Compliance & call recording
GDPR-compliant call recording
Record every conversation — encrypted, with consent and an audit trail.
A call-recording system built for GDPR from the start: a consent announcement and opt-out, recordings encrypted under your control, supervisor pause / mask, retention periods you set, and a record of who listened to what — on an appliance you own, on-premises or in your private cloud.
The problem
Recording calls? Then GDPR applies.
If your business records calls — in the call center, in sales, or in support — GDPR applies from the first second. A voice recording is personal data, and the law requires a lawful basis, informing participants, securing the files, and a justified retention period. Most phone systems record, but leave compliance entirely up to you.
Pentacomm flips that: the compliance mechanisms — consent, opt-out, encryption, pause / mask, audit, and retention — are built into the platform, not bolted on later or left to you. You set the policy; the appliance enforces it and keeps the evidence.
How it keeps you compliant
Compliance built in — not bolted on
Every control GDPR expects for call recording is a core platform feature, managed from the same console.
- Consent announcement & opt-out — On queue, ring-group and outbound calls, an informing message plays before recording starts, with a keypad (DTMF) opt-out; the notice and any refusal are logged with the call. The announcement on calls that go straight to an extension, and an opt-in mode for consent-based recording, are in development.
- Encrypted recordings — Call recordings encrypted with AES-256-GCM per segment, with per-tenant keys and a dedicated encryption role; faxes are encrypted at rest too. The keys live on your appliance, not with a vendor — without them, a file cannot be played back.
- Your data stays with you — On-premises or private cloud: recordings and their metadata never leave your perimeter and never pass through a third-party cloud.
- Supervisor pause & mask — Pause or mask the recording in real time when sensitive data is spoken (payment card, personal data) — without dropping the call. A common PCI-DSS requirement.
- Optional periodic beep — A discreet, configurable tone that continuously signals a call is being recorded, where regulation requires it.
- Access log & audit trail — Who opened which recording, voicemail or fax, and when — on one access-log page — plus an audit log of every configuration change and every support session, for regulator and data-subject requests.
- Retrieval & export on request — Recordings indexed in searchable CDRs, with CSV, XLSX and PDF export — so you can find a person's calls and answer an access request. Search, export and erasure of everything about one person in a single step is in development.
- Retention you set, enforced daily — Set how long each category is kept — recordings, call history, voicemail, fax, call-center history, callbacks, conference logs and access logs — with legal guidance on the settings page. A daily sweep enforces it; expired recordings and faxes are crypto-erased.
- Support access under your control — Our remote support uses an encrypted connection your appliance opens outward — no inbound port, no VPN. You choose the mode: on, off, or approval per session — an engineer gets in only after your administrator approves, for a window you set. Every session start and end is emailed to the addresses you list and written to your audit log; while access is off, we cannot reach the appliance. An air-gapped installation has no remote channel at all.
The bottom line
You don't just record the calls — you can prove you do it lawfully. Consent, encryption, audit and retention, built in, on a system you own.
Frequently asked
Call recording and GDPR
Is it legal to record my company's phone calls?
Yes, under certain conditions. GDPR and Romanian law allow call recording if you have a lawful basis (typically legitimate interest or performance of a contract) and you inform participants before recording. Pentacomm plays a consent announcement before it records queue, ring-group and outbound calls, with an optional DTMF opt-out, and logs the notice and any refusal with the call.
Do I need the customer's consent to record the call?
You must at least inform the caller that the call is being recorded and for what purpose. Pentacomm delivers the consent announcement before connect and an optional periodic beep during the call, plus a keypad opt-out — and the proof of notice stays with the call record.
How are the recordings secured?
Every call recording is encrypted with AES-256-GCM, per segment, with dedicated per-tenant keys and a separate encryption role. Recordings never leave your perimeter — the appliance runs on-premises or in your private cloud, under your control.
How long can I store the recordings?
As long as your retention policy requires. You own the storage and decide the duration; GDPR requires you not to keep data longer than necessary for the stated purpose. You set a retention period for each category of data — recordings, call history, voicemail, fax and more — and the appliance removes expired data every day; expired recordings are crypto-erased.
How do I answer a GDPR request for access to a recording?
Recordings are indexed in searchable CDRs, with CSV / XLSX / PDF export, and access is role-controlled and logged. You can quickly retrieve a person's calls and prove who accessed a recording and when. Tooling to search, export and erase all data about one person in a single step is in development.
Can a supervisor pause recording when sensitive data is discussed?
Yes. Supervisors can pause or mask recording in real time (for example while a payment card is read out), without dropping the call — a common requirement for PCI-DSS and for data minimization.
Where is the data stored — with you or with me?
With you. Pentacomm runs on-premises or in your private cloud; we do not host your calls or recordings, and there is no third-party cloud component on the media path. For support, our engineers can reach the appliance over an encrypted connection it opens outward — every session is emailed to you and written to your audit log, and you can require your approval for each session or switch the access off at any time.
See GDPR-compliant recording in action.
Talk to us about a proof-of-concept on your own call center — or about early pilot access. We'll show you consent, encryption, pause / mask, and the audit log on real calls.
Contact us for early access