Governance
Anonymising the contact does not anonymise the recording.
The name comes off the record and the audio still carries the person's voice, the transcript still carries their words, and the coaching still quotes them by the sentence.
Which is why an erasure request that stops at the contact record has not done the thing it claims to have done.
Before
Consent is a refusal, and it happens before storage.
Not a banner, not an acknowledgement afterwards. An upload without confirmed consent is stopped before a single byte reaches disk, and the confirmation is recorded with who gave it, from what address, and when.
The meeting bot takes the other route to the same place: it is visible in the participant list under its own name, so consent is something everyone in the meeting can see rather than a clause in something somebody signed. The step that attaches the recording asks again.
- Be deliberate about the dialler —
On dialled calls the announcement to the other party is yours to configure and deliver. The platform does not make it, and in most places you need it — treat that as a requirement rather than an option.
After
Deleting a call deletes everything derived from it.
The transcript, the searchable index, every extracted fact, the coaching — all of it, because leaving the derivatives is how a deletion becomes a deletion in name only.
The file itself is removed afterwards on a best-effort basis, deliberately: a storage failure must not roll back the deletion. And the record of the deletion is written before it happens, so the act survives into the audit trail even when the thing it describes no longer exists.
- An erasure request reaches the recordings —
With the reasoning written into the product rather than inferred: the audio, the transcript and the coaching quotes all carry the subject's voice and words.
- A person under legal hold is skipped —
The subject of a recording is the human on the call, so the hold that protects them protects it.
- Spend survives the recording —
The cost of processing a call stays queryable after the call is purged — so purging does not blind you to what you spent.
- Cost is metered per operation —
Transcription, extraction, indexing, questions, dialling, storage and bot joins, each recorded with what it cost. Minutes are kept to four decimal places so a thirty-second call records half a minute rather than nothing.
›How long are recordings kept?
By your retention policy. Set one — without a policy for call recordings, nothing is purged, and that is the wrong default to inherit by accident.
›Who can play a call?
Anybody who can read calls in the workspace. Grant that deliberately.
›Can somebody outside the company reach a recording?
Only through a shared moment, which you create deliberately and can password-protect, expire and revoke.
›Is the audio served to the browser from a permanent address?
No. Playback uses a short-lived signed address rather than a durable link, and it is scoped so that it can only ever refer to the thing it was minted for.