Recordings and retention

What is recorded

Calls are recorded in two channels: the person on one, and what the person hears on the other. The recording is a WAV file. To switch recording on or off for a campaign, see recording.

How a recording is kept safe:

1. The call is written to a temporary spool on the phone server.
2. It is uploaded to storage. The storage service reports a SHA-256 fingerprint and a size, and both are checked.
3. Only then is the spool file deleted.
4. If an upload fails, it is retried. If the phone server stops mid-call, the file it left is repaired and registered when it starts again.
5. A reconciliation check lists answered calls with no stored recording after 15 minutes, a failed recording, or one still waiting. Platform operators read it.

Who can play

Owner, admin, supervisor, QA and compliance can play or download a recording. Every access is written to the audit trail first. If the audit entry cannot be written, nothing is served. Recordings are found from the person’s journey. See journeys.

Recording consent by state

In some states everyone on the call must agree to recording. The rule recording_consent with all_party marks them. When any state a person points to needs it, the call carries that flag, and the bot asks for recording consent. The Safety overview’s check says “Everyone on the call must agree to recording here.” Calls placed by hand through the API, and every inbound call, get the strict setting.

All-party states in the starting rules: CA, CT, DE, FL, IL, MD, MA, MI, MT, NV, NH, OR, PA and WA. Counsel should confirm the list and the wording. See rules and counsel review.

Retention

Retention is how long you keep recordings before deleting them. Counsel should decide it, and it can differ by what the recording is evidence of.

Not yet

The 10-year figure in the code is a placeholder pending counsel. It is only written onto each recording as a “keep until” date. Nothing deletes recordings when that date passes.

Not yet

Each plan has a field recording_retention_days (the starting plans use 30 and 3650). It is stored and passed on, but no service reads it to keep or delete recordings. Today it enforces nothing.

Not yet

Local storage is not locked. A stored recording can still be changed or removed by someone with access to the storage. Locked storage and encryption keys depend on a real object store and are not set up.

Note

Reading a transcript is not written to the audit trail yet. Playing a recording is.

Until these are built, decide your retention period with counsel, write it down, and plan to delete by hand. See before you call.