Data storage, privacy and retention

Privacy is configured per agent in the builder, under Security & Fallback Settings, and applied to each call after it ends. Workspace-wide tools cover per-call removal, the admin PII reveal and deletion requests.

Data storage setting#

Data Storage Setting (data_storage_setting) decides what is kept after a call:

The setting is applied after the call_ended and call_analyzed webhooks and post-call analysis have run, so your webhook receivers and analysis get the full data once. What stays in Tried afterwards follows the setting.

You can also change the setting for a single live call with update-live-call (data_storage_setting).

PII scrubbing#

With Everything except PII, PII to remove (pii_config.categories) picks the categories. All are selected by default:

Detection uses patterns first. When an LLM provider key is configured, a second LLM pass finds names and addresses the patterns miss. Redacted text is replaced with [redacted:<category>], for example [redacted:email]. Word timestamps of redacted utterances are dropped, since they would reveal the original words.

Recordings: the redacted words' timestamps are covered with a 1 kHz beep. WAV files are edited in place; Ogg and MP3 recordings are decoded and re-encoded.

GET /privacy/call/:call_id shows what was applied to a call: the setting, when it ran and redaction counts per category.

Show PII (admins)#

When a call is scrubbed, Tried keeps an encrypted copy of the unscrubbed data for 30 days by default (TRIED_PII_REVEAL_RETENTION_DAYS). Admins can reveal it with the Show PII switch in Call History, or GET /v2/get-call-unscrubbed/:call_id. Developers and members cannot. Every reveal is written to the audit log as call.pii_reveal. Expired copies are deleted by the daily privacy job.

Remove sensitive data from one call#

Remove sensitive data in the call drawer scrubs every PII category from that call now, whatever the agent's setting, and beeps its recordings. It works on ended calls only. Admins and developers can use it.

curl -X POST https://api.tried.com.au/v2/remove-call-sensitive-data/call_7f3a... \
  -H "Authorization: Bearer $TRIED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keep_unscrubbed_copy": false}'

keep_unscrubbed_copy defaults to true. Set it to false to keep no copy for Show PII. The action is audited as call.remove_sensitive_data.

Recording retention#

Recordings are kept for 30 days after a call ends, then the audio files are deleted. The call record, transcript and analysis stay; recording_url and recording_multi_channel_url become null.

To keep recordings longer, an admin picks a longer period in Settings, Security, Recording retention, or sets recording_retention_days with Update workspace settings. Longer retention is opt-in and billed on each call's recorded minutes:

The price is $0.001 (AUD) per minute for each 30 days past the included 30. It appears on the call's cost as a recording_retention_<days>d line, priced when the call ends, so changing the setting does not re-bill past calls. Agents set to Basic attributes only record nothing and pay nothing.

The daily privacy job deletes recordings past the workspace's period, measured from when each call ended. Shortening the period deletes older recordings on the next run. Agent-level Data retention below still deletes whole calls, recordings included, on its own schedule.

Retention#

Data retention (data_storage_retention_days) deletes calls older than the chosen period:

A privacy job runs once a day (first run a minute after the API starts). For each agent with retention set, it deletes ended calls older than the cutoff together with their mixed and dual-channel recordings. Calls still in progress are never deleted. The same job deletes recordings past the recording retention period. Admins and developers can run the purge for their workspace now with POST /privacy/run-retention.

Recording and log links#

Recording URLs on the call object are always signed links, never public bucket paths.

With S3 storage Needs keys, links are S3 presigned URLs. With local storage (no S3 keys), links point at the API with an expiry and an HMAC signature. The public_log_url and knowledge base retrieval links on a call are signed and valid for 7 days.

Delete everything for a phone number#

To answer a deletion request (for example under the Australian Privacy Principles), delete all data held for one phone number:

curl -X POST https://api.tried.com.au/privacy/delete-phone-number \
  -H "Authorization: Bearer $TRIED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone_number": "+61412345678"}'

{ "phone_number": "+61412345678", "calls_deleted": 4, "sms_deleted": 9, "sms_chats_deleted": 1, "contacts_deleted": 1 }

The number is matched as written and in E.164 form (AU numbers in local format are normalised). Calls to or from it are deleted with their recordings, along with SMS messages, SMS chats and the contact record.

Deleting single records#

Deleting a call (DELETE /v2/delete-call/:call_id) also deletes its recordings. Deleting a whole workspace deletes all of its data; see Workspaces.

Related#

• Security and compliance
• Exports
• The call object