An application destined for a client VoIP device is available at a service provider 20 and is loaded first to a client-side device over an unsecure public network, using a secure protocol. The VoIP device is not able to receive the application directly using the secure protocol and the client side device is instructed to load the application to the client VoIP device over a private network using an unsecure protocol.