Cenaly Phone: direct calls between devices

Cenaly Phone can call from device to device directly — phone to phone, phone to computer and back — without a PBX, a SIP server or a Cenaly account. Devices pair once, and after that they call each other straight away. In the same network (Wi-Fi at the office, in a warehouse, at home) the call goes over the local network and works even without internet; with “Calls over the internet” turned on, it works between different networks too. The call and its audio are encrypted with your devices' keys, and the pairings and the call history are stored only on the device.

Which version you need#

What you need#

You don't need a Cenaly account. If you are signed in to Cenaly Phone with a staff account, direct calls work next to the work line, and signing out of Cenaly doesn't remove them.

Turning it on#

Without a Cenaly account. On the app's first screen choose “Direct calls between devices” (“Call your phones and computers in the same network or over the internet. No account needed.”). Direct calls turn on and the “Add device” screen opens right away. From then on the app starts as a softphone rather than on the sign-in screen.

With a Cenaly account, or later. Settings → “Direct calls” → “Turn on direct calls”.

What Settings → “Direct calls” contains:

Pairing#

Pairing is done once for each pair of devices. Open “My devices” → “Add device” (or the add button on the lamp board) and choose a method.

After pairing you see “Device “…” added” and an “Undo” button — in case you added the wrong device.

If the digits differ and you tap “Does not match”, pairing is cancelled: “Pairing cancelled. Someone may be interfering — pair with a QR code instead.” After three failed attempts within 10 minutes there is a pause: “Too many attempts. Try again in 10 minutes.”

Invitation link#

1. On the first device: “Add device” → “Send an invitation link” — send the link, which looks like https://cenaly.com/p2p/pair#…, by messenger or email.
2. On the second device copy the whole link, open “Add device” and tap “Open an invitation link” — the app takes the link from the clipboard.
3. Compare the security code (the section below) to make the pairing verified.

The link is valid for 5 minutes. Everything after the # sign is never sent to the server — these are the pairing keys, and they stay between your devices.

My devices and the security code#

Settings → “Direct calls” → “My devices” — the list of paired devices with a status lamp. Pairings that haven't been compared yet are marked “Not verified”. While there are none — “No paired devices yet”.

On a device card:

• “Name on this device” — how to label the device for yourself. If the other side changes its own name, your label isn't overwritten.
• Call.
• “Security code” — 12 digits. “Compare this code on both devices. If it is the same, tap “Matches”.” It's handy to read it out loud on the phone or when you meet. After “Matches” the “Not verified” mark disappears.
• “Check direct connection” — what prevents calling directly (see “Guest Wi-Fi and client isolation”).
• “Remove device” — remove the pairing. After that this device can't call you. If it is online, the pairing is removed on its side too — it shows “Pairing removed”.

Device lamps#

Paired devices appear as lamps on the BLF board — like PBX extensions (more about the board — “BLF lamps”):

Devices tell each other whether they are free, ringing or on a call (“Available”, “Ringing”, “On a call”, “On hold”, “Do not disturb”, “Offline”). In the same network the status updates at once. Over the internet — only while your lamp board is open: a phone is never woken up just for a status. If a device can only be reached by waking it, the lamp is grey with the caption “Will answer when called” — you can call, but whether it is free is unknown. A device lamp without fresh data never shows “Available”.

Tapping a lamp or swiping right — call; swiping left — edit (the device card); the menu also has “Remove”. Device lamps have no pickup and no transfer. Whoever turns off “Show my status to paired devices” doesn't share their status.

The call#

You can call from the device card, from a lamp or from the Calls history. The call screen shows how the audio travels:

• “Direct” — between the devices, without servers;
• “Via Cenaly server (encrypted)” — the audio goes through the Cenaly server and stays encrypted (see “Calls over the internet”).

While the device is waking up — “Waking the device…”; if the network changes mid-call (for example, the phone leaves Wi-Fi for mobile data) — “Restoring the connection…”.

If “Show with a warning” is selected in the settings, a call from an unknown device comes with an “Unknown device” banner and the caption ““…” — this is how it named itself”. An unknown device picks its own name, so don't take it at its word. Buttons: “Block” and “Add to my devices”. With “Reject silently”, such calls don't reach you.

The direct call history is stored only on the device; in the no-account mode, direct calls appear in Calls together with calls on your own SIP lines.

Calls over the internet#

If the devices are in different networks — say, one phone at the office and another with a courier on mobile data — both need “Calls over the internet (Cenaly server)” (on by default).

• The Cenaly server works as an anonymous postman: it passes sealed call messages between devices and wakes the phone with a notification. No account is needed, and it's free.
• Whenever possible the audio goes directly. If the network doesn't allow a direct connection, the audio goes via the Cenaly server — still encrypted.
• Only audio goes through the server, and no more than 60 minutes a day per device. When the limit is used up you see “Today’s limit for calls via the Cenaly server is used up” — calls in the same network and direct connections keep working.
• “Always via Cenaly server” hides your network address from the other device, but every call uses this daily limit.
• Turn off “Calls over the internet” and the app doesn't contact Cenaly for direct calls at all; you can only call within the same network.

Incoming calls in the background#

What Cenaly sees#

Settings → “Direct calls” → “What Cenaly sees” says it plainly: “Calls between your devices go directly and are encrypted. To reach a device over the internet, the Cenaly server passes sealed messages between devices and wakes the phone. It sees device keys, times and network addresses, but not names, content or sound.”

• A sealed message waits for delivery for no more than 2 minutes and is deleted from the server no later than 15 minutes after that.
• The device registration and the notification address are deleted after 60 days without an update and are never matched with Cenaly accounts.
• To find a path over the internet, the device asks a STUN service for its public address. With the “International (cenaly.com)” server region this is Cloudflare's public service (stun.cloudflare.com): it sees the device's network address and nothing else — no keys, messages or audio.
• The device keys are kept in the system store: on iPhone — in the Secure Enclave, on Windows — in the Windows protected store, on Ubuntu — in the keyring.
• Cenaly's cloud features — call recording, the assistant, the transcript, speech translation — are off for direct calls.
• Pairings, keys and the direct call history are stored only on the device. Signing out of Cenaly doesn't erase them; only “Delete key and all pairings” does.

A lost device and a new phone#

Direct calls have no account and no central revocation: Cenaly doesn't know which devices are yours, and there is no way to “block the phone in the cloud”. So if a device is lost or stolen:

1. On each of your remaining devices open “My devices” → the lost device → “Remove device” (“Lost a device? Remove it here on each of your devices.”).
2. Ask colleagues who had it in their “My devices” to do the same.

After that the lost device can't call any of you.

A new phone has to be paired again: pairings can't be moved through the cloud. Remove the old device from “My devices” and add the new one by any method from “Pairing”. The same applies after “Delete key and all pairings” and after reinstalling the app.

Guest Wi-Fi and client isolation#

Guest and public Wi-Fi (cafés, hotels, business centres) often doesn't let devices see each other — this is called client isolation. The device card → “Check direct connection” shows what exactly is in the way:

A VPN works like a local network: devices in the same VPN call each other directly.

Is it safe on a public network? Direct calls are received on a single port (TCP 42917) and no SIP port is opened, so SIP phone scanners on public Wi-Fi have nothing to find. The app doesn't answer anyone it isn't paired with, and with “Only my devices” visibility it doesn't show its name in the network.

iPhone specifics#

• The device keys are kept in the Secure Enclave.
• On first use iOS asks for access to the local network — allow it. Without it, “Nearby” and calls in the same network don't work.
• The call uses the iPhone system call screen, like any call; over the internet, an incoming call also shows on the lock screen.
• Without internet, in the same network, incoming calls arrive only while the app is open.
• The QR code is scanned with the camera. Tapping an invitation link doesn't open it yet — copy the link and tap “Open an invitation link”.

Computer specifics: Windows and Ubuntu#

The sign-in screen has the same “Direct calls between devices” entry, and ⚙ has “Direct calls” (with or without an account). Differences from a phone:

• No camera. Instead of a scanner there is “Open an invitation link”: it pastes from the clipboard an invitation link or the QR code text of the other device. “Send an invitation link” copies the link to the clipboard.
• A pairing created by pasting is shown as “Not verified” on the computer — even if the phone in the same pair shows it as verified. Compare the “Security code” on both devices and tap “Matches”.
• Windows Firewall asks on first launch for permission for incoming connections (TCP 42917). Allow it for private networks — otherwise the computer can't be reached in the same network.
• Ubuntu keeps the keys only in the keyring (Secret Service — gnome-keyring or KWallet). Without it, direct calls don't turn on: “Device keys are unavailable, so direct calls are off.”
• Calls are received while the app is running; it lives in the notification area.
• Without a microphone or sound devices the call is receive-only — you hear the other side, but they don't hear you.
• A direct call on a computer has no tone keys and no transfer: the buttons are visible but unavailable.
• “Address of this device” may also list virtual network addresses (Docker, VPN). Pick the address in the same network as the other device.

The “Russia” server region#

With the “Russia (cenaly.ru)” region, calls over the internet aren't available. Calls in the same network already work. Pairs from different regions (one phone on “International”, the other on “Russia”) don't connect over the internet, but do in the same network. When calling over the internet isn't possible, the app shows “Internet calls are unavailable”.

Limitations#

• The Cenaly Phone browser extension doesn't support direct calls.
• Only between Cenaly Phone apps: you can't call a regular number or another vendor's SIP phone directly.
• No call transfer, group calls or video.
• Pairings aren't moved to a new phone through the cloud — only by pairing again.
• Recording, the assistant, the transcript and speech translation are off for direct calls.
• Via the Cenaly server — no more than 60 minutes of audio a day per device.
• “Russia” region: only calls in the same network.

Troubleshooting#

FAQ#

Do I need a Cenaly account?#

No. Direct calls work without an email, a company or a plan. If you have an account, direct calls work next to the work line and aren't removed when you sign out of Cenaly.

Is it paid?#

No. Calls via the Cenaly server are free but limited: audio only and no more than 60 minutes a day per device. Direct calls don't count towards this limit.

Can I call a regular number or a SIP phone this way?#

No — only between devices with Cenaly Phone. For regular numbers you need a PBX: Cenaly's or your own.

Can I pair with a colleague's phone?#

Yes, with any device that has Cenaly Phone. Keep in mind: if a colleague loses their phone, you have to remove it from your “My devices” yourself.

Does Cenaly hear my conversations?#

No. The audio is encrypted with your devices' keys; even when it goes via the Cenaly server, the server doesn't decrypt it. Direct calls have no recording, transcript or assistant.

Which port should be open in the network?#

The app receives direct calls on TCP 42917. If the port is taken, it picks another free one and announces it itself in the QR code and in the “Nearby” search. No SIP port is opened.

Related articles#

• Cenaly Phone: your own SIP server without a Cenaly account
• Cenaly Phone: BLF lamps
• Cenaly Phone: swipes and gestures
• Cenaly Phone: several places, auto-answer, sign-out and password
• Telephony: your own PBX