What is recorded
The sit, from the moment the rep slides to start at the door until they end it: the conversation in the home, as audio, then its transcript, its scores and the report. Nothing records before the slider. If the rep forgets to end it, the recording pauses after a stretch with nobody talking (your organization picks 10 to 60 minutes, 20 by default) and ends after a set number of recorded hours (4 to 12, 8 by default).
Location is shared only if the rep turns it on. Homeowners are never enrolled: their voices are told apart only while that one sit is processed, and never used to recognize them in another sit.
Who hears it
Every table in the database has row-level security, and files in storage are checked against the sit they belong to. No one sees another organization’s sits.
| Rep | Manager | Org admin | |
|---|---|---|---|
| Hear a sit | Their own, and any a teammate shared | The organization’s | The organization’s |
| Notes at a moment | Yes | Yes | Yes |
| The rep’s private notes | Their own | No | No |
| Download a recording | No | No | Yes, through a short-lived link, logged |
| Export | Their own data | No | The organization’s data |
| Delete a sit | No | No | Yes, logged |
Exports, downloads, sit deletions and seat changes are written to an append-only audit log. TrueSit’s own support sees an organization only read-only, for 30 minutes, with a reason the org admin can read in their audit log; a recording plays there only if an org admin granted access to that sit.
Consent by state
Before every sit the phone shows the rule for that sit’s state, from your organization’s consent table, and the line the rep says. Where everyone must agree, Start waits until the rep taps I said it, and the sit keeps which version of the line was used.
| State | The law | The line |
|---|---|---|
| California | All-party | Required; Start waits for I said it |
| Kansas | One-party, in person | Required, unless your organization makes it recommended |
| Every other state | Not confirmed yet | Required |
This is not legal advice; check your states with your own counsel. Homeowners have a plain-words recording notice, in English and Spanish.
Retention
Your organization sets how long sits stay. A nightly job deletes what is past its period and logs each deletion; an org admin can also delete a single sit, and its files are purged from storage.
| Data | By default | Your organization can set |
|---|---|---|
| Audio | 12 months | Its own period |
| Transcripts, scores and reports | 24 months | 6 to 36 months, never shorter than the audio |
| A rep’s voiceprint | 24 months | 6 to 36 months |
The full retention schedule lists every kind of data.
Encryption
Audio is encrypted on the phone as it is recorded, before it is uploaded (AES-GCM, with the key held in the phone’s Keystore or Keychain). Uploads travel over TLS to a private storage bucket, encrypted at rest. The read API returns exactly the rows the app shows the person who made the token, and API tokens are stored only as a hash.
No training on your data
We do not use your recordings, transcripts or scores to train AI models. Product improvement is an organization setting, off by default: nothing is used for it unless an org admin turns it on.
Export and deletion
Anyone can export their own data and delete their account, on the phone or the web; deletion waits seven days, and signing in during that time cancels it. An org admin can export the organization’s data, remove a member at once, or close the organization after a 30-day grace period. When a rep’s account is deleted, the company keeps its sits under Former rep. Every step is written to the audit log.