Telyzer Server: IT security sheet

What is installed

Windows service	What it does
`TelyzerApp`	The web application and its API on one host name over HTTPS. Serves the portal to browsers and receives relays.
`TelyzerWorker`	Scheduled reports and exports, alerts, imports, contact-centre mailboxes and housekeeping.
`TelyzerGateway`	Listens for call records (SMDR/CDR) from phone systems on the network.
`TelyzerDatabase`	PostgreSQL 17, installed with Telyzer, listening on 127.0.0.1 only.

Plus Telyzer Server Manager, a signed Windows program for administrators on the server (services, licence, backups, updates, certificate, logs).

Folders

C:\Program Files\Telyzer Server\     programs (replaced by every update)
C:\ProgramData\Telyzer\              data (kept by updates and by uninstall)
  keys\         encryption key ring, protected for this machine
  attachments\  contact-centre files (email attachments)
  logs\         log files of every service, 14 days

Note: Coming with the installer release. TelyzerDatabase, Server Manager and the folder layout are created by the installer.

Ports in

Port	From	Purpose
TCP 443 (HTTPS)	Users' browsers; Telyzer Relay PCs at other sites	The portal, the API and relays. One host name; there is no separate admin console on a server.
TCP, one port per direct-push connector (40001–49999, or the port you choose)	The phone systems you allow	Call records (SMDR/CDR). Each connector accepts lines only from the sender addresses you set on it.
TCP 8081 (default)	This machine only	The listener's health check. Do not open it in the firewall.
The database port, on 127.0.0.1	This machine only	The database. Never reachable from the network.

The installer's firewall rules open 443 and the phone system ports to the local subnet; widen them only where a phone system or relay needs it.

Important: Phone systems send SMDR as plain text over TCP — that is how PBXs work. Keep direct push on your own network; across sites or untrusted networks, put a Telyzer Relay next to the phone system so records travel over HTTPS.

Connections out

To	Why	Required?
Your mail server (SMTP)	Sign-in links, invitations, password resets, reports and alerts	Yes, for email to work
Your mailboxes (IMAP/SMTP, Microsoft 365 or Gmail)	Contact-centre email channels, if you use them	Only with the contact centre
Telyzer's cloud, `app.telyzer.com` port 443 (setting `Telyzer:OnPrem:CloudUrl`)	Online licence activation; the daily licence check; critical error reports every 15 minutes. With the installer release also: the daily check for updates and the opt-in support heartbeat.	No — see below
Your domain controllers (LDAP/LDAPS) or Microsoft Entra ID	Sign-in with company accounts	Only if you set it up (coming with the installer release)
Browsers' push services	Notifications on users' phones and PCs	No

Exactly what goes to Telyzer

Daily licence check (System → Licence, can be switched off): the licence ID and revision, the Telyzer version, the licence status and usage counts (extensions, users, sites, agents). Never call data.
Critical error reports (System → Support, on by default, can be switched off): the kind of error, the program code where it happened, the Telyzer version and the operating system. Phone numbers, names, email addresses, message text, caller addresses and call records are removed before anything is stored, and never sent.
Both are signed with the server's licence key and sent over HTTPS.
A server set to work offline never connects to Telyzer at all: licences are activated with a request file, error reports are downloaded from System → Support and sent by hand.

Accounts

Services run as Windows virtual service accounts (NT SERVICE\TelyzerApp and the like), with access only to their own folders.
The database has a random password created at installation and kept encrypted for the machine (Windows DPAPI). No one needs to know it.
People are your organization's members, added by its administrators; the first administrator is created during installation. Roles and permissions are the cloud's; only members with the system.admin permission (Owners and Administrators) can change the server's settings.
Sign-in: email and password with two-step sign-in (authenticator app), and company accounts through Active Directory / LDAP or your own Microsoft Entra app.

Note: Coming with the installer release. Virtual service accounts, the database password and Active Directory / Entra sign-in come with the installer release; email, password and two-step sign-in work today.

Data at rest

Everything is on the server: the database, contact-centre files under attachments and logs under logs, in the data folder.
Stored secrets (mail server and mailbox passwords, tokens) are encrypted with the server's key ring; the key ring is in keys, encrypted with Windows DPAPI so only this machine can read it. Backups include the key ring — without it, stored secrets cannot be read.
We recommend BitLocker on the data drive, and keeping backups on storage your backup system protects.
Antivirus: scan the attachments folder (Telyzer can also send each contact-centre file to a ClamAV server you run: setting Inbox:Attachments:ClamAv = host:port). Exclude the database folder from on-access scanning, as PostgreSQL recommends.

Data in transit and in the application

Browsers and relays use HTTPS only (HSTS). Mail uses STARTTLS or SSL/TLS unless you choose an unencrypted internal relay.
The same protections as the cloud: session cookies, CSRF protection, rate limits, role-based access, row-level isolation in the database and the Audit log.
Warnings and errors go to the Windows Event Log (Application log, sources TelyzerApp, TelyzerWorker, TelyzerGateway) and to log files under logs.
The licence never stops call collection: whatever its status, call records are received and kept.