On this page
A phone call can contain a name, an address, an order, a health question, or a card number read out loud. Before putting an agent on a real line, you should know where that information goes. Here's what the platform does, including its limits.
What gets stored
A call can produce audio recordings, transcripts, analysis results and logs of the tools the agent used. Audio and text also pass through the speech, language and voice providers you selected. Those providers process them under their own terms, so they belong in your review too.
Redaction in stored logs
Unless your deployment turns it off, stored call logs go through pattern matching. That covers transcript text, summaries, extracted fields and call metadata. It replaces:
- Email addresses
- Phone numbers
- Card-like number sequences
- US social security number patterns
Fields with names suggesting credentials, such as tokens or API keys, are also masked.
It's important to know what this misses. Pattern matching looks for shapes, not meaning. It won't reliably catch a person's name, a street address, or a medical detail. Nor will it catch a number spoken as words and transcribed that way, such as "nine eight seven six". Don't treat redaction as anonymisation, and if your calls may contain sensitive details, restrict who can read them.
Zero-PII retention
If you don't need a transcript or recording after the call, an agent can be set to zero-PII retention, which stops them from being kept. It can't be combined with storing call audio. The trade-off is real: you'll have much less to review when a call goes wrong, so it suits a mature flow better than a new pilot.
Retention
A scheduled job runs daily and deletes data past its retention period. Transcripts follow a setting on each agent, from 1 to 3,650 days, with a default of 90. Recordings default to 30 days and are set for the deployment as a whole. Choose periods based on your needs rather than leaving the defaults in place.
Before you rely on deletion, check that it covers everything you think it does. Anything you sent to your own systems by webhook stays there under your own rules, and it won't be deleted by ours.
Access inside your organisation
Data is scoped to your organisation. Team members get roles and permissions, API keys are managed per organisation, and audit logs record administrative activity. Credentials you save as secrets are encrypted. Give recording access only to those who need it.
What the speech engine offers
Our engine has regional endpoints and data controls for some providers, including model-training and retention opt-outs for Deepgram and ElevenLabs. Availability depends on your provider and your deployment, so ask us to confirm your exact setup rather than assuming it's in place.
What your review should still cover
zlicx gives you controls. It doesn't make your use of them lawful by itself, and this article isn't legal advice. Have someone responsible check:
- DPDP Act obligations for the personal data in your calls, if you serve people in India
- Call notices. Does your opening line say the caller is speaking with AI, and that the call may be recorded?
- Sector rules for health, finance or insurance
- Where data is stored, including each provider you've chosen
- Your deletion process when a person asks
We don't claim any certification on this page. If you need formal documents for a vendor review, ask us what's currently available.
Reduce what you collect
The most effective step is the simplest one. Don't ask for what you don't need. An agent confirming a delivery doesn't need a date of birth. Tell it never to request OTPs, card numbers or passwords, and test what it does when someone offers them anyway.
The customer support workflow shows where these limits apply in practice. Recordings and analysis are part of the standard usage covered by our pricing.
Apply these limits to a real flow.
Work out what your calls will contain, then collect less of it.