Where Your Recordings Live: Residency as Architecture, Not Policy

The highest-consequence data decision in the building

A call recording contains a customer’s name, their phone number, their account number, their financial position, sometimes their health details, and — on a collections floor — frequently their distress.

Shipping that to a QA vendor is one of the most consequential data decisions a contact centre makes. Under India’s DPDP Act, 2023, it is a decision with statutory weight rather than merely reputational weight.

The market makes this harder than it needs to be. Most conversation-intelligence vendors process in US or EU regions, are vague about where derived data lives — the transcripts, the sentiment scores, the flagged quotes — and answer residency questions with a compliance page rather than an architecture.

A compliance page is a description of intent. The question a DPO is actually asking is a question about topology.

“Where is it processed” and “where is it stored” have different answers at most vendors, and the second one is usually the one nobody volunteers.

Why policy substitutes for architecture

Because region-sharding a SaaS product is expensive and touches everything.

Authentication, routing, storage, deployment pipelines, support tooling, monitoring — each has to become region-aware, and each is a place where a mistake means data crosses a boundary silently. It is months of work that produces no visible feature.

Writing a policy takes an afternoon. So the category writes policies, and the difference only becomes apparent when somebody asks a question specific enough to distinguish the two.

What we changed: residency you can point at

The API host is genuinely region-sharded. The region is stored per user and returned at login, and the application talks to a region-specific host from that point on. A separate global host handles login only.

Deployments exist for ap-south-1 (Mumbai, primary) and ap-southeast-1 (Singapore).

The consequence is the part that matters: a customer’s calls stay in their region because they are served by a different stack, not because of a setting. There is no configuration flag whose misconfiguration moves your data, because there is no flag — there is a different deployment.

The rest of the posture, specifically

Hosting	AWS ap-south-1 (Mumbai). Your data stays in India.
Derived data	Transcripts, sentiment, emotion and scores held in the same region as the audio
Source of truth	Your connected storage stays under your control
PII masking	Per workspace; redacts names, account numbers and ID numbers from transcripts
Masking scope	Transcript text and derived outputs — the audio recording is unchanged
Masking timing	Applies to calls processed after activation, not retroactively
Retention — recordings & transcripts	15 days from processing
Retention — reports & analyst notes	12 months
Deletion	On request, at any time
Credentials	Encrypted in the browser before transmission at sign-in
Internal access	Restricted to the analyst team assigned to your account
Audit-log retention	Enforced by a daily expiry job, not by convention
Regulatory frame	Indian DPDP Act, 2023

The 15-day / 12-month split is the line worth pausing on. It says the recordings — the sensitive part — are transient, and the findings — the useful part — persist. That is the shape a compliance officer wants and it is not the shape that is cheapest to build, because it means the system has to be able to explain a finding after the audio behind it is gone. Which is why every finding carries its quote and its timestamp inline, as described in What You Cannot Prove.

Cross-tenant discipline is written into the analyst rules

Unusually, this appears in the operating instructions rather than only in a policy:

Indian and Mauritius workspaces sometimes hold US training recordings … never quote any PII or PHI — no names, numbers, dates of birth, case or medical detail; quotes limited to generic greeting and closing lines. … PHI must not persist on disk.

And the practical list of what never touches disk: the database password, customer phone numbers, and the original audio.

On-premise is a real option

Not a checkbox. It is wired through the front end, extends the registration flow with SMTP configuration, replaces presigned cloud upload with direct posting, hides the cloud integrations entirely, and adds a filesystem watcher that ingests anything dropped into a monitored directory.

That depth of investment normally means a real customer required it, which is the most reliable signal that an on-premise option is genuine rather than aspirational.

What we do not claim

We do not claim HIPAA or PCI certification. That statement is already live on our FAQ and it stays here. If your requirement is a certification, we are not it, and finding that out on this page is better for both of us than finding it out in procurement.

Masking is instructed, not yet verified. The pipeline is told to mask, and it does — you can see substitutions in real output. What does not yet exist is a post-load check that confirms the masking actually scrubbed everything. “We mask” is accurate. “We mask and we check it worked” is not yet, and it is on the list precisely because the difference matters to the person reading this.

Masking is not retroactive. It applies to calls processed after you activate it. Calls already processed keep whatever they had.

The audio itself is never modified. Masking applies to the transcript and everything derived from it. The recording in your storage is untouched — which is correct, since it is your record, but it means the audio is not a masked artefact.

Where to start

The question worth asking every vendor in your shortlist, in these words: where is the derived data — the transcripts and the scores — not just the audio?

The answers separate architecture from policy quickly, because the second answer is the one that has usually not been rehearsed.

Book a demo and we will walk you through the residency model and what masking does and does not cover.

---

Related: What You Cannot Prove on evidence that has to survive the audio’s retention window, and One Rubric Does Not Fit Every Campaign on the per-workspace masking switch.