Call recording and consent

§01 The rule

What Romanian and European law wants

A recorded telephone call is personal data on both sides of the line, and recording it is processing that needs a lawful basis under Article 6 — usually the caller's consent, sometimes a contract, occasionally a legitimate interest that survives being written down and balanced. Which of those applies is a question about your business, and this page will not answer it for you.

What is not in serious doubt is the transparency half. The person on the line has to be told, before the recording starts, that it is happening and why, and told plainly enough that a decision to stay on the line means something. In practice that is a sentence at the start of the call, and in Romania the supervisory authority has been consistent that a notice buried in a website policy is not it.

Two practical points that catch people. Consent has to be as easy to withdraw as to give, which for a telephone call means a caller who says "stop recording" must be able to stop it. And if the call is with an AI assistant, that is a second, separate disclosure — one sentence can carry both, but one of them does not stand in for the other.

These pages describe what this software does. They are not legal advice and they do not decide whether what you are doing with it is lawful. That decision is yours, and in most of the interesting cases it depends on facts about your business that no software can see.

§02 The switch

Off until you turn it on

Recording is decided per assistant and per organization, and nothing records by default. When it is on, the audio of the call is captured by the voice gateway; the control plane never handles a media frame, which is why every decision below is about a file rather than about a stream.

A recording that starts can be paused and resumed during the call, and a call that transfers to a human operator produces a second recording of that leg, fetched from the carrier afterwards so that your retention policy governs it instead of theirs.

Off until you turn it on
Default	Off.
Granularity	Per assistant, within an organization policy.
Who captures it	The voice gateway. The control plane sees the record, not the audio.
After a handoff	The operator leg is fetched from the carrier and stored under your retention, not theirs.
Withdrawal	A denied consent state pauses recording. It does not delete what was already captured.

§03 Consent

Five ways to announce it, and the default is none

The product models this properly. There are five announcement modes — say nothing, play a standard announcement, have the assistant say it, play your own audio file, or speak your own wording — and the consent state of a call is tracked through pending, announced, granted and denied, with a configurable behaviour when a caller refuses.

And then two facts undo most of it, both of which belong on this page rather than in a release note. The default mode is to say nothing, in the migration, in the fallback policy and in the resolving service. And there is no interface in the console or the API for a customer to change the organization-level recording policy at all — it is set from the platform side.

Worse, and verified while writing this: the assistant-level plan is written into the call snapshot under one name and read back under another, so the lookup always fails and the policy always falls through to the default. The practical consequence is that no announcement is spoken on any call today, whatever is configured. It is a bug, it is on the record here, and it is ahead of new features.

none Say nothing. The default. The default
announcement Play the standard announcement before the assistant speaks.
assistant_announcement The assistant says it, in its own voice, as part of the greeting.
custom_audio Play an audio file you uploaded.
custom_message Speak wording you wrote.

§04 Location

The audio passes through our bucket first

This is the paragraph a residency review will find, so it is at the top of the section rather than at the bottom. The voice gateway holds no tenant storage credentials — by design, because giving a media process a customer's S3 keys is a worse trade — so it writes the finished recording to the platform bucket the moment the call ends. If you have configured your own destination, a queued job then copies the object across and deletes the source, and only after the copy is verified.

So a recording exists on platform storage for the time it takes that job to run. If your destination is unreachable, disabled or misconfigured when it runs, the object stays on the platform bucket rather than being lost, and it stays there until the destination works.

The other artefacts behave differently and better. Transcripts, message logs and event exports are written by the control plane, which does hold your credentials, so they go straight to your bucket with no staging copy. The operator-leg recording fetched from the carrier is written directly to your bucket too.

The audio passes through our bucket first
Assistant recording	Platform bucket first, then relocated to yours. The window is one queued job.
Operator recording	Fetched from the carrier and written straight to your bucket.
Transcripts and exports	Written straight to your bucket. No staging copy.
If relocation fails	The object stays on the platform bucket and is retried. It is never deleted before the copy is verified.
Object path	Derived from the call row, never from anything a caller supplies.

§05 Retention

How long the audio lives

A scheduled job runs every night at 03:15 and applies the retention policy for every organization: anything past its window is deleted from the object store and its row is marked purged. The starting windows are below, and they are a platform default rather than a recommendation — ninety days of call audio is a long time if you have no reason to keep it.

Zero data retention is a separate mode, and its name promises more than it does. It strips the content of a call — transcripts, messages, tool arguments, event payloads, summaries — and deletes the audio, either immediately when the call ends or after a delay you set. What it does not do is ask any vendor for anything: the audio still went to a transcription vendor and the text still went to a model, under their retention, not ours. It removes our copy. Nothing more, and the source says so.

What survives every one of these paths is the shape of the call: identifiers, both telephone numbers, timestamps, duration, billable seconds, cost rows and the audit log. The numbers stay in the search index, so a call remains findable by number after its content is gone.

How long the audio lives
Recordings	90 days by default.
Transcripts and structured outputs	365 days by default.
Events and logs	90 days by default.
Analytics	No window is applied. Kept.
Audit log	No window. Entries cannot be deleted.
Zero data retention	Our copy only. No vendor is asked to retain nothing.

§06 Redaction

Text only, after the call, and off by default

Personal-data redaction rewrites transcripts, message content and event payloads after a call, replacing card numbers — Luhn-checked, so a sixteen-digit order reference is not masked for nothing — email addresses, telephone numbers, IBANs and national identifiers including the Romanian CNP. Word-level timings are discarded at the same time, because keeping them would undo the redaction one word at a time.

Three limits, and each one matters more than the feature. It is off unless you switch it on. It never touches audio: a card number read aloud is still on the recording, and the flag that suggests otherwise is not implemented on either side. And it is a rewrite of data we already hold, applied after the call — the unredacted text existed in the database, and it went to the transcription vendor and the model before it existed here at all.

If a caller must never say a card number to an assistant, redaction is not the control. Not asking for one is.

§07 Your bucket

What changes when the storage is yours

Your storage

You choose the provider and the region, you can apply your own lifecycle rules, and the object stops living on our infrastructure once the relocation completes. For an organization whose recordings are governed by somebody else's policy, that is the difference that makes the product usable.

Four things it does not change, listed because each one has surprised somebody. The recording still passes through the platform bucket on its way. Reads still go through URLs we sign, expiring in fifteen minutes, so we remain in the access path. Your credentials are encrypted under a key separate from the application key, and the AWS role option avoids a long-lived key pair entirely. And the retention window on a destination is stored but not enforced — retention runs from your organization policy, not from the bucket.

One more, and it is the reason the storage page says supported rather than proven: no customer bucket has ever been pointed at a live installation. The write, read, compare and delete probe passes, and that is a different claim from a year of production traffic.

A route to a person, which is the point of publishing this

A DPA nobody can ask a question about is a PDF. If your review turns up something this page does not cover, or something it gets wrong, the form reaches the person who wrote it.

Ask a compliance question See the demo

The rest of the set

The other European documents

None of the seven documents in this set has been through a lawyer. They are engineering statements about a running system, published because a wrong description is worse than a missing one, and they will be reviewed before anybody is asked to sign anything.

Notes

1 The nightly run is callagent:calls:apply-retention, scheduled at 03:15 in bootstrap/app.php.
2 The relocation job is app/Jobs/Storage/RelocateArtifactToStorageDestination.php; it verifies the destination write before deleting the source.
3 Retention defaults are column defaults on the organizations table: 90 days for recordings and events, 365 for transcripts.
4 Redaction is app/Services/Calls/PiiRedactionService.php, run from the call finaliser and only when the policy asks for it.

Recording is off, and silence is not consent