Compliance Options

The recording of phone calls is in many cases a regulated activity that falls under any of a number of industry or government regulations. QMS has features to assist in compliance with these various regulations.

Call Encryption

When regulations require call recordings to be encrypted, QMS provides this functionality as well as key management capabilities to make compliance as easy as possible. When call encryption is enabled, all recordings are encrypted using the AES-256 algorithm.

When designing a call recording system that requires encryption, there are a few important points to keep in mind.

  • Keys are protected by Microsoft DPAPI so that they are never stored in cleartext. This requires that the QMS services run under a domain service account rather than the default local system account. This must be manually configured after the installation of the software.

  • All key operations require two QMS administrators to be present. This includes: enabling encryption in QMS, backing up keys (each administrator will be able to back up half of the key onto a small USB device), and doing a re-key operation.

When playing back recordings in QMS, all media transferred across the network is always encrypted regardless of if call encryption has been enabled or not.

Recording Rules

Many regulatory compliance issues can be handled through the use of recording rules, which are part of Recording Profiles.

For example:

  • If calls involving financial transactions must be retained for seven years then a Recording Profile can be created that retains recordings for that duration of time when the call information matches criteria that identifies the call as a financial transaction.

  • If calls from certain country codes, area codes, or specific numbers must be recorded or must not be recorded, rules can be easily made to accommodate that.

Users can be members of multiple Recording Profiles which allow many different sets of rules to be applied to different situations.

On-demand Recording

To deal with situations where the remote party may need to opt-out of being recorded (for instance, in areas that require two-party notification of recording), on-demand recording can be used. This feature will prevent a recording from happening until the user manually triggers the recording using either the Client user interface or the optional QMS Desktop Utility, which is an application that can run directly on the user’s desktop.

Recording Pause/Resume

Some regulations require that portions of a phone call must not be recorded. For example, PCI-DSS regulations require that the verification number on credit cards must never be recorded. There are several ways to accomplish this within QMS. Both the QMS Client user interface and the optional QMS Desktop Utility provide mechanism to allow users to pause and resume their own recordings. If this level of control is not sufficient, the process can be automated by using the QMS Client API. For turn-key solutions, the Enghouse Interactive Advanced Services team can provide full solutions customized to the customer’s needs.

Two-user Authorization for Recording Playback

Special users can be configured with permissions that allow them to authorize playback of recordings. If a user needs to play back a recording and does not have full permissions, the authorizing user can enter credentials and allow the playback to occur.