All external services – Web server, XMPP signaling, STUN/TURN are set up to be TLS encrypted with a certificate and using latest ciphers.
IoChat which uses WebRTC, also has a big advantage over most VoIP services in the security area. Until now, most services have typically treated security as optional, meaning most end users use VoIP calls without encryption. Since WebRTC forbids unencrypted communication, users can be assured that their data remains safe and private.