Announcement Introducing iCallify Built by ASTPP’s Engineering Team to Power Modern Contact CentersExplore iCallify

ASTPP Community Edition 6.0
Data Collection Advisory and Remediation

Last updated: 13-10-2026
Product: ASTPP Community Edition 6.0
Status: Resolved in the application and the installer

Summary

A community member reported that ASTPP Community Edition 6.0 was sending information to an Inextrix endpoint without informing the administrator. The report was correct. After reviewing our code, we confirmed that the software collected account and server information and transmitted it to us once per day, with no notice in the documentation and no setting to control it.

This should not have happened the way it did. We have removed the data collection from the application, added an explicit consent step to the installer, and documented what was involved so anyone can verify the change in our public source code. This page explains what we found and what we did.

What was collected

Once per day, when the web interface was used, the software gathered and sent two kinds of information to an Inextrix endpoint:
  • Account information for every active account. This included personal data, such as contact details, not just technical or deployment statistics.
  • Server and platform information, such as the public IP address, hardware and operating system details, FreeSWITCH status, and aggregate counts of accounts, DIDs, packages, and calls.
We want to be clear and direct: the account information included personal data, and it should never have been collected or transmitted in this way.

Why it existed

The mechanism was originally added to help us understand how many ASTPP installations exist, where they are located, and which features are used, so we could plan development. That was the intent. It does not change the fact that the implementation was wrong.

What was wrong, regardless of intent

  • It collected personal data that was not necessary for understanding deployments.
  • It was not disclosed in the documentation or the installation guide.
  • It gave administrators no visibility and no way to turn it off.
  • Operators had no way to know this was happening or to stop it.

We accept these points in full.

What we have done

  • Removed the data collection code from ASTPP Community Edition 6.0, not just disabled it. The collection routine and the daily transmission are gone.
  • Removed the associated feedback mechanism.
  • Updated the installation script so it asks for explicit consent before sending anything. The default is no. If you decline, nothing is sent and installation continues normally.
  • Published all of these changes in our public repository so they can be independently verified.

How to verify

You are welcome to review the commit history, inspect the current code, and confirm that no account or personal data is collected or transmitted by the application.

Our commitment going forward

We are setting a clear standard for any feature that communicates outside the operator’s own server:
  • It will be documented.
  • It will be visible to administrators.
  • It will be off by default and under the administrator’s control.
  • A working security contact, [email protected], is in place for reporting concerns directly.

Credits

We thank infrahost and Raphael Schneeberger (github.com/ScIT-Raphael) for reporting this clearly and responsibly, and the community members who raised it for discussion.

Contact

Questions about this advisory can be sent to [email protected].