Why We Applied for Anthropic's Cyber Verification Program

Your business phone line carries things you would not want anyone else to see: the numbers your customers call from, your call records, the bookings District AI makes for you. The best time to find a security flaw in the software behind it is before anyone else does. That is why we applied to Anthropic's Cyber Verification Program, and on November 7, 2026, Anthropic approved Distronode for Defense Access.

Why it matters for a phone company

A phone line is an attractive target, because an attacker who gets into the software behind it can reach far more than one business's records. As a Canadian telecommunications company, we hold those records for businesses in four regions, and we publish where each call is handled. Keeping our software secure is part of the service we sell.

We are a small team, and we already build with Claude every day, from writing and reviewing code to checking our own changes before they ship. Anthropic runs the Cyber Verification Program because the same skills that take apart an attack can also be used to build one, so Claude's safety checks can interrupt deeper security work for anyone. Verifying who is asking lets Anthropic relax those checks for defenders working on their own systems, so that work is far less likely to stop halfway.

What Defense Access lets us do

Claude already helps any developer review code and find bugs in their own software. Defense Access goes further, for verified defenders working on their own systems. For us, that means we can ask Claude to:

• work through a security incident in depth, from the first alert to the fix;
• examine a suspicious file and analyze any malicious code inside it;
• confirm whether a reported vulnerability is real, and check that a fix closes the hole it was meant to close;
• write sharper detection rules, so a real threat stands out from false alarms.

It covers the software you rely on every day: the District AI apps and voice agent, distronode.com and the four regional sites behind them.

What it does not touch

Defense Access is for our own security work, and District AI does not use it to answer your calls or texts. If your workspace has chosen the optional Claude brain for its receptionist, that works exactly as before and stays on our sub-processor list.

The commitments that come with it

Anthropic approves this access with requirements, and we think they are the right ones:

• Phishing-resistant sign-in. By December 15, 2026, every account that can use this access will sign in with a passkey or a security key, not a code that can be phished.
• No long-lived keys for Claude. By the same date, nothing will reach these models with a stored API key. Access will use short-lived credentials that expire on their own.

We are putting both in place ahead of Anthropic's deadline.

What this means for you

Nothing changes on your side. Your numbers, your receptionist and your settings work exactly as before. What changes is behind the scenes: we can find and fix security issues in our software sooner, with better tools, before they reach your phone line.

It builds on what we already publish about where your data lives. Our last update explained how your workspace's email is now sent from your region, and the Canada, Europe and Asia-Pacific pages name every service that runs outside the region.