@Vapi is it normal that the recording URLs can be accessed without authentication?

Thank you for your question. To help clarify, are you referring to recording URLs generated by Vapi's default cloud storage, or are you using a custom storage solution (like S3 or GCS) for your recordings? Source: - [Call recording](https://docs.vapi.ai/assistants/call-recording)

@User it is the default cloud storage

Vapi's documentation states that recordings in default cloud storage are encrypted and access is controlled via API credentials, but it does not specify whether the actual recording URLs require authentication to access. If you are concerned about unauthenticated access, the best practice is to configure custom storage with your own access controls or enable compliance features (like PCI or HIPAA), which restrict storage and access more tightly. For sensitive use cases, review your storage configuration and consider reaching out to Vapi support for clarification on URL access policies. Reference: [Call recording documentation](https://docs.vapi.ai/assistants/call-recording) Source: - [Call recording](https://docs.vapi.ai/assistants/call-recording)

@Vapi Support Bot can this be forwarded to a human agent please?

To reach a human agent, please email support@vapi.ai with your request and conversation details. Alternatively, you can join the [Vapi Discord community](https://discord.com/invite/pUFNcf2WmH) for real-time support in the #support channel. Tip: Include relevant context or links to this conversation for faster assistance. Source: - [Vapi Support Documentation](https://docs.vapi.ai/support)

To answer your question, yes it is normal. If you configure your own cloud storage, you can configure credentials to secure your recordings. However, if you choose to secure your recordings behind your credentials, you will have to manually send us the recordings to debug issues. Let us know if you have any questions