Hello, When enabling hippaCompliance are we able to persist the recordings in a hippa compliant environment? also wondering if there are any in depth docs on live call control (ie. what kinds of control messages we can send outside of 'say') and are there docs on setting up a US (+1) vonage number for outbound calling?

Hi there! I've found some information that should help with your questions: ### HIPAA Compliance and Recordings When you enable HIPAA compliance (

hipaaEnabled: true

), Vapi will not store any recordings, transcriptions, or call logs during or after calls. This is a key requirement for maintaining HIPAA compliance [(source)](https://docs.vapi.ai/security-and-privacy/hipaa). If you need recordings while maintaining HIPAA compliance, you would need to: 1. Configure your own external storage solution (like S3) 2. Manage the recording outside of Vapi's systems 3. Ensure your storage solution is HIPAA-compliant You can implement real-time audio recordings in chunks during calls, but these won't be stored on Vapi's systems when HIPAA compliance is enabled [(source)](https://docs.vapi.ai/security-and-privacy/hipaa). ### Live Call Control Documentation For live call control, Vapi supports several types of control messages beyond 'say': 1. **Add Message**:

json
{
  "type": "add-message",
  "message": {
    "role": "system", // Valid roles: system, user, assistant, function, tool
    "content": "Your custom message here"
  }
}

2. **Transfer**:

json
{
  "type": "transfer",
  "destination": {
    "type": "number", // or "sip"
    "number": "+1234567890" // if type is "number"
    // or
    "sipUri": "sip:user@domain.com" // if type is "sip"
  },
  "content": "Optional message to say before transfer"
}

You can find more details in the [Call Features documentation](https://docs.vapi.ai/calls/call-features). ### Setting Up a US Vonage Number for Outbound Calling To set up a US (+1) Vonage number for outbound calling: 1. **If you already have a Vonage number**: - Import it into Vapi using your Vonage credentials - Use this format:

json
   {
     "number": "+12145551234", // Your Vonage Number
     "provider": "vonage"
   }

2. For outbound calling, use the

/call/phone

endpoint: ```bash

When you enable

hipaaEnabled

in the compliance plan: 1\. **Default Behavior**: By default, when HIPAA compliance is enabled, no logs, recordings, or transcriptions will be stored by Vapi. This is clearly documented in the

CompliancePlan

class: 2\. **Recording with HIPAA Compliance**: However, if you want to record calls while maintaining HIPAA compliance, you can do so by: - Setting

recordingEnabled: true

in the

artifactPlan

- Providing your own HIPAA-compliant cloud storage credentials The system supports several cloud storage providers for HIPAA-compliant recording storage: - Amazon S3 - Google Cloud Storage (GCP) - Cloudflare - Azure Blob Storage - Supabase 3\. **Important Condition**: If HIPAA compliance is enabled but no compatible cloud storage credentials are provided, recordings will not be stored at all, as shown in the code: 4\. **UI Configuration**: The Vapi dashboard UI automatically disables the recording options when HIPAA compliance is enabled (as a safety measure), but you can override this behavior if you have configured the necessary cloud storage. \## Summary Yes, you can persist recordings in a HIPAA-compliant environment when enabling HIPAA compliance in Vapi, but you must: 1\. Provide your own HIPAA-compliant cloud storage credentials (S3, GCP, Azure, Cloudflare, or Supabase) 2\. Explicitly enable recording in the

artifactPlan

settings 3\. Understand that Vapi itself will not store any recordings, logs, or transcriptions - they will only be stored in your configured cloud storage This allows you to maintain HIPAA compliance while still being able to record and access call data through your own secure cloud storage environment.

@Shubham Bajaj @User Is there any documentation on what credentials are specifically needed for uploading to S3? Do I need to create an IAM role? Additionally does VAPI handle the upload process? Or does the recording get sent to me via a webhook and I need to upload it to S3

Here is a link to the documentation on how to set up and create the credentials for using AWS. Using your credentials, we upload the recordings to S3. You don't have to

Thanks!

Marking this ticket as Solved ✅