At CASA25, a standout panel dove deep into one of the most critical—and least understood—aspects of the vCon revolution: how to handle consent, compliance, and data provenance in an AI-driven world.

Moderated by Thomas Howe of Strolid, the panel brought together a mix of perspectives from across the ecosystem: Jason Goecke (Creo Solutions), Nima Golchini (Enea), Tony Nuzzo (Approved Contact), and Ben Curtis and Dean Landsman from JLINC. Together, they explored how programmable trust and verifiable consent are becoming the new foundation of intelligent communications.

From Permissions to Provenance

Tony Nuzzo of Approved Contact opened with a simple but powerful premise: trust starts with permission.

His company’s new Permissions product lets brands validate consent explicitly — not just “we think they agreed,” but clear records of whether customers allow their voice to be used in AI, or whether they want to receive texts or calls.

“You want to be a trusted brand, not just a brand,” Tony said. “And the VCon gives you a way to prove that trust.”

By capturing this consent inside verifiable conversation data, VCons effectively become an insurance policy for brands — proof that engagement is both compliant and authentic.

Security First: Cleaning the Pipeline

Nima Golchini of Enea then connected the dots between consent and cybersecurity.

Enea provides messaging and signaling firewalls that filter spam, block malicious content, and enforce regional compliance rules across operators and CPaaS providers.

He explained how AI models now detect campaign drift — where a registered campaign sends unrelated content — and help enforce national codes of conduct, like France’s restriction on promotional messages during weekends.

“It’s about keeping a clean pipeline,” Nima said. “Security, compliance, and monetization all depend on it.”

JLINC: Proof That Data Stays True

The discussion moved to data provenance, where Ben Curtis and Dean Landsman from JLINC outlined how cryptographic signatures and zero-knowledge auditing can verify the flow of data without ever exposing its contents.

Ben explained how their system ensures that data shared between systems — for example, between AI models or CPaaS platforms — is traceable, trusted, and compliant with privacy regulations.

“We can prove that the data went where it was supposed to go, and came from who it was supposed to — without ever revealing the private data itself.”

Dean added that this capability turns compliance into something verifiable and automatic:

“From the moment data begins to the moment it ends, it still belongs to its originator. That’s the essence of trust under GDPR and every new data law to come.”

Smart Contracts for Consent

When Jason Goecke of Creo Solutions joined the exchange, he described VCons as the foundation for programmable compliance.

“It’s like a smart contract for communication,” he said. “Consent travels with the data itself. That gives you ownership, transparency, and interoperability — the foundation for trusted applications.”

VCons, in this view, turn consent into code — allowing businesses to automate trust, not just declare it.

The New CRM: Conversational and Consumer-Centric

Closing the panel, Dean Landsman reflected on how VCons could transform CRM systems.

Traditional CRMs were designed to collect and exploit data, not to protect it. The next generation, he said, will be conversational and consumer-centric — powered by verifiable, user-owned data.

“CRM hasn’t really had guardrails before. VCons bring them,” he said. “They ensure customer data stays their own — and make the system finally work for the customer.”

From Compliance to Confidence

The message from this CASA25 panel was clear: VCons aren’t just about storing conversations — they’re about redefining digital trust.

They turn compliance into a design principle, enable verifiable provenance for AI, and make consent portable across every layer of the communications stack.

As Thomas Howe closed the session, he summed up the mood perfectly:

“This isn’t about regulation slowing us down — it’s about trust becoming programmable.”

In a powerful and refreshingly down-to-earth keynote at CASA25, Sebastian Schumann of Deutsche Telekom Global Carrier pulled back the curtain on one of the most ambitious initiatives in European telecom: building a sovereign CPaaS platform, purpose-built for the wholesale market — and for a world increasingly defined by trust, sovereignty, and intelligent engagement.

This isn’t just another API platform. It’s a blueprint for how telcos can reclaim the CPaaS narrative, embed themselves deeper into enterprise value chains, and offer something that the tech giants simply can’t: control, compliance, and carrier-grade connectivity — at scale.

🔍 The Why: It All Starts with Sovereignty

Deutsche Telekom’s CPaaS platform was born out of a hard regulatory reality. As Sebastian shared, their prior communications tech stack — hosted on a US-based hyperscaler — was abruptly deemed non-compliant for sensitive sectors like healthcare and government.

“We couldn’t even use infrastructure that belonged to the big US hyperscalers,” Sebastian explained. “So we built our own — in Europe, for Europe.”

This shift became an opportunity, not a setback. In fact, it became a key differentiator. European enterprises, especially in regulated industries, are increasingly demanding data sovereignty, local hosting, and compliance with EU laws like GDPR and Schrems II.

Deutsche Telekom’s new CPaaS platform is hosted completely within Europe, built with open-source components like SignalWire and Mation, and architected to be disconnected from third-country data jurisdictions.

It’s not just a product. It’s a position — one that’s uniquely valuable in today’s world of rising digital nationalism and privacy expectations.

⚙️ The How: Telco Assets + Software Mindset

What makes Deutsche Telekom’s approach stand out is their clear focus on building, not buying.

Their team assembled a CPaaS platform from the ground up, layering modern APIs on top of decades of core telco infrastructure:

• Billions of voice minutes already flow through their aggregation stack
• SMS and RCS connectivity is managed directly or via Google’s hub, with Telekom handling the commercial aggregation that’s still a pain point in RCS
• The CPaaS layer is carrier-owned, carrier-operated, and extensible via open standards or compatibility layers

And they’ve embraced developer-centric principles without falling into the telco trap of waiting on standards committees.

“We didn’t wait for the standards. We used what’s already the de facto standard in the market,” Sebastian said. “Real-world compatibility is more important than agreement by committee.”

To ease onboarding, they even offer compatibility layers for customers migrating from “the big guys,” allowing them to reuse existing integrations and switch endpoints without rewriting applications.

🛠 The What: Not Just APIs — Solutions

This isn’t about API counts or developer dashboards. Deutsche Telekom’s platform is designed to solve real customer problems, with a special focus on wholesale enablers and enterprise resellers.

In fact, Sebastian made a point to say:

“You don’t sell APIs. You sell what’s behind them — the capabilities. And really, you sell a solution to a problem.”

That’s why the platform includes a low-code integration layer, allowing customers to connect CPaaS capabilities directly into systems like Salesforce or other CRMs — without needing deep technical teams or external SI support.

Think of it like this:

You’re an enterprise who needs to trigger a voice notification from Salesforce You don’t want to hire developers Deutsche Telekom’s platform lets you drag and drop that integration as part of a managed service — fully hosted in a European sovereign cloud

This is what Intelligent Engagement looks like in practice:

CPaaS that starts with a use case, not an API spec.

🤝 A Platform and a Product: White-Label CPaaS for Carriers

Here’s where it gets really interesting.

Deutsche Telekom isn’t just offering CPaaS to large enterprise customers — they’re enabling other telcos to plug in their own trunks, white-label the platform, and run their own branded CPaaS on top of Telekom’s infrastructure.

It’s a multi-layered go-to-market model:

Serve direct wholesale traffic generators Enable partners and telcos to offer CPaaS under their own brand Offer full-stack capabilities: from local trunks and termination to CRM integration and billing

For smaller telcos looking to enter CPaaS or modernize their enterprise offering, this could be a fast track to market, bypassing years of development.

📚 The Roadblocks: Education & Awareness

Despite the technical readiness and regulatory fit, the biggest challenge isn’t code — it’s culture.

“Educating our own salespeople was tough,” Sebastian admitted.

“They know how to sell SMS and voice — now we’re asking them to sell something that helps others sell voice and SMS. It’s a different mindset.”

And enterprise customers don’t always speak the language of CPaaS. They don’t ask for APIs — they ask for automation, web interfaces, and ways to simplify communication workflows.

This underscores the need for solutions storytelling, not just product specs.

🧭 Why This Matters

Deutsche Telekom’s CPaaS initiative isn’t just a technical feat — it’s a strategic blueprint for European telcos looking to stay relevant in a cloud-first, AI-driven, privacy-sensitive world.

• ✅ It reclaims telco value by combining connectivity with software
• ✅ It meets rising enterprise demand for sovereignty and trust
• ✅ It turns legacy assets into future-facing solutions
• ✅ It empowers other telcos to participate in CPaaS without building from scratch

And most importantly, it does all this without waiting for the perfect standard or the next committee meeting.

“It’s not black and white,” Sebastian said. “But if you have the numbers, the routes, and compatibility — you’re in the game.”

🚀 Final Word

At CASA25, Deutsche Telekom showed what’s possible when a telco leans into its strengths, learns from the platform players, and delivers value the European way — with control, compliance, and real-world business models.

It’s not just CPaaS. It’s CPaaS with purpose.