Hello VAPI team, First of all, what an amazing product your team has built! Truly great. I wanted to check today about security and privacy. We're about to work with a publicly traded FinTech company that wants to leverage voice AI capabilities as part of their operational flows. One question they had was around cybersecurity. From looking at the vapi platform, it looks like it can support HIPAA and PSS, which is great, but then it means that we will not get access to the recordings. Is there a way to make sure we can leverage enhanced cybersecurity but still keep the recordings?

You can achieve enhanced cybersecurity and still keep call recordings by enabling PCI compliance and configuring a PCI DSS Level 1 compliant cloud storage (e.g., AWS S3, GCP, Azure, or Cloudflare R2) for your Vapi assistant. Here’s a sample configuration:

json
{
  "compliancePlan": {
    "pciEnabled": true
  }
}

Note: If you enable both HIPAA and PCI compliance, recordings and transcripts will not be stored, even with cloud storage configured. For further details, see the [Vapi PCI compliance documentation](https://docs.vapi.ai/security-and-privacy/pci). Source: - [PCI Compliance | Vapi Documentation](https://docs.vapi.ai/security-and-privacy/pci)

Hi tlvtech, To maintain cybersecurity while using Vapi's HIPAA and PCI-compliant settings, it's important to note that these configurations are designed to not store call logs, recordings, or transcriptions on Vapi’s systems. This aligns with privacy standards. However, if you still need access to recordings while maintaining a high level of security, consider these options: 1. **Enable compatible cloud storage**: For PCI compliance, you can store recordings in a compliant environment like AWS S3 or Azure Blob Storage. Ensure the storage solution adheres to your security requirements. 2. **Utilize webhooks**: Configure a webhook to receive transcriptions securely if needed, allowing you to store them according to your own compliance protocols. For HIPAA compliance, remember that recordings are not stored, but an end-of-call report can be generated for your records. To ensure optimal security and compliance, you can toggle between these settings as needed, but keep in mind the implications for data privacy and access. [More details here](https://docs.vapi.ai/security-and-privacy/hipaa).