EDITIONS
One sovereign platform. Three ways to run it.
Every edition is the same Bulwark Voice Suite, with the same encryption, offline operation and emergency alerting. Editions differ in scale, integrations, audit tooling and how much of the running we do for you. Moving up is a new licence, not a reinstall.
In every edition
The sovereign core is never an upsell.
YoursRuns on your servers. Data never leaves your walls.
EncryptedTLS and SRTP on every call, by default.
OfflineWorks with no internet, air-gap ready.
Secured2FA, role-based admin, append-only audit.
SafeEmergency alerts with muster.
RecoverableEncrypted backups you control.
Lite
One site: a school, clinic, branch office or field unit.
The full sovereign core on a single server: encrypted calling, voicemail, IVR, presence, emergency alerts and backups, running fully offline.
- Single node
- Core call control
- Emergency alerts + muster
- Encrypted, offline, audited
Enterprise
Institutions that cannot go dark: multi-site, integrated, audit-ready.
Everything in Lite, plus 2–4 node active-active clustering, contact-centre supervision, every messaging channel, scoped APIs, every storage destination and the full safety suite.
- 2–4 nodes active-active
- Supervisor listen / whisper / barge
- SMS + WhatsApp, scoped API clients
- SAN, SFTP, S3 backups; FIPS mode + STIG
Sovereign Managed
Defence, PSUs, banks and hospitals that want the outcome without building a team.
Enterprise, deployed and run by VoipHorizon engineers on your premises. You keep ownership of the servers, the data and the keys.
- Everything in Enterprise
- We deploy on your premises
- We monitor, update and back up
- DR drills with evidence reports
Compare editions, feature by feature
Generated from the same feature list as the product. Updated 2026-10-31. Beta = built, finishing validation. Coming soon = on the roadmap.
| Feature | Lite | Enterprise | Sovereign Managed |
|---|---|---|---|
| Scale | |||
| Servers (nodes) | ✓1 | ✓2–4, active-active | ✓2–4, active-active |
| Users and concurrent calls | ✓Licensed for a small site | ✓Set by your hardware and licence | ✓Set by your hardware and licence |
| Calling & call control | |||
| Extensions & registration SIP phones and softphones register and call over TLS with encrypted media. | ✓ | ✓ | ✓ |
| Hunt groups Ring teams simultaneously or in sequence. | ✓ | ✓ | ✓ |
| Call queues (ACD) Agents, tiers and routing for contact-centre style call handling. | ✓Small teams | ✓ | ✓ |
| IVR / auto-attendant Menu-driven call routing you design in the admin console. | ✓ | ✓ | ✓ |
| Voicemail & MWI No-answer and busy deposit, message-waiting lamps, and voicemail-to-email. | ✓ | ✓ | ✓ |
| Call recording Record all calls, selected extensions, or on demand — with PCI pause and masking. | ✓ | ✓ | ✓ |
| Call blocking Block unwanted callers by exact number or pattern, system-wide and per user. | ✓ | ✓ | ✓ |
| Park & group pickup Park a call and pick it up from any phone. | ✓ | ✓ | ✓ |
| Transfer & forwarding Attended and blind transfer plus flexible call forwarding. | ✓ | ✓ | ✓ |
| Click-to-call Originate calls from the console or your own apps via the API. | ✓ | ✓ | ✓ |
| Always-on sessions Persistent conference rooms and supervised hotlines that reconnect automatically. | ✕ | ✓ | ✓ |
| Presence & calendar-aware routing Beta Calls follow presence — in a meeting or DND routes to voicemail, driven by your calendar. | ✓ | ✓ | ✓ |
| Supervisor listen, whisper and barge Beta Supervisors listen silently, coach the agent, or join the call from a live-calls view; every action is audited. | ✕ | ✓ | ✓ |
| WhatsApp voice calls into queues Beta WhatsApp Business calls arrive over SIP-TLS into your queues and IVR. | ✕ | ✓ | ✓ |
| Video & collaboration | |||
| Browser calling (WebRTC) A co-branded web softphone — voice and video in the browser, no plugin. | ✓ | ✓ | ✓ |
| Presence & instant messaging See who's available and chat, with BLF busy-lamp presence on phones. | ✓ | ✓ | ✓ |
| HD video conferencing Coming soon Scalable multi-party video over a dedicated SFU. | ✓Small meetings | ✓ | ✓ |
| SIP room systems Coming soon Bring SIP video-conferencing equipment into the same meetings. | ✕ | ✓ | ✓ |
| Collaborative whiteboard Beta Draw together on a shared canvas — in chat, group chat and live meetings. | ✓ | ✓ | ✓ |
| Security & compliance | |||
| Encrypted signalling & media TLS and SRTP/DTLS everywhere by default — encrypted the moment you install. | ✓ | ✓ | ✓ |
| Encryption at rest Secrets and backups encrypted with AES-256-GCM; full-disk LUKS documented. | ✓ | ✓ | ✓ |
| RBAC & two-factor admin Per-module roles, TOTP 2FA and security questions for administrators. | ✓ | ✓ | ✓ |
| Append-only audit trail Hash-chained audit of every change and login attempt. | ✓ | ✓ | ✓ |
| Retention & subject erasure Configurable retention and one-call erasure of a subject's records. | ✓ | ✓ | ✓ |
| PCI recording controls Pause and mask recording so card details are never written. | ✓ | ✓ | ✓ |
| FIPS mode & STIG hardening FIPS-approved TLS suites and DISA-STIG-aligned OS hardening. | ✕ | ✓ | ✓ |
| IP & subnet firewall Beta Allow or deny SIP by IP, CIDR or country, with auto-ban on floods and failed auth. | ✓ | ✓ | ✓ |
| Recording export Beta Finished recordings copied off the server automatically, encrypted, with local disk freed only after a confirmed copy. | ✕ | ✓ | ✓ |
| Safety & resilience | |||
| Emergency mass alerting Beta Blast a voice alert to a group, site or everyone, with muster acknowledgment and an auto incident bridge. | ✓ | ✓ | ✓ |
| Location & geofencing Beta Track people and assets and target alerts by geofence — on your own network, even air-gapped. | ✕ | ✓ | ✓ |
| Threat & travel awareness Beta Correlate named threat feeds with your people and auto-alert anyone near an event. | ✕ | ✓ | ✓ |
| SMS channels Beta Send and receive SMS through an on-site GSM gateway, an Indian DLT-registered aggregator or Twilio. | ✓One channel | ✓ | ✓ |
| Alerts by SMS and WhatsApp Beta Emergency alerts can also go out by text, in parallel or as a fallback; a SAFE or HELP reply counts as the muster answer. | ✓ | ✓ | ✓ |
| Reliability & scale | |||
| Active-active clustering 1–4 nodes serving calls together, with replicated configuration. | ✓Single node | ✓ | ✓ |
| Capacity-aware provisioning Detects hardware limits and warns before you overcommit. | ✓ | ✓ | ✓ |
| Per-service isolation Each feature is its own service, so restarting one never disrupts the rest. | ✓ | ✓ | ✓ |
| Runs fully offline No internet required at the site — ideal for air-gapped deployments. | ✓ | ✓ | ✓ |
| Scheduled encrypted backups Beta Database, configuration, voicemail and recordings backed up on a schedule, encrypted with your own key, with retention and verified restore. | ✓ | ✓ | ✓ |
| Your storage, your choice Beta Write backups and exports to a SAN, NAS or Windows share, an SFTP server, S3-compatible storage, or optionally Google Drive. | ✓Local disk & NAS | ✓ | ✓ |
| Administration & integration | |||
| Web admin console Manage the whole platform from an HTTPS console with a signed certificate. | ✓ | ✓ | ✓ |
| Static API tokens Super-admin-issued tokens for scripts and BI tools, scoped and revocable. | ✓Read-only | ✓ | ✓ |
| Reporting & analytics Call, queue and agent reports via REST, Grafana and Power BI. | ✓Built-in reports | ✓ | ✓ |
| Zero-touch provisioning Push device configuration automatically over HTTPS. | ✓ | ✓ | ✓ |
| Flexible PSTN connectivity SIP trunks, PRI and FXO/FXS gateways, secure or plain per provider. | ✓ | ✓ | ✓ |
| Offline licensing Signed licences with an annual term that work with no internet. | ✓ | ✓ | ✓ |
| Scoped API clients with token rotation Machine credentials with per-resource read/write/delete scopes, short-lived access tokens and secret rotation with a grace window. | ✕ | ✓ | ✓ |
| WhatsApp Business messaging Beta Send and receive WhatsApp messages and approved templates through the WhatsApp Business Cloud API. | ✕ | ✓ | ✓ |
| Secure file sharing Beta Browse stored files and hand out expiring, download-limited links; every download is audited. | ✕ | ✓ | ✓ |
| Deployment & updates | |||
| One-file installer A single signed installer bundles every engine — nothing downloaded separately. | ✓ | ✓ | ✓ |
| Appliance image Ship as a ready-to-boot appliance with a first-boot setup wizard. | ✓ | ✓ | ✓ |
| Apply-on-top updates Update by running the update package over the top, with automatic rollback. | ✓Self-applied | ✓ | ✓ |
| Support & services | |||
| Support | ✓Email, business hours | ✓Priority SLA, 24×7 option | ✓24×7 with a named engineer |
| Deployment | ✓Self-install with the one-file installer | ✓Guided deployment with our engineers | ✓Deployed by us on your premises |
| Updates | ✓Self-applied | ✓Staged rollouts, with our help | ✓Planned and applied by us |
| Day-to-day operations | ✕ | ✕ | ✓Monitoring, backups and patching run by us |
| DR drills with evidence reports | ✕ | ✕ | ✓ |
Every edition includes the full sovereign core: encryption on every call, 2FA and audit, offline operation, emergency alerts with muster, and encrypted backups.
Moving between editions
Same software in every edition. You change the licence (and, for Managed, who runs it) — never the platform, and never your data.
Lite → Enterprise
A new licence file. No reinstall.
- We issue an Enterprise licence for your cluster.
- Your admin installs it under Administration → Licence & Edition. Enterprise features unlock immediately — no reinstall and no restart; calls in progress are not touched.
- Optional: add nodes 2–4 with the same installer, choose “join an existing cluster” and enter the one-time cluster key. Configuration replicates to the new node.
You keep: All users, extensions, settings, recordings, voicemail and call history.
Effort: Licence: minutes. Each added node: an install and a join, usually the same day.
Enterprise → Sovereign Managed
A services agreement. No software change.
- We agree the scope and the access model: engineers on site, or remote access you approve and can revoke (none for air-gapped sites).
- Handover: runbook, monitoring, backup destinations and key-escrow arrangements, following your security policy.
- We take over monitoring, updates, backups and DR drills, and send you evidence reports.
You keep: Everything. You keep ownership of the servers, the data and the encryption keys.
Effort: Typically two to four weeks, including the handover.
Lite → Sovereign Managed
Both steps together.
- Licence upgrade to Enterprise, then the services handover above, planned as one project.
You keep: All data and settings.
Effort: Planned with you.
Moving down (Enterprise → Lite)
At renewal, with a Lite licence.
- Reduce the cluster to one node first.
- Install the Lite licence. Enterprise-only features switch off; calls, emergency alerts and backups keep running.
You keep: Settings of switched-off features are kept, so moving back up restores them. No data is deleted.
Effort: Planned with you at renewal.
Not sure which edition fits? Start with a one-day pilot on an isolated segment — the pilot runs the same software as every edition.