Privacy
Data and privacy controls per agent, from call recording and spoken consent to redaction, retention, and telemetry.
Every control in the agent editor's Privacy section decides what a call leaves behind.
Like every editor section, it is editable on a draft and locked once the version is published, so make privacy changes before you publish.
Workspace defaults and per-agent pins
Every control here is a per-agent override of a workspace default. Leave it on "Inherit workspace default" and the agent follows the workspace. Pin it and you fix it for this agent only. Workspace defaults live in Workspace and members.
Each inheritable control reads back as one of three states:
- Inherit workspace default -- no per-agent value; changes to the workspace setting carry through.
- On (or a pinned value) -- fixed for this agent regardless of the workspace.
- Off -- also a deliberate pin; an explicit "off" wins even when the workspace default is on.
For the toggles (call recording and the two disclosures), the inherit state is stored as an empty value. The moment you flip a toggle either way, you have pinned it.
Call recording
Call recording controls whether the platform stores the call audio.
| Setting | Effect |
|---|---|
| Inherit workspace default | Records only if the workspace default is on |
| On | Records this agent's calls |
| Off | Never records this agent's calls |
The workspace default for recording is on -- the one privacy default that starts switched on.
When you record audio, tell the caller. That is what the recording disclosure below is for.
Consent and disclosure
The agent can speak two short consent lines at the start of a call: a recording disclosure and an AI disclosure. They sit ahead of the greeting and are the first thing the caller hears (see Voice and speech).
Turn the recording disclosure on whenever you record call audio. Consent and disclosure covers the preset lines, the spoken order, and why a switched-on but blank disclosure blocks publishing.
Data storage
The Data storage control decides how much of each call is kept after redaction runs -- the levels, categories, and matching rules are on PII redaction.
Redaction happens when transcripts are written to storage. It never touches the live conversation, so it cannot break the agent mid-call.
What redaction does not reach
Redaction applies to the stored transcript only. The call recording is unredacted audio -- a number the redactor strips from the transcript is still audible. Turn call recording off if that matters.
Data retention
Retention sets how long this agent's transcripts are kept before automatic deletion.
| Setting | Effect |
|---|---|
| Inherit workspace default | Follows the workspace retention setting |
| A fixed period | Deletes transcripts older than that period (1 day to 2 years) |
| Keep forever | Never auto-deletes transcripts |
The default is to inherit the workspace default. Use a shorter period for agents that handle sensitive calls.
The audit log is on a third clock
The workspace audit log — who changed what, when, from which IP, and whether it was allowed — is kept for two years by default, set separately under Settings → Compliance and privacy. It is deliberately longer than transcript retention: the record of who deleted a call has to outlive the call, or the trail expires with the thing it describes.
Refused attempts are recorded too. A permission check that says no is a security signal, and a log of successes alone cannot answer whether anyone tried.
Reading a call is recorded, not just changing one
Opening a call's transcript, playing its recording, listening to a call in progress, or opening a caller's profile writes its own entry, under Access beside Changes on the same page. The entry records who, when, from which IP, and whether audio was actually served — never the transcript, the recording, or anything the caller said. Those stay where they were.
The two are kept apart because they answer different questions and arrive at very different rates: a workspace changes a setting occasionally and opens call detail all day. Mixing them would bury the change trail rather than enrich it.
Access entries follow the same retention as the rest of the audit log, and export with it.
Recordings are on a separate clock
Retention does not govern call audio
This setting does not govern call audio. A recording is stamped with its own expiry when it is written, thirty days by default, and a separate job deletes the audio file when that expiry passes. The transcript purge never touches stored audio, and the audio purge never reads this setting.
So an agent set to "Keep forever" keeps its transcripts indefinitely and still loses its recordings after thirty days. The recording window is a platform-level value, not a per-agent or per-workspace one. Contact support if you need audio kept longer or deleted sooner.
Transcripts and recordings both appear on Calls and analytics until their respective clocks expire.
Telemetry
Telemetry controls how much call content flows to third-party observability tools. Data storage governs what the platform keeps; telemetry governs what leaves to those services. The subprocessor list is available in writing on request -- see Compliance.
| Level | What is sent |
|---|---|
| Inherit workspace default | Follows the workspace telemetry level |
| Off (metadata only) | No conversation content, metadata only |
| Redacted content | Content sent after the PII redactor runs |
| Full content | Verbatim content |
The workspace default is Off (metadata only). The inherit row shows the resolved level, so you can see what an agent on "inherit" actually sends.