911 / E911

911 always connects — by design. US 911 rules (Kari's Law and RAY BAUM's Act) don't allow a phone system to block 911. Every phone can dial 911: users without E911, users with no plan, phones on DND, phones outside the office, even while the safety lock is on.

• The address 911 gets comes from your provider, not this panel. It's the address registered there for the caller-ID number the call is sent with: a user with E911 on sends their own 911 number; everyone else uses the office fallback (your provider's E911 on the trunk's default caller ID, or an office 911 number you set).
• The E911 page is locked with a separate 6–12 digit code. Unlock it for 10 minutes to make changes. Wrong codes are limited and alerted; every change is logged and emailed.
• Every 911 call shows on the dashboard and is emailed immediately — who called, which address was used, whether the phone was outside the office.
• Users are warned in My Phone which address 911 will send help to, and that it doesn't follow the phone.
• Test every phone by dialing 933 if your provider offers it.

Lost E911 code: sqlite3 /var/lib/pbx/pbx.db "DELETE FROM kv_settings WHERE key='e911_code_hash'", then set a new one.

This system helps you route 911 correctly, but you are responsible for registering accurate addresses with your provider and meeting the 911 rules that apply to you. This is not legal advice.

---

Call recording and the law

Recording calls without everyone's consent is illegal in some places — "two-party"/all-party consent states such as California, and other countries — and can break workplace or union rules.

• Admin call recording is off for the whole system by default. Turning it on (Recordings → Recording settings) requires the admin to tick a legal acknowledgement, which is logged. When on, only extensions with Admin call recording ticked on the Logins page are recorded. These recordings are silent to callers unless the announcement is on.
• "Record my calls" (My Phone → Settings) needs recording in the user's plan, plus the user's own legal acknowledgement. An admin can disable a user's recording but never force it on.
• "This call may be recorded" announcement: plays to both parties when a recorded call starts. Upload your own message, or a beep plays instead.

---

Plans and billing (Stripe)

What a plan sets: monthly outside minutes, voicemail, texts per month, recording, and the number of IVR menus. No plan: users can only call other extensions. Admins are never limited.

Setting it up:

1. In Stripe (start in test mode), copy the secret key and create a webhook to https://<your-public-panel>/stripe/webhook. Copy the signing secret.
2. Admin → Billing: paste the keys, set the public URL, create plans (name, price, limits). Then Publish each plan to Stripe.
3. Users subscribe, switch and cancel in My Phone → Billing. Stripe's own page handles payment details.

Overriding plans: Billing → User access sets defaults for users without a plan, and per-user exceptions such as unlimited minutes for a lobby phone. Without Stripe: just use User access to give people what they need.

---

Opening My Phone to the internet (optional)

To let users reach My Phone from anywhere, publish the panel through Cloudflare Tunnel (optionally behind Nginx Proxy Manager), e.g. https://myphone.example.com → http://<PBX-IP>:8001. Then:

• Anything through the tunnel/proxy is treated as internet: users get My Phone, admin pages answer "office network only" with the admin menu hidden. Admins keep using http://<PBX-IP>:8001 at the office.
• Sign-in lockouts and logs use each visitor's real IP.
• Turn on Cloudflare's Always Use HTTPS.
• Never forward port 8001 (or NPM's 80/443) directly from the router.
• Use a different name from the SIP domain: sip.example.com stays a grey-cloud A record.