​

Redaction vault

​

What the vault is

• Deterministic, not probabilistic. The engine is fixed pattern matching — the same redaction primitive Orbit uses everywhere PII is stripped — not an LLM judgment. The same transcript always yields the same redacted copy, and every removed span is counted and typed.
• Opt-in per tenant. The vault runs only when you enable it under Compliance → Recording redaction vault in your organization settings (settings.compliance.recording_redaction_vault.enabled). A settings read failure fails closed: the vault stays disabled rather than risking an incomplete copy.

​

The artifact contract

{
  "status": "redacted",
  "redacted_at": "2026-03-08T12:12:00Z",
  "transcript_redacted": "Agent: May I have your card number? Caller: Yes, it's [CREDIT_CARD_REDACTED]. Agent: I'll also send a receipt to [EMAIL_REDACTED].",
  "audio_redaction_segments": [
    { "start_ms": 18400, "end_ms": 21250, "category": "credit_card" },
    { "start_ms": 31900, "end_ms": 34100, "category": "email" }
  ],
  "audit": {
    "total_redactions": 2,
    "by_category": [
      { "type": "credit_card", "count": 1 },
      { "type": "email", "count": 1 }
    ],
    "compliance_topics": ["pci", "pii"],
    "policy_categories": null
  }
}

1. The raw transcript is untouched. The vault adds a copy; it never edits or replaces the original transcript on the call record. Deleting the raw values is a destructive retention-policy decision, and it belongs to the retention pipeline (recording.retention_deleted — see the recording lifecycle), not to an additive redaction step.
2. The audit never carries what it removed. Counts and categories are typed; the redacted values themselves never appear in the artifact, the logs, or the webhook payload. The raw transcript remains the only place the original values exist.

​

Where it sits in the lifecycle

​

What to branch on

{
  "type": "recording.redaction_vault.ready",
  "data": {
    "call_id": "call_abc123",
    "total_redactions": 12,
    "by_category": [
      { "type": "credit_card", "count": 4 },
      { "type": "email", "count": 8 }
    ],
    "compliance_topics": ["pci", "pii"],
    "policy_categories": ["email", "phone"],
    "audio_redaction_segments": [
      { "start_ms": 18400, "end_ms": 21250, "category": "credit_card" }
    ],
    "timestamp": "2026-03-08T12:12:00Z"
  }
}

• call_id is the join key — read the artifact off the call record’s redaction_vault metadata after this event arrives.
• total_redactions and by_category are counts and categories only; treat a nonzero total as “a sanitized copy exists,” never as a list of values.
• audio_redaction_segments is the muting map for playback exports: mute or beep each listed millisecond range before the audio leaves your control. An empty list means no timing data was available — the redacted transcript still stands, but the raw audio needs your own handling.
• compliance_topics tells you which regulatory surface the audit touched; route recordings tagged pci to your cardholder-data process and pii to your general identifier process.

​

Scoping by category

​

Tenant posture, stated precisely

​

Common pitfalls

1. Exporting the raw transcript for QA. The redacted copy exists precisely so reviewers never need the raw one. Point QA exports at redaction_vault.transcript_redacted, and keep raw-transcript access behind your own role gate.
2. Treating the vault as deletion. The artifact is additive — the raw transcript survives until your retention policy purges it. If your posture requires the raw copy to disappear, schedule that through retention, not through this vault.
3. Playing back raw audio to reviewers. The audio segment list is the deterministic half of audio masking: mute or beep the listed ranges on the playback surface before reviewers hear it. Until you do, the redacted transcript and the playable audio tell two different stories.
4. Assuming the event without enabling the control. recording.redaction_vault.ready fires only when the vault is opted in. If you subscribed but never enabled the setting, no artifacts and no events appear — check the compliance settings first.
5. Enabling the vault and expecting historical calls to copy. The vault runs at write time, when a transcript finalizes. It seals copies for calls recorded after you enable it; it does not retroactively process your archive.