Sovereign identity · European Digital Identity Wallet · Voice AI · Self-hosted

Identity, wallets, telephony and Voice AI.
One sovereign stack. Zero cloud lock-in.

Nine integrated products, one self-hosted platform. Hardened Windows logon, an OpenID Connect + Passkeys identity provider, a live European Digital Identity Wallet verifier and issuer, a new Business-Wallet for multi-employee firms, browser meetings + softphones, a programmable Voice AI layer, a sovereign SBC, a Remote Signature Service (CSC v2, PAdES-B-T with trusted timestamp) and the ZUGFeRDPro e-invoicing SDK (ZUGFeRD, XRechnung, Factur-X, UBL — ready for the German 2025-2028 mandate and EU ViDA). Bolted onto what you already own — FRITZ!Box, Asterisk, FreePBX, carrier SIP, Teams Direct Routing — or the foundation for a fresh service. NIS2 / DORA / CRA / GDPR aligned. Runs in air-gapped networks. This page itself is the production tenant.

Get your own tenant → Try the Business-Wallet → Meeting demo — no signup Talk to us

Free during preview · 30-day no-limits grace · early-adopter pricing locked in · EU-hosted, no tracking pixels, no analytics beacons.

What's new · August 2026

European Business-Wallet — multi-employee corporate credential vault, once-only, selective disclosure, immutable audit
Cross-tenant trust federation (signed bilateral trust statements)
Countersign endpoint — banks, notaries and auditors endorse documents
HMAC public share links + Bitstring Status List revocation
Wallet-Instance-Attestation per employee · multi-DID (did:web, did:key, did:jwk, did:webvh)
mDoc / ISO 18013-5 issuance + presentation scaffolding

Prefer a human? Real answer, minutes not days: ✉ info@aloaha.com ✏ Contact form Call us in the browser → rings our office ✎ How the call-us button works →

Nine sovereign products, one integrated platform.

Ranked by where they create the most defensible value. Take one. Take all nine. Run them next to anything you already own — carrier SIP, Teams Direct Routing, FRITZ!Box, Asterisk, FreePBX — or replace those pieces piecemeal on your own timeline. On wide screens the tiles flow as a 3×3 grid; on tablet and mobile they collapse to two columns and then one.

01 · CodeB Credential Provider V2

Replace the Windows password tile.

The flagship of the CodeB line. Replaces the Microsoft password tile via the documented Credential Provider Filter interface — NFC, TOTP, PKI smartcards or USB tokens, as second factor or full passwordless. 100 % managed .NET. FIPS 140-2 enforceable by Group Policy. Windows 8 through Server 2025. No cloud, no telemetry, runs in air-gapped networks.

NFC, TOTP, PKI smartcards, USB tokens · second factor or fully passwordless
FIPS 140-2 enforceable by Group Policy
System Tray Edition · card-remove auto-lock
Tools Edition · standalone helpers, scriptable
Admin CLI · CSV-driven enrolment for hundreds of cards
Pairs with the CodeB IdP and EU Wallet verifier to extend Windows logon into single sign-on for your apps

CP V2 details & downloads Download (Tray Edition) Request eval key

02 · OpenID Connect & Passkeys IdP

A drop-in EU identity provider you can host yourself.

An OpenID Connect identity provider for Nextcloud, WordPress, Grafana, GitLab, Teams, AWS, Azure or your own apps — with Passkeys (FIDO2 / WebAuthn) and magic-links wired alongside. Per-tenant RS256 keys, PKCE-only flows, RFC 7662 introspection, RP-Initiated Logout. Server never sees plaintext passwords; the user's own device signs the assertion.

OIDC IdP · per-tenant RS256 keys · PKCE-only · RFC 7662 introspection · RFC 7009 revocation
Passkeys (FIDO2 / WebAuthn) · TouchID / Windows Hello / YubiKey · phishing-resistant
Magic-link sign-in & self-service password recovery
Identity claims propagate into the SIP, WebRTC and SBC layers below — a caller is the same subject as a logged-in user
Wallet-as-recovery: forgot-password via your EU Wallet

IdP overview vs Okta, Auth0, Keycloak → Talk identity

03 · EU Digital Identity Wallet validator

Accept verified EU Wallet credentials — today, in production.

One of the first self-hostable EU Digital Identity Wallet verifiers in operation. OID4VP 1.0, HAIP 1.0, SD-JWT VC. Live on this domain right now. Replace usernames and passwords with cryptographically verified European Digital Identity Wallet claims — SD-JWT VC + KB-JWT selective disclosure — for sign-in, account recovery, customer onboarding, KYC, age gating, healthcare attestations, public-sector portals. Government-issued Personal Identification Data (PID) remains reserved for Member State-notified providers; CodeB is the verifier / relying-party integration.

OID4VP 1.0 verifier · HAIP 1.0 profile · SD-JWT VC and mDL credential formats
Cited by the Maltese Minister responsible for digital identity (2026-06)
Interoperability tracked in a published per-Member-State wallet matrix — wider real-wallet coverage lands as the ecosystem stabilises
Wallet sign-in, wallet recovery, wallet KYC at onboarding, wallet-bound consent for AI calls
REST API + signed webhooks for integration into any application

EU Wallet sign-in Verifier API → Talk EU Wallet

EU Digital Identity Wallet success screen showing PID (SD-JWT VC) shared with CodeB / Aloaha Limited, verified badge visible — **Live proof:** the EU Reference Wallet on Android after a successful PID presentation to this verifier.

04 · Voice AI & PBX

Programmable, sovereign, carrier-independent Voice AI — not just an AI receptionist.

A self-hosted browser-and-SIP communications platform with a fully programmable Voice AI core. Per-number persona prompts, real-time multilingual conversations, scheduled outbound campaigns with conditional retries, human SIP transfer mid-call, signed transcripts and summaries emailed after every call, REST API initiation, HMAC-signed webhooks, pluggable AI engine, local TTS fallback, bring-your-own SIP carrier. WebRTC meetings + browser softphones + SIP gateway included.

Programmable Voice AI · per-vnum persona / prompt / voice / language
Outbound campaigns · scheduled, conditional retries, signed summary delivery
SIP REFER human-transfer mid-call · AI hands the caller to a hardphone or browser tab
REST v1 initiation + HMAC-signed webhooks · the AI is API-first
Pluggable AI Voice Engine · cloud or on-prem · local TTS fallback if the engine is unreachable
HD WebRTC meetings · browser softphones (SIP-over-WebSocket RFC 7118) · bring-your-own SIP trunk
Signed call recordings (forensic-grade ECDSA sidecar)

Voice AI platform Browser softphones → Talk Voice AI

05 · Sovereign SBC

The identity-aware SIP/WebRTC layer between your apps and your telephony.

A self-hosted Session Border Controller folded into the same install as the meetings, identity and Voice AI. Sits at the boundary of your VoIP estate — in front of FRITZ!Box, Asterisk, FreePBX or your carrier trunk — and does the work classic SBC vendors sell as a standalone appliance, plus identity-aware policy that none of them ship. For telecom operators, CPaaS developers, white-label communications providers, companies embedding calls into portals, and vendors building specialist browser phones.

SIP normalisation, NAT traversal, integrated TURN (UDP / TCP / TLS) with ICE-Lite for hardphones
SIP-over-TLS (RFC 5630) for encrypted hardphone registration · per-trunk SDES SRTP (RFC 4568) on the carrier leg · persistent REGISTER-pinhole reuse (RFC 5626) so TLS phones survive NAT teardowns
Any-to-any voice interop matrix · WebRTC browsers, SIP-over-WebSocket softphones (sip-js / JsSIP), classic UDP phones (MicroSIP, Asterisk) and TLS-registered hardphones (Yealink) reach each other through one bridge with full SDP rewriting + media transcoding
Native WebRTC ↔ SIP gateway · DTLS-SRTP ↔ RTP/SRTP · Opus ↔ G.711 transcoding
Identity-aware SIP · OIDC, Passkeys, EU Wallet claims resolve to the same tenant subject as REGISTER
Access control with CIDR + glob + per-tenant + private-IP bypass + brute-force auto-block
Signed CDRs + tamper-evident recordings (ECDSA-P256 sidecar)
Multi-tenant by domain · one bridge, isolated App_Data per tenant · hot-reloadable trunks and TURN config
BYO carrier · no vendor lock on the underlying telephony estate

Sovereign SBC overview STUN / TURN / ICE explained → Talk SBC

06 · Team Chat

The messaging layer that stays inside your tenant.

Direct messages, group channels and file sharing — all served by your own IIS / bridge install, per-tenant isolated, OIDC-authenticated. No third-party gateway ever sees the messages. Real-time delivery over WebSocket, poll fallback for restrictive networks, drag-and-drop uploads up to 20 MB, and an offline-catch-up email if a teammate has unread messages after 24 hours away.

Direct messages + group channels · per-tenant isolated under App_Data
Real-time WebSocket delivery · poll fallback works behind restrictive networks
File attachments up to 20 MB · drag-and-drop · images preview inline
OIDC-authenticated senders · identity clamped server-side, no spoofing
Offline catch-up email · if a user is offline ≥24 h with unread messages
Embeddable widget · drop "Chat with us" into any tenant page (visitor pairing via HMAC invitation)
Unified bubble · in-meeting chat and standalone chat share one visual style across every surface
Meeting archives · signed-in users get an auto per-day, per-room record of what they said in the room chat, browseable from chat.html (guests stay ephemeral)
Full REST + WS API · automate bots, hook into CRMs, script announcements
WhatsApp Business Cloud API connector · per-tenant Meta App credentials, HMAC-verified webhooks, media caching, appsecret_proof, and a shared “WhatsApp Inbox” group thread so your team replies to WhatsApp customers from the same UI as internal chat

Open Team Chat Chat API → Talk Chat

07 · Business Intelligence

Property Management System that publishes its own website — and uses your phone system.

A full PMS for short-let, holiday-let and hotel operators, running inside the same CodeB tenant as your phone system. Real-time ops dashboard, revenue analytics, housekeeping, guest inbox and owner statements — and the public-facing property website is a live rendering of the same inventory, no separate CMS. Meet, Chat and Call are the CodeB comms you already know. Multi-tenant, OIDC-authenticated, EU-hosted.

Today dashboard · check-ins, check-outs, stay-overs, bookings, transactions · live
Ops modules · arrivals, turnovers, guest inbox, housekeeping, issues, calendar, CDR, devices
Revenue · revenue, cashflow, forecast, pick-up, pace, performance, owner statements
Properties · occupancy, pricing, catalog, reviews, channels, guests, inventory · single source of truth
Dynamic public website · auto-generated from Properties, per-tenant branding, leads capture, iCal sync
Channel managers · The PMS plugs in natively, source picker in the top nav
Meet · Chat · Call · the CodeB phone system, not a third-party embed
Multi-tenant · each customer (or owner) on their own subdomain, per-tenant audit log

Open the product page Talk BI

08 · Remote Signature Service

Sign PDFs from a browser or from your backend — PAdES-B-T with trusted timestamp.

A Cloud Signature Consortium (CSC) v2 signing service and a browser-side signing client, running on the same tenant as the rest of the platform. Per-user signing certificates minted from your OIDC profile (Common Name, given name, family name, email), incremental save preserves prior signatures, RFC 3161 trusted timestamp from a configurable TSA, and full support for encrypted source PDFs (Standard V2 RC4-128 and V4 AES-128). Advanced Electronic Signature (AdES) scope, self-signed keys today — the CSC v2 API surface and audit trail are designed to accept a Qualified Signature Creation Device (QSCD) connector for Qualified Electronic Signatures (QES) as a future upgrade, aligned with the European Digital Identity Wallet remote-signing patterns.

Browser signing client · sign.html · drag-drop, multi-page preview, arrow-key navigation, edit Reason/Location/ContactInfo per signature
Cloud Signature Consortium v2 API subset — per-user credential list, SCAL2 authorisation with WebAuthn plus PIN, hash signing, full-document signing, RFC 3161 timestamp fetch
PAdES-B-B baseline — CMS signed attributes per ETSI EN 319 122-1, including signing-certificate v2 with issuer and serial binding
PAdES-B-T — RFC 3161 timestamp embedded in every signature; the timestamp authority is a per-install configuration knob
Per-user certificate lifecycle — every user gets their own EC P-256 signing key on first use, wrapped by the operating system key store; the certificate subject is populated from the OIDC profile (name, given, family, e-mail)
Incremental save preserves prior signatures — classic xref-table PDFs and xref-stream PDFs both supported (ISO 32000-1 §7.5.6)
Encrypted PDF support — signs source PDFs protected by the Standard security handler (RC4-128 and AES-128) without requiring decryption first
SCAL2 Signature Activation Data — short-lived signed authorisation bound to the document hash, with PIN and WebAuthn second factors verified server-side before the signature is released
Advanced Electronic Signature scope today — not QES yet, but the crypto module is pluggable so a certified HSM or QTSP backend can be swapped in on customer engagement

Sign a PDF now CSC v2 API → Talk Signature

09 · E-Invoicing SDK · ZUGFeRDPro

ZUGFeRD, XRechnung, Factur-X and UBL — on your own servers, in your own code.

The Aloaha ZUGFeRDPro SDK creates and reads EN 16931-conformant electronic invoices in CII syntax — ZUGFeRD, XRechnung, Factur-X — and reads UBL / PEPPOL as a bridge. On-premise COM + .NET + CLI + Web Services surface. Invoice data never leaves your process. Ready for the German mandate: receive since 2025-01-01, issue phased 2027-01-01 (turnover > EUR 800k) and 2028-01-01 (all businesses). France Factur-X 2026-09-01 receive / 2026-09-01 issue for large + medium, 2027-09-01 all. Italy SDI mandatory since 2019; Poland KSeF, Belgium PEPPOL 2026-2028. EU ViDA directive brings a common wire in 2030-2035.

Create ZUGFeRD / XRechnung / Factur-X XML in UN/CEFACT CII syntax
Embed the XML into existing PDF/A or generate a fresh PDF/A-3 from XML + Word template
Extract the XML back out of any received ZUGFeRD or Factur-X PDF, no OCR
Read UBL 2.1 / PEPPOL BIS Billing 3 into the same internal model — SDK acts as UBL→CII bridge
XAdES on the XML, PAdES + RFC 3161 timestamp on the wrapping PDF (via CodeB Signature Server)
COM interface for VB6 / VBA / classic ASP / MS Access / Navision / Delphi retrofit
.NET assembly (early and late binding) for C# / VB.NET / PowerShell / F# / modern ERP
Command-line tools for batch pipelines + Web Services for language-agnostic HTTP callers
OEM licence for ISVs embedding ZUGFeRD output into their own accounting / billing / ERP product
Standalone GUI + free ZUGFeRD PDF Viewer for exception-handling by accounting staff

E-Invoicing SDK overview 2025-2030 deadlines → Talk e-invoicing

Three ways to phone from your browser.

Same audio quality. Same call routing — internal extensions, AI agents, virtual numbers, external destinations all work identically. Pick whichever matches how your team already works, or run all three side by side. All are installable PWAs.

A · Office (CodeB native)

Full-featured CodeB Webphone.

The default browser softphone for CodeB tenants. Click-to-call, meeting handoff, in-room chat, screen share, presence. Talks to the bridge over the CodeB signalling channel — no third-party SIP library to learn.

One-click meeting handoff to/from a phone call
Presence, in-room chat, screen share built in
PWA install · works offline for sign-in shell

Open office.html

B · SIP.js

Bring your own RFC 7118 softphone.

For teams that already use the SIP.js library or want a pure standards-based path. Speaks SIP over WebSockets directly to the bridge. Real 3×4 dialpad with DTMF. Credentials in your browser’s localStorage — never on our servers.

Pure RFC 7118 · vendor-neutral SIP-over-WSS
SIP.js v0.21.2 from public CDN
PWA install · credentials never leave the device

Open sip-js.html

C · JsSIP

Same standard, alternative library.

For teams that prefer the JsSIP library or already have integrations against it. Same RFC 7118 wire protocol, same dialpad UX, same browser-only credential storage. Pick whichever JS library your team already knows.

Pure RFC 7118 · vendor-neutral SIP-over-WSS
JsSIP v3.10.1 from public CDN
PWA install · credentials never leave the device

Open jssip.html

Live, on this very server

This page proves itself.

SIP fraud engine

built-in

An operator-curated Access Control system gates every inbound INVITE and every outbound dial. CIDR + glob + per-tenant + private-IP bypass + auto-blacklist on brute-force. Toll fraud doesn't reach your trunk.

How the bridge protects you →

EU Wallet verifier

live

Full OID4VP 1.0 end-to-end with SD-JWT VC + KB-JWT holder binding. The wallet-preferred x509_hash (HAIP 1.0 Final) and additional x509_san_dns (OpenID4VP compatibility mode) client identifier prefixes supported. Try it on logineu.html.

Wallet verifier API →

Standards-first

RFC-based

Built on published RFCs and OpenID / EUDI specifications, with minimal proprietary crypto glue. RFC 6749, 7009, 7517, 7523, 7662, 8414, 9101, 9116, 9309. OID4VP 1.0. HAIP 1.0. WebAuthn L3. SIP over UDP and TLS (SIPS, RFC 5630). No proprietary protocol, no lock-in.

All public APIs →

Hosted in

Aloaha Limited — Malta-registered, EU-hosted. Zero tracking pixels, zero analytics SDKs, zero third-party CDN. RFC 9116 security.txt published.

CRA / NIS2 / DORA posture →

Talk to us → Open the live status page Try a meeting now

Why this exists

Because EU sovereignty isn't a slogan.

Your data never leaves your infrastructure.

No US analytics SDK. No third-party CDN. The phone calls, the identity sign-ins, the Windows logon events — all stay on your server. The same binaries you run, you can audit. The AI Voice Engine is pluggable: local TTS auto-reply ships by default (no cloud at all); the real-time AI Voice Engine is operator-selected per tenant (local or your chosen cloud provider) so the data-path choice is yours.

NIS2 · DORA · CRA aligned by default.

Designed around the EU Cyber Resilience Act (Reg. 2024/2847), NIS2 and DORA from the first commit. Secure-by-default, vulnerability handling documented, security.txt published, atomic file writes with rolling backups everywhere.

Standards over lock-in. Always.

Every protocol we speak is RFC, W3C, OIDF or ISO. Every API is documented and curl-able. Every integration is BYO-anything: bring your own SIP trunk, your own AI engine, your own SMTP, your own IdP — or use ours. Walk away anytime.

One team. One product line. Real humans.

You email info@aloaha.com, you get a reply from the people who write the code. Aloaha Limited has shipped signing, PKI and secure communications software since 2003 — and dogfoods every product in production.

Your own free live tenant

Try it on your own domain. Free. In production.

Conference, Phone bridge, Voice AI and the OIDC + EU Wallet identity stack are fully multi-tenant. Every customer gets their own isolated tenant — their own users, their own trunks, their own admin UI, their own data on disk. Free to evaluate, live, on infrastructure you can verify.

Path A · You point the DNS

Bring your own subdomain.

Point an A record from your subdomain (e.g. phone.yourcompany.com) at our IP, then email us. We light up your tenant inside one business day — your domain, your Let's Encrypt certificate, your isolated admin console at phone.yourcompany.com/admin.html.

Your domain in every URL — full white-label feel
Your own SIP trunks, vnums, recordings, transcripts
Your own OIDC IdP signing keys (per-tenant RS256)
Zero data sharing with other tenants — HARD-isolated by host

Tell us your subdomain →

Path B · We host the subdomain

Pick a name. We host it.

No DNS control needed. Suggest a tenant name and we provision <yourname>.codeb.io or <yourname>.aloaha.com for you, live, free, inside one business day. Same isolation, same admin console, same per-tenant data — just under our DNS.

Live within one business day — no infrastructure prep
Same multi-tenant isolation as Path A
Move to your own subdomain later, anytime, no data loss
Free evaluation period · no card, no contract, no auto-billing

Suggest a tenant name →

Both paths give you a real production tenant — not a demo sandbox, not a screenshot, not a marketing trial that's artificially gated. The same multi-tenant code that runs phone.aloaha.com runs your tenant. The same ACL system that defends our trunks defends yours. Walk away anytime, take your data with you.

Request your free tenant → Email info@aloaha.com Call us in the browser

How it works

See the architecture, not just the screenshots.

Four canonical data flows, each one diagrammed end-to-end so an architect can verify our claims before booking a call. Every flow is on a separate page with two SVG diagrams — ingress and egress — sized for print and screen.

Flow 01 · Meetings

Your video never touches the server.

Browser-to-browser DTLS-SRTP over WebRTC; the server only relays signalling. Peer-to-peer mesh by default; auto-promotes to a self-hosted SFU on demand. See where media flows, where signalling goes, and where neither does.

View the meeting data flow →

Flow 02 · SIP bridge

Where the browser meets the phone network.

WebRTC ↔ SIP gateway with BYO trunk. PAI/RPID outbound caller-ID, multi-trunk priority, integrated TURN. Two diagrams: inbound from PSTN, outbound to PSTN.

View the SIP bridge data flow →

Flow 03 · Identity (OIDC)

Sign-in, end to end, no cookies.

OpenID Connect Authorization Code + PKCE through to refresh-token rotation, plus the EU Wallet (OID4VP) side path. Per-tenant RS256 keys, RFC 7662 introspection, RFC 7009 revocation.

View the identity data flow →

Flow 04 · Voice AI

AI on your trunk, prompts on your disk.

How a single inbound DID is mapped to a virtual-number persona, how the prompt is loaded, where the AI Voice Engine sits, and how the transcript ends up in your tenant's storage. Pluggable engine, fixed contract.

View the AI receptionist data flow →

Each diagram is a static SVG — no client-side rendering, no third-party CDN, no JavaScript required. Open the page, hit Ctrl+P, hand the print-out to your architect.

Three ways to start a conversation

Let's talk.

Whether you want a Credential Provider evaluation key, a 20-minute demo of the AI receptionist, an integration walkthrough for the OIDC IdP, or just to understand whether self-hosted CPaaS makes sense for your team — start here.

Send the form

Quick, captcha-gated, no account. Tell us your scenario; we'll come back with the right person and the right deck.

contact.html →

Email us directly

One business day for substantive replies. Forward a brief, attach a deployment diagram, send an RFP — whatever helps.

info@aloaha.com →

Call us in the browser

One click, WebRTC, no app to install, no number to dial. Rings the office during business hours CET. Uses the same SIP bridge we sell.

Click to call →

Replies within one business day. Email lands with humans, not a queue. Need an evaluation key for the Credential Provider? Add "eval key" to your subject — we ship one inside 24 hours.

Built and operated by Aloaha Limited, Malta-registered since 2003. CodeB Conference runs in production on this domain as the daily-driver phone and meeting platform for the team that develops it — dogfooded, not demoware.

Registered: Malta · Aloaha Limited· EU-hosted · no tracking pixels, no analytics SDKs· RFC 9116 security.txt published· Talk to us →

The sovereign Plan B

Plan A is surrender. Plan B is sovereignty.

In today’s IT landscape, ‘Plan A’ is surrendering your data to Big Tech, accepting vendor lock-in, and relying entirely on the public cloud. When the internet drops, your workforce is locked out.

We are CodeB. We are the sovereign, self-hosted Plan B. We give you back control of your keys, your communications, and your identity — and our systems keep running even when the internet doesn’t.

Your keys
Your communications
Your identity
LAN-fallback continuity

Air-gap-capable. FRITZ!Box, Asterisk, FreePBX, Teams Direct Routing next to it — not above it. NIS2 / DORA / CRA / GDPR aligned. EU-built.

Frequently asked questions

What is CodeB?

CodeB Sovereign Communications is a self-hosted platform from Aloaha Limited that combines identity, European Digital Identity Wallet support, telephony and Voice AI in one stack. The platform is made up of nine integrated products that can be run next to systems you already own, such as FRITZ!Box, Asterisk, FreePBX, carrier SIP or Teams Direct Routing, or used as the foundation for a new service. The www.aloaha.com homepage itself runs on the production tenant.

Who makes CodeB?

CodeB is built and operated by Aloaha Limited, a Malta-registered company that has shipped signing, PKI and secure communications software since 2003. Aloaha Limited runs CodeB in production as the daily phone and meeting platform for its own team. Emails to info@aloaha.com are answered by the people who write the code.

Which products are in the CodeB line?

The CodeB line has nine products: CodeB Credential Provider V2 for Windows logon, an OpenID Connect and Passkeys identity provider, a European Digital Identity Wallet verifier, Voice AI and PBX, a sovereign Session Border Controller, Team Chat, a Business Intelligence property management system, a Remote Signature Service and the ZUGFeRDPro e-invoicing SDK. Customers can take one product or all nine.

Can I self-host CodeB?

Yes, CodeB is designed to be self-hosted on your own IIS and bridge install, and it runs in air-gapped networks. Aloaha Limited also offers hosted tenants under your own subdomain or under codeb.io or aloaha.com. Every tenant is isolated with its own users, trunks, admin console and data on disk.

Does CodeB keep my data inside my own infrastructure?

Yes. According to Aloaha Limited, phone calls, identity sign-ins and Windows logon events stay on your server, with no US analytics SDK and no third-party CDN. The AI Voice Engine is pluggable: local TTS auto-reply ships by default with no cloud at all, and the real-time AI Voice Engine is selected per tenant by the operator, either local or a cloud provider of your choice.

Is CodeB GDPR, NIS2 and DORA aligned?

CodeB is described as aligned with NIS2, DORA, CRA and GDPR, and designed around the EU Cyber Resilience Act (Regulation 2024/2847), NIS2 and DORA from the first commit. Aloaha Limited publishes an RFC 9116 security.txt and documents its vulnerability handling. Aloaha Limited is Malta-registered and EU-hosted.

Does CodeB use tracking or analytics?

No. The CodeB site and platform are described as having zero tracking pixels, zero analytics SDKs and zero third-party CDN. The public site is EU-hosted by Aloaha Limited in Malta.

What is CodeB Credential Provider V2?

CodeB Credential Provider V2 replaces the Windows password tile through the documented Credential Provider Filter interface. The product supports NFC, TOTP, PKI smartcards and USB tokens as a second factor or for fully passwordless logon, is 100% managed .NET, and FIPS 140-2 can be enforced by Group Policy. Credential Provider V2 supports Windows 8 through Server 2025, has no cloud and no telemetry, and runs in air-gapped networks.

Can CodeB be my OpenID Connect identity provider?

Yes. CodeB includes a self-hostable OpenID Connect identity provider for Nextcloud, WordPress, Grafana, GitLab, Teams, AWS, Azure or your own apps. The IdP supports Passkeys (FIDO2 / WebAuthn), magic-link sign-in, per-tenant RS256 keys, PKCE-only flows, RFC 7662 introspection, RFC 7009 revocation and RP-Initiated Logout. The server never sees plaintext passwords.

Does CodeB support the European Digital Identity Wallet?

Yes. CodeB includes a self-hostable European Digital Identity Wallet verifier based on OID4VP 1.0, HAIP 1.0 and SD-JWT VC, live on www.aloaha.com. The verifier can be used for sign-in, account recovery, onboarding, KYC and age gating. Government-issued Personal Identification Data (PID) remains reserved for Member State-notified providers; CodeB is the verifier and relying-party integration.

What can CodeB Voice AI do?

CodeB Voice AI is a programmable, self-hosted voice AI on browser and SIP. Features include per-number persona prompts, real-time multilingual conversations, scheduled outbound campaigns with conditional retries, human transfer mid-call via SIP REFER, and transcripts and summaries emailed after every call. Calls can be started through a REST API with HMAC-signed webhooks, the AI engine is pluggable, and a local TTS fallback answers if the engine is unreachable.

Do I have to replace my existing phone system to use CodeB?

No. CodeB can run next to FRITZ!Box, Asterisk, FreePBX, carrier SIP or Teams Direct Routing, or replace those pieces on your own timeline. The CodeB sovereign SBC sits in front of your PBX or carrier trunk and handles SIP normalisation, NAT traversal, TURN and WebRTC to SIP gatewaying. You bring your own SIP carrier.

Can I make phone calls from a web browser with CodeB?

Yes. CodeB offers three browser softphones: the native CodeB Office webphone, a SIP.js softphone and a JsSIP softphone. The SIP.js and JsSIP options use SIP over WebSocket per RFC 7118 and keep credentials in the browser's localStorage. All three are installable PWAs and route calls to extensions, AI agents, virtual numbers and external destinations the same way.

Does CodeB include team chat?

Yes. CodeB Team Chat provides direct messages, group channels and file sharing up to 20 MB, served from your own install and isolated per tenant. Messages are delivered in real time over WebSocket with a poll fallback, and senders are OIDC-authenticated. A WhatsApp Business Cloud API connector lets a team reply to WhatsApp customers from the same interface.

Can CodeB sign PDF documents?

Yes. The CodeB Remote Signature Service signs PDFs from a browser or a backend using a Cloud Signature Consortium (CSC) v2 API, producing PAdES-B-T signatures with an RFC 3161 trusted timestamp. The service is Advanced Electronic Signature (AdES) scope with self-signed keys today, not Qualified Electronic Signatures (QES); the design is intended to accept a QSCD connector as a future upgrade.

Does CodeB support e-invoicing such as ZUGFeRD and XRechnung?

Yes. The Aloaha ZUGFeRDPro SDK creates and reads EN 16931-conformant ZUGFeRD, XRechnung and Factur-X invoices and reads UBL / PEPPOL. The SDK runs on-premise with COM, .NET, command-line and Web Services interfaces, so invoice data never leaves your process. Aloaha positions the SDK for the German 2025-2028 e-invoicing mandate and EU ViDA.

How much does CodeB cost?

CodeB is free during the preview, with a 30-day no-limits grace period and early-adopter pricing locked in. A free evaluation tenant needs no card, no contract and no auto-billing. Licensing and hosting options are listed on the CodeB pricing page.

How do I get started with CodeB?

You can request a free live tenant in one of two ways. Path A: point an A record from your own subdomain at the CodeB IP and email Aloaha Limited. Path B: pick a name and Aloaha provisions a subdomain under codeb.io or aloaha.com. Either tenant is live within one business day; you can also try a meeting demo without signing up.

How do I contact Aloaha Limited about CodeB?

You can use the contact form, email info@aloaha.com, or call the office from the browser with one click over WebRTC during business hours CET. Aloaha Limited replies within one business day. For a Credential Provider evaluation key, add "eval key" to the email subject and a key is sent within 24 hours.

Identity, wallets, telephony and Voice AI. One sovereign stack. Zero cloud lock-in.