one option is that the server is hosted inside a protected environment
-> https POST / webRTC connection & signalling -> should be allowed firewall
-> STUN & TURN servers (currently using Twilio) may be hosted inside the protected environment
-> what could be outside ?
-> the SMS should also be sent from inside the environment & deleted immediately after the sending