Privacy and compliance
Voice agents handle personal data by nature: people say their name, their number, and sometimes far more. These are the controls.
Redaction
Redaction is currently inactive and cannot be turned on. It scrubbed the stored transcript only, while the live call log still carries the turn as it was spoken, so it protected less than its name suggested. The control is read-only in the builder until that gap is closed. Agents that already carry the flag are unchanged.
compliance.redact_pii on an agent replaces emails, phone numbers and card-like
numbers in the stored transcript. It matches structured identifiers only: names,
addresses and free-text detail are not removed, and neither are numbers a caller
spelled out in words.
Treat it as a reduction in stored detail, not as de-identification, and do not rely on it to meet a regulatory obligation.
Recording
Recording is off by default and enabled per agent. Whether you may record, and whether you must announce it, depends on your jurisdiction - in many places you must tell the caller. If you must announce it, put it in the agent's opening line.
Recorded audio is never given out as a storage address. A playback link is minted when you read the session, is scoped to that one call, and expires within the hour, so a link cannot be forwarded and does not become a standing way in to a customer conversation. See Sessions.
Deleting data
An organization's data can be exported and deleted on request. Deleting an agent removes its sessions and their recordings.
Deleting an agent that has call history is blocked by default, because it would destroy the record of those calls. Archive it instead if you only want it out of the way.
Where data goes
Your data lives in your organization's region. Conversation content is sent to the model, transcriber and voice providers you chose for the agent, which process it on their own infrastructure - so which providers you pick is part of your compliance posture, not just a quality decision.
What is yours
Glytos gives you the controls. Consent, calling hours, do-not-call lists, disclosure, and the lawful basis for what you do with what you capture are your responsibility - and they vary by country.