Recording Encryption

RingQ encrypts every call recording, and its transcript, AI summary and sentiment, straight after the call. There are three levels. Standard is on by default on dedicated RingQ servers: recordings are stored encrypted with the server's own key and your team plays them as usual. Strict locks recordings with your company's own key file, so only people with that key can listen, in the web app or in the RingQ app on their phone. Off saves new recordings without encryption.

This guide covers the levels, turning on Strict, playing recordings in Call Logs and on the phone, checking that it works, where encrypted recordings are stored, backups, the access log and how it supports PDPA, GDPR, PCI DSS and ISO 27001. For an overview, see the Call Recording Encryption page on ringq.com/compliance/recording-encryption.

Encryption levels

The account owner chooses the level under Global Settings > Security settings > Recording encryption.

Recording encryption is not available on multi-tenant (shared) servers.

Before you start with Strict

Strict is optional. Until the owner turns it on, recordings stay on Standard and your team plays them as usual.

How the Strict key works

When you turn Strict on, your browser makes a key pair. The private half is saved to your computer as a key file (.rqkey), protected by a passphrase you choose. Only the public half is sent to RingQ.

• Each recording gets its own random AES-256-GCM key. That key is locked with your company's public key (RSA 3072-bit).
• Your key file is protected by your passphrase (PBKDF2-SHA-256, 310,000 rounds). Choose a long passphrase.
• A recovery key is a second key file with its own passphrase. Every recording can be opened with either key. Keep it apart from the main key, for example in the office safe.
• Neither RingQ nor anyone with access to the server or the backup storage can open a locked recording.

Important: without the key file and its passphrase, locked recordings can never be opened, not even by RingQ. Keep the key file, the recovery key and both passphrases somewhere safe before you turn Strict on.

Turn on Strict

Sign in to the web app as the account owner.

1. Go to Global Settings > Security settings and open the Recording encryption tab.
2. Under Encryption level, choose Strict. The Set up encryption steps open.
3. Type a passphrase for the main key, and type it again.
4. Leave Also make a recovery key (recommended) ticked, type a different passphrase for it and, if you like, where it will be kept.
5. Click Make the key. Then click Download both key files and save them somewhere safe.
6. Click Check my key file, choose the main key file you just saved and type its passphrase. This proves the file works before anything is locked.
7. Tick I understand that without the key file and its passphrase, locked recordings can never be opened, not even by RingQ.
8. Click Check and turn on.

The tab now shows Strict: your own key, On, with the key codes of the main and recovery keys (for example RQ-7F3A-91C2), who turned it on and when. From now on, every new recording is locked about a minute after the call ends.

Access rules

Listen to recordings in Call Logs

With Standard, nothing changes: click play in Reports > Call Logs and the recording plays, with its transcript, summary and sentiment. With Strict:

1. Go to Reports > Call Logs. Locked calls show a lock on the play button.
2. Click play on a locked call. The Unlock recordings window opens.
3. Choose your key file (.rqkey) and type its passphrase, or paste the key. Click Unlock.
4. The recording plays. The transcript, AI summary and sentiment open from the same call as usual.

• Once unlocked, other locked calls play straight away until the key locks itself or you click Lock.
• Reports > Call Ratings plays locked recordings the same way.
• Download recording saves a normal mp3. Download recordings (ZIP) saves every recording on the page. Both only work when allowed in Access rules.
• Admins can listen if they have the key file. Normal users cannot open locked recordings.
• Recordings made before Strict was turned on are not locked with your key and play as before.

Play recordings on the phone

In the RingQ app (iPhone and Android), recordings open from the person's page. With Standard they play at once. With Strict, add your key file once; after that Face ID, Touch ID or your fingerprint unlocks it. Only admins see recordings in the app.

Play a recording

1. Open Recents or Contacts and tap the person you spoke with.
2. Under Recent Calls, calls with a recording say Recording, or Encrypted recording with Strict.
3. Tap the call to open its recording page, then tap Play recording.
4. Tap Show transcript to read the transcript, AI summary and sentiment.

Strict: add your key to the phone

First, put the key file on the phone:

• iPhone: AirDrop the .rqkey file to the phone, or email it to yourself, and save it to Files.
• Android: copy the .rqkey file to the phone's Downloads folder or Google Drive.
• Delete any copy left in email or chat afterwards.

Then add it:

1. Open the RingQ app and go to Settings > Recording key.
2. Tap Add recording key and choose the .rqkey file.
3. Type the key file's passphrase.
4. Confirm with Face ID, Touch ID or your fingerprint.
5. The app shows the key code, for example Key RQ-7F3A-91C2 added. It must match the code on the web.

After that, Play recording on an Encrypted recording asks for Face ID or your fingerprint once, then plays.

• The key locks itself after the time set in Access rules, and when you sign out or switch profile.
• To take the key off the phone, go to Settings > Recording key > Remove key.
• Downloading a recording, the bulk ZIP and Listen in RingQ links are in the web app only.

Queue recording: opt in and opt out

Each queue chooses whether its calls are recorded, and whether agents may pause the recording during a call, for example while a customer reads out a card number. Whatever is recorded is then encrypted at the level chosen above.

Set it for a queue

1. Go to Call Flow and open the queue.
2. Open the Settings tab and find Call Recording.
3. Choose Use extension setting, Always record, Never record, or Record, agents can pause. The text under the field explains the choice.
4. Click Save changes.

Pause and resume during a call

• In the web, desktop or phone app, press the record button during a queue call to pause the recording, and press it again to resume.
• The call stays one recording. The paused part is left silent, so the transcript, AI summary, sentiment and CRM webhook still work for the rest of the call.
• On Always record and Never record queues the button is blocked and the app says so.
• For card payments, pausing is how you keep card security codes out of recordings: encryption alone does not make storing them allowed under PCI DSS.
• Transcripts and AI summaries only exist for recorded calls. Integrations lists any queues set to Never record, so you can see which calls send no recording to your CRM.

Check that it works

Use this short check after turning Strict on, and after adding the key to a phone. With Standard, a test call simply plays as usual in Call Logs and on the phone.

1. Make a test call with recording on and talk for a few seconds.
2. After about a minute, the call shows a lock in Call Logs.
3. Play it with the key file: it plays and the transcript shows.
4. Try a wrong passphrase: it is refused.
5. On the phone, the same call shows Encrypted recording and plays after Face ID or your fingerprint.
6. Open the Access log on the Recording encryption tab: your unlock and play, and the phone's, are listed with the device name.

How recordings are stored

Once a recording is encrypted, the same encrypted file goes everywhere it is kept. The plain file exists only for the minute or so before it is encrypted.

Inside an encrypted file

• Each recording gets its own random AES-256-GCM key.
• Standard: the file starts with RQS1; the recording's key is wrapped with a key derived from the server's own secret (the one behind the RQBK- backup password). The server opens it for whoever is allowed to play it.
• Strict: the file starts with RQE1; the recording's key is sealed with your company's public key (main and recovery). Opening happens only in your browser or the RingQ app, with your key.
• The header is protected too: an edited or swapped file is refused.

Backup and restore

• Every Time Machine backup is locked with the server's own backup password. With Strict on, it is locked with your company's key instead, so it can be opened only with your key file.
• The server's backup password is needed to restore on another server. The owner can view it (it starts with RQBK-) under Time Machine. Viewing it is logged.
• To restore, choose the backup in Time Machine. A company-locked backup asks for your key file and passphrase; a backup from another server asks for that server's backup password.
• Older backups made before this change restore as before.
• A restore replaces the server's settings and call data and signs everyone out. Plan it.

Access log

The Access log on the Recording encryption tab lists every unlock, play, transcript view, download, bulk download, wrong-key try and settings change, with who, which call, IP address, device and time. Entries from the phone show the device, for example iPhone app (iOS 18.2). The log is never trimmed by the audit retention.

Change the key or the level

If you lose the key

If both the main and recovery key files, or their passphrases, are lost, recordings locked with them cannot be opened by anyone, including RingQ. Make a new key with Change the key so that new recordings can be opened again.

Compliance

Standard and Strict help you meet the security requirements below; Strict also keeps the key away from RingQ. Your own obligations depend on how you use recordings; this is not legal advice. RingQ itself is certified to ISO/IEC 27001:2022.

Not encrypted: recordings made before encryption was turned on, and voicemails.

Troubleshooting

Related

• Security Guide
• Recording Link API
• Call Recording Encryption (compliance overview)