It uses ZRTP and SRTP at least for the audio / video streaming portion of the service. The exact ciphers and strength are decided by the two clients making the call, as OStel server itself has no hand in negotiating crypto for that portion. Since we support many different client types (CSipSimple, Jitsi, Groundwire, SFLPhone, etc) this can vary greatly.
OStel.co does address this - we are specifically trying to lay out how a privacy-first, security by design VOIP service should be run. We are taking stock, off-the-shelf open-source software, and figuring out the best configuration for it to be run in order to store as little data as possible. We are also thinking about how we can defend against tracking of signaling information - by perhaps running the SIP/TLS portion over Tor.
You can read about this and more on some of our posts on the Guardian Project blog:
For signaling, nothing magic with OStel - we are using standard SIP over TLS. The TLS certifcates are based on the standard Root CA trust model. We are looking into pinning as possible feature for the Android CSipSimple app. We are already supporting features like pinning and trust on first use (TOFU-POP) in Gibberbot, so we understand the importance here of those advanced features.
Ultimately, our focus with OStel (and the larger Open Secure Telephony Network) is to build best-practice based secure voice systems built on free software, that work like the Internet does. This also means apps like Jitsi, Groundwire, SFLPhone and other compliant clients can work just as well with our system as the primary Android app we focus on.
https://guardianproject.info/wiki/OSTN#Client_Software