, and complete a post-incident review.
Status and customer notice
Service health is published on the public status page. Customers are notified of confirmed data incidents without undue delay.
status.telegent.comResilience
Ready to recover, with a wider architecture rolling out.
Business continuity and disaster recovery follow recognized practice, with backups and tested failover. A multi-region, multi-provider data architecture is still rolling out.
3 in place1 in progress
BC/DR program
The business continuity and disaster recovery program is aligned to ISO 22301 and the BCI Good Practice Guidelines.
Backups and recovery
Backups and documented recovery procedures are in place.
Failover testing
Failover testing runs quarterly, and a full disaster recovery exercise runs annually.
Multi-region architecture
A multi-region, multi-provider data architecture is rolling out.
Telecom
Carrier practices, caller authentication, and CPNI.
Telecom compliance follows the practices expected of a registered carrier, including caller authentication and protection of customer proprietary network information.
3 in place
Registered carrier practices
Operations follow FCC registered carrier practices.
STIR/SHAKEN
STIR/SHAKEN is provided via the underlying carrier.
CPNI
CPNI protections are in place.
Contact
Talk to security.
Headquarters in Pleasant Grove, Utah. Questions about a control, a questionnaire, or a customer review go to the security team.
Information on this page is provided for informational purposes and describes current practices and stated objectives. Contractual commitments are governed by customer agreements.
Questions about a control or a review?
Email the security team for the current posture, a questionnaire, or how a deployment is protected.