> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiveku.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance and Recording

> E911, HIPAA, PCI, recording controls, and toll-fraud guard

Running a phone system means inheriting a stack of legal and regulatory obligations — emergency services, recording disclosure, healthcare privacy, payment data, and runaway billing risk. Hiveku Communications has built-in controls for each, and surfaces them in `/dashboard/communications/` under the **Compliance** tab.

## E911 — required by law

The RAY BAUM Act (US) and similar laws elsewhere require that any phone capable of dialing emergency services have a **verified physical address** so first responders know where to go. Hiveku enforces this at provisioning time.

<Warning>
  You **must** register an E911 address for every DID before activating an extension on it. Hiveku will not provision the line without one. This is non-negotiable — both for legal reasons and for the safety of anyone dialing 911 from your line.
</Warning>

<Steps>
  <Step title="Add an address">
    From the Compliance tab, **E911 Addresses** > **New address**. Enter the street address, city, state, postal code.
  </Step>

  <Step title="Wait for verification">
    Hiveku validates the address with the carrier's MSAG (Master Street Address Guide). Most addresses verify in seconds; ambiguous ones may need manual review.
  </Step>

  <Step title="Assign to a DID">
    On the **Numbers** tab, set the E911 address for each DID. Multiple DIDs can share the same address.
  </Step>

  <Step title="Update on physical move">
    If you move office or a remote employee changes location, update the E911 address. The address tells first responders where to go.
  </Step>
</Steps>

<Info>
  For mobile softphones used by remote employees, the registered E911 address is wherever they typically work. If they travel, dialing 911 from the softphone routes to their **registered** address — they should use a real cell phone for emergencies while traveling.
</Info>

## Call recording

Recording is configurable per DID, per ring group, per queue, and per extension. Decide what to record and when, and keep tight control over who can listen.

<Tabs>
  <Tab title="On / off">
    Default is off. Turn on globally, per direction (inbound only / outbound only / both), or per route.
  </Tab>

  <Tab title="Announcement">
    Required by law in many jurisdictions. The agent and/or caller hears: "This call may be recorded for quality and training purposes." Configurable per route.
  </Tab>

  <Tab title="Opt-in (two-party consent)">
    Some states (CA, FL, IL, MA, MD, MT, NH, PA, WA) require all parties consent. Hiveku can prompt the caller for explicit "Press 1 to consent" before recording starts.
  </Tab>

  <Tab title="Pause and resume">
    Agents can pause recording during PCI-sensitive moments (taking a credit card) and resume after. Keypress shortcut on the phone or button in the browser softphone.
  </Tab>
</Tabs>

## Recording retention

Set how long recordings are kept before automatic deletion.

| Retention        | Use case                                                          |
| ---------------- | ----------------------------------------------------------------- |
| 0 days           | Don't record (or delete immediately) — for HIPAA-strict workflows |
| 7-30 days        | Quality assurance review window only                              |
| 90 days          | Default for most businesses                                       |
| 1-7 years        | Regulated industries with retention obligations                   |
| Custom per route | Different policies for different DIDs                             |

<Warning>
  Some industries (healthcare, financial services) have **minimum** retention requirements; others (HIPAA-covered entities) have **maximum** restrictions on how long recorded health discussions can persist. Consult counsel for your specific obligations — Hiveku gives you the tools, but the policy is yours.
</Warning>

## HIPAA controls

For healthcare-covered entities, Hiveku offers:

* **Encrypted-at-rest recordings** — Standard for all accounts
* **Restricted access** — Per-user permissions on listening and downloading recordings
* **Audit log** — Every listen, download, and config change is logged
* **Custom retention** — Down to 0 days, with hard delete after the retention window
* **Business Associate Agreement (BAA)** — Available on Business plans and above; required for HIPAA workflows

Contact sales to enable BAA terms on your account.

## PCI-DSS

If your agents take credit card numbers over the phone, you must avoid storing the card data in recordings. Use **pause and resume**:

```
Agent: "Let me pause the recording so I can take your card. Pausing now."
[Caller reads the card. Agent enters into payment system.]
Agent: "Resuming. Thanks for your patience."
```

The pause-resume keypresses or button clicks are logged so you can prove compliance. Or, route card-capture to an automated DTMF entry that the agent can't hear — see your payment processor's docs for "agent-assisted DTMF" patterns.

## Toll-fraud guard

Toll fraud is what happens when an attacker gets credentials to your phone system and uses it to dial expensive premium numbers — a single incident can cost five figures. Hiveku's toll-fraud guard protects you with:

<CardGroup cols={2}>
  <Card title="Daily spend cap" icon="dollar-sign">
    Configurable per account. When hit, outbound calls are blocked until you raise the cap or wait until the next day.
  </Card>

  <Card title="Concurrent call cap" icon="layer-group">
    Maximum simultaneous outbound calls. Defaults to 2x your normal peak. Anomaly trips suspension.
  </Card>

  <Card title="Country whitelist" icon="globe">
    By default, outbound is allowed to your account's primary country only. Add more as needed. Premium-rate numbers always require explicit allowlisting.
  </Card>

  <Card title="Anomaly detection" icon="triangle-exclamation">
    Velocity, destination, and time-of-day patterns. Outliers trigger a soft-suspend — your team gets an alert and can quickly approve or block.
  </Card>
</CardGroup>

## Audit log

Every change to compliance-sensitive settings is logged with user, timestamp, before/after values, and IP address.

| Event                    | Logged                                |
| ------------------------ | ------------------------------------- |
| Recording listened to    | User, recording ID, timestamp         |
| Recording downloaded     | User, recording ID, timestamp         |
| Recording deleted        | User, recording ID, reason, timestamp |
| Retention policy changed | User, old policy, new policy          |
| E911 address updated     | User, DID, old address, new address   |
| Toll-fraud cap changed   | User, old cap, new cap                |
| User permission changed  | Granter, grantee, scope               |

Logs are exportable as CSV for SOC 2 and similar audits.

## Opt-out for SMS

By law (TCPA in the US), SMS recipients must be able to opt out at any time. Hiveku enforces this automatically:

* Inbound `STOP`, `UNSUBSCRIBE`, `QUIT`, `CANCEL`, `END`, or `OPTOUT` (case-insensitive) triggers an opt-out
* All future SMS to that recipient from any of your numbers is blocked
* The recipient can text `START` or `UNSTOP` to re-opt-in
* Confirmation messages on opt-out and opt-in are sent automatically

You don't need to implement this — it's at the platform level.

## Caller ID and STIR/SHAKEN

To reduce spoofing and "Spam Likely" labeling:

* Hiveku enforces caller ID rewrite — extensions can only outbound from numbers actually owned by your account
* STIR/SHAKEN attestation is signed automatically for all US outbound
* For high-volume outbound, register your business with the FCC's Robocall Mitigation Database (free) for full attestation

## Troubleshooting

<AccordionGroup>
  <Accordion title="E911 address won't verify">
    The address may not be in the carrier's MSAG database, especially for new constructions or rural addresses. Submit a manual verification request from the address detail page; Hiveku ops will work with the carrier.
  </Accordion>

  <Accordion title="Recordings stopped saving">
    Check that recording is enabled on the route the call took (DID → ring group → extension — recording flag at any layer can disable). Storage quota is also worth checking on legacy plans.
  </Accordion>

  <Accordion title="Toll-fraud guard suspended my outbound">
    Open the alert in the dashboard, review the flagged calls. If legitimate, raise the cap and unsuspend. If fraudulent, change extension passwords immediately and review recent SIP registrations in the audit log.
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Buy a number" icon="phone" href="/how-tos/buy-phone-number">
    Includes E911 verification step.
  </Card>

  <Card title="Communications overview" icon="circle-info" href="/communications/overview">
    Full feature index.
  </Card>
</CardGroup>