Skip to main content

Security and compliance

Recording consent

Disclosure, opt-out and per-jurisdiction rules.

What Finn keeps from a call

ArtifactWhen it's kept
TranscriptEvery call that connects.
Post-call analysisEvery connected call on a Finn with analysis questions.
RecordingOnly on deployments with the recording add-on switched on.

All three are kept until your retention window deletes them (transcripts and recordings) or for as long as the call record exists (analysis). See retention.

Turning recording on or off

Recording is a billable add-on, set per deployment when you create it.

WhereSettingDefault
Dashboard deploy dialogSave recordings, under Security & ComplianceOn
API, POST /deploymentsrecording_enabledfalse

The dashboard switch starts on, so turn it off in the deploy dialog if you don't want recordings. Each answered call on a deployment with recording on is charged for recording. Through the API the setting can't be changed after the deployment is created. See api-deployments.

Turning recording off doesn't stop transcription. The conversation is still transcribed and analyzed, so a written record of the call exists either way.

Where disclosure is required

In all-party-consent jurisdictions, everyone on a call must consent to it being recorded. In the US that includes California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington, among others. The rule follows the person, not your office: if your Finn calls into one of these states, or takes calls from one, you need a disclosure even if your business is elsewhere. Some laws that cover recording may also reach transcription.

This isn't legal advice. The lists change, and other countries have their own rules. Check with a lawyer who works on telecom before you launch in a new jurisdiction. See compliance-regions.

Adding the disclosure

Finn doesn't add a recording notice for you. Put it in the Finn's welcome message, so it's the first thing the caller hears:

"This call may be recorded for quality purposes."

Two things to watch:

  • Put it first. A notice buried three sentences into a long welcome message is weak evidence of consent, because the caller may already be talking over it. See agents-welcome.
  • Write it in every language. If the Finn speaks more than one language, a disclosure written only in English leaves other callers with none. See agents-multilingual.

When a caller objects

There's no way to stop recording or transcription in the middle of a call. If a caller refuses, your options are to transfer them to a person with a transfer tool or to end the call. Write the rule into the prompt:

Guardrail:
If the caller says they do not want to be recorded, apologize, tell them
you will connect them to a team member, and use the transfer tool.

To remove an existing recording or transcript for that caller, ask support. See retention.

A recording disclosure covers the recording. It doesn't cover whether you were allowed to call the person.

For people who ask not to be called again:

  • Add a Yes/No post-call question such as opt_out, so requests are easy to find in the CSV and the call.completed webhook. See analysis fields.
  • Remove those numbers from every audience and keep them out of future uploads. Finn has no suppression list, and an opt_out answer doesn't stop the next call on its own.

Saying it's an AI

This is a separate obligation from recording disclosure, but it comes up in the same conversation. Using an AI voice agent is generally legal. Deceiving someone who directly asks whether they're talking to a person is not. Add a guardrail so the Finn always answers honestly:

"If the caller asks if you're a real person, tell them honestly that you're an AI assistant."

See agents-guardrails.

Checklist before launch

  1. Decide whether each deployment needs recordings, and set Save recordings in the deploy dialog (or recording_enabled in the API) to match.
  2. List every jurisdiction your Finn will call into or take calls from.
  3. Put the disclosure at the start of the welcome message, in every language the Finn speaks.
  4. Add the AI-disclosure guardrail and a transfer for callers who refuse recording.
  5. Add an opt_out question and decide who removes those numbers from your audiences, and how often.
  6. Place a test call and confirm the disclosure is the first thing you hear.