A product that records conversations has to answer for them.
Every call carried through this platform will produce a recording, a transcript and the phone number of the person on the other end. That is the heaviest data footprint in the suite outside HR, and the questions it raises — where does it live, who can hear it, how long is it kept, what happens when a customer asks you to delete it — deserve a page rather than a chip in a row.
The three things people get wrong about call recording.
Not because they are hard, but because they are easy to leave until a customer asks.
Pause before the card number
A rep taking a payment over the phone will be able to pause the recording and resume it, from the same screen the call is on. Without it, your card data obligations arrive in an audio file you did not mean to create — and the usual discovery of that is an auditor, not an engineer.
Retention is a setting, not a default
You will set how long recordings are kept, per number and per team, because a sales call and a complaint call do not have the same answer. Deletion when the period ends will be the behaviour rather than a cron somebody has to remember to write.
Not everyone with a login may listen
Playing a recording will be its own permission, granted per team, and every playback will be written to a log with who and when. A conversation your customer had with one of your reps is not general office reading.
Consent and the do-not-disturb registry are checks, not settings.
The obligations here fall on you as the sender, which is exactly why the platform should enforce them rather than trust them. Where this page and the acceptable use policy differ, the policy is the binding text.
The consent you hold is stored with the number
A missed call, a form submission or a tick on a webpage is a consent event, and it will be kept as a record against the contact rather than as a claim somebody makes later. When a customer asks what you had, the answer should be a row, not a recollection.
Scrubbed before it is dialled
An outbound campaign number is checked against the do-not-disturb registry before the call is placed, and the permitted calling hours are a gate the campaign cannot run outside. Neither is switchable — an option to turn off a legal obligation is a liability with a toggle on it.
Opt-out that actually takes effect
An opt-out has to stop the next message, not be honoured at the next list refresh. It will apply at the contact, across campaigns, immediately — which is the only reading of "promptly" that survives a complaint.
Registered headers and templates, enforced
The platform refuses to send on an unregistered header or a body that does not match a registered template, rather than letting it fail silently at the operator. The numbers page covers what registration asks of you.
On our own infrastructure, inside India.
Recordings, transcripts and call metadata will sit on Comsky Cloud, in Indian data centres, on the same platform the rest of the suite runs on — which means the residency answer is the same answer, rather than a different one per product.
Data residency
- Recordings written in Indian data centres
- Transcripts stored beside them
- Call metadata in the same region
- No copy held outside India by default
- Storage region selectable on the contact-centre tier
Access and audit
- Playback as its own permission, per team
- Every playback logged with who and when
- Monitor, whisper and barge each recorded as having happened
- Deactivating a user removes telephony access in the same action
- Admin changes written to the account’s own audit trail
Deletion and export
- Retention period you set, per number and per team
- Deletion removes audio, transcript and index entry
- Recordings fetched over authenticated, expiring links
- Export of your own call records over the API
- Nothing left on a public URL
Comsky Cloud is live today and has its own security page, which describes controls that are running rather than planned. This page is about a product that is not.
The part a security page usually leaves out.
Everything above is a design. Here is what that costs you as a reader, stated rather than implied.
There is no deployment of Comsky Telephony, so none of these controls has ever been exercised against real traffic. There is no carrier contract, which means the leg of the call we do not control is not yet contracted for. There has been no external audit and no penetration test of this product, and it holds no certification — we have none to name and are not going to borrow one from elsewhere in the suite. And nothing here is end-to-end encrypted: a call that is recorded is decrypted in order to be recorded, and any product that offers you both is telling you one of the two things that is not true.
About the recordings, mostly.
Where will recordings and transcripts be stored?
In Indian data centres, on Comsky Cloud. Retention is a setting you control, and deletion means deleted — including from the transcript index, which is the copy people forget about.
Can I stop a call being recorded while a card number is read out?
Yes, that is the design: pause and resume from the agent’s own screen, mid-call. A platform that records everything and tells you to handle card data elsewhere has moved the problem to you without saying so.
Who in my team will be able to listen to a recording?
Whoever you grant it to. Playback is its own permission rather than something that comes with a login, it is granted per team, and each playback is logged with who did it and when. A supervisor who listens live — monitor, whisper or barge — is recorded as having done so too.
Is the audio end-to-end encrypted?
No, and it cannot be while the call is recorded: a recording is made by decrypting the audio. Audio will be encrypted in transit between the legs and at rest once written. Any telephony product that offers you recording and end-to-end encryption together is wrong about one of them.
What happens when a customer asks us to delete their data?
The recording, the transcript and the transcript index entry go together, on your instruction. The call metadata that your own invoice depends on is a different question, and the answer is in the privacy policy rather than here.
Are you certified for this?
No. There is no certification on Comsky Telephony, no external audit and no penetration test, because there is no deployment to audit. When there is, this page says so with the date on it. Borrowing a certification from another product in the suite would be the easy thing to write and would be untrue.
Does the agent need good broadband to take a call?
Not necessarily. The dialer bridges two carrier legs, so the call can land on an ordinary mobile or desk handset and the audio path does not depend on your office broadband. A browser softphone is planned as well, for teams that want one.
Start with Comsky Telephony.
Grow into the ecosystem.
One Comsky account, being rolled out across the products — and one invoice covers them, however many you run.