What is the difference between transit encryption and end-to-end call encryption?

Transit encryption (such as standard TLS on SIP) protects the audio as it travels between your device and the provider's server — but the provider's server decrypts and re-encrypts the audio to forward it onward. This means the provider has access to plaintext audio at their media gateway. End-to-end encryption means the audio is encrypted on the sender's device, travels as ciphertext through all intermediate nodes including the provider's infrastructure, and is only decrypted on the intended recipient's device. The provider never has access to the audio. Most enterprise voice platforms offer transit encryption and market it as "encrypted calling" — a distinction that matters significantly for high-sensitivity conversations.