Klytic

Home›Guides›Telephony

Telephony · Understand

What a phone platform knows about your company

Yes, a business conversation is company data. Its content is if it is recorded; its metadata (who calls whom, when, for how long) always is. To know who holds it, you need to list these traces and name four parties: the user, the administrator, the platform operator and the carrier.

Updated October 20267 minOfficial sources cited

A conversation is company data

People think of the recording first. It is the most visible trace, but it only exists if someone decided it should. A call that is not recorded still leaves a line in a call history: the caller’s number, the number called, the extension that answered, the time, the duration, sometimes the reason the call ended or the transfer.

Call metadata: the information that describes a call without containing what was said. Numbers, extension, date, time, duration, queue, transfers. Linked to an employee or a customer, it is personal data.

This metadata often says more than you might think. The list of numbers called by a salesperson maps out their portfolio. An executive’s calls to a lawyer or a potential buyer reveal an ongoing deal. A call history is therefore an asset to protect, just like a customer file.

The GDPR applies as soon as this data makes it possible to identify a person. It requires a specified purpose and a retention period that does not exceed what is necessary for that purpose. It does not set a period itself: it is up to the company to choose and justify one.

Inventory: what the platform keeps

A business phone system produces at least seven families of data. Not all of them exist everywhere, but it is better to have listed them before signing.

TraceWhat it containsExists if
DirectoryNames, extensions, direct numbers, groups, sometimes external contactsAlways
Call historyMetadata for each incoming, outgoing and internal callAlways
RecordingsThe content of conversationsRecording is enabled on the line or queue
Transcripts and summariesText derived from a conversationThe feature is subscribed to and used
VoicemailThe caller’s voice, often copied by emailVoicemail is active
Technical logsPhone connections, IP addresses, errors, administrative actionsAlways
Backups and ticketsCopies of the configuration and data; exchanges with supportAlways, depending on the contract

The last two rows are the ones most often forgotten. The guide What is a sovereign cloud? points this out: backups and logs are copies. They may be hosted somewhere other than the main service and last longer than the original data.

Voicemail deserves particular attention. When it is sent by email, a copy leaves the phone platform and lands in the email system. It then follows the mailbox’s rules: delegations, shared mailboxes, email backup.

Who can know the numbers called

“The cloud” is not a party. Four distinct roles can see all or part of the call history.

  1. The user generally sees their own calls, in their app or on their phone.
  2. The company administrator sees the history of all the extensions they manage, often with statistics. They decide on everyone else’s permissions.
  3. The platform operator hosts the server, updates it and restores it. Technically, it can access the data. The useful question is when it accesses it, whether it does so in a logged way, and which law applies to it.
  4. The carrier that connects the phone system to the public telephone network routes outgoing and incoming calls. It therefore knows the numbers, times and durations, if only for billing.

The operator and the carrier may be the same company or two different companies. When you keep your carrier and entrust the phone system to another provider, your metadata is held by both. An external party also has their own carrier: a call to the outside leaves traces beyond your perimeter, whatever you choose.

Who owns the call history

The word “own” is misleading. From a data protection standpoint, the company that decides to use the phone system and keep its history is the controller of that processing. The platform operator generally acts on its behalf, as a processor, within the limits of a data processing agreement.

In practice, the operator holds the data for as long as the service runs, then for as long as its backups last. Three questions to ask:

  • Export: can the call history, recordings and configuration be retrieved, in what format, and how long after the end of the contract?
  • Deletion: when is the data erased, including in backups?
  • Numbers: do the numbers belong to your carrier subscription, and can they be ported elsewhere?

Reversibility is negotiated at signing. On the day you leave, it is too late to discover that recordings cannot be exported.

Where the recordings are

A recording is an audio file stored somewhere: on the phone server, in ancillary storage, sometimes at a transcription provider. Before enabling it, you need to know where it ends up and who can listen to it.

Two decisions are separate. The first is legal: why record, whom to inform, how long to keep. It is covered in How long to keep call recordings. The second is a setting: which lines to record and who can listen. For Klytic Tel, it is described in Who can listen to recordings in Klytic Tel.

For recordings in the workplace, the CNIL, France’s data protection authority, requires that access be limited to the departments concerned by the purpose pursued and that the actions performed be logged. It is a good test for any platform: who has the right to listen, and can it be verified?

Encryption: how far it protects

Encryption in IP telephony covers two flows: signaling, which sets up the call, and the voice itself. Between phones or apps and the platform, both can be encrypted, for example with TLS for signaling and SRTP for voice.

The limitation lies in the path. A call to an external number leaves the provider’s infrastructure and crosses the networks of one or more carriers. From that point on, its level of protection depends on those networks. No phone system provider can, on its own, encrypt a call along its entire length all the way to an outside party’s phone.

Encryption of stored data, for its part, says nothing about who holds the key. A recording encrypted on disk remains readable by the service that has to play it back.

Example: a fifteen-person recruitment agency

A hypothetical case. An agency records calls on its candidate reception line, to train new recruiters. A candidate asks what the agency keeps about them.

While taking inventory, the agency finds more than the recording: a call history line for each call, two voicemails received in a shared mailbox, a transcript in the CRM, and copies in the backups. It can answer because it has listed these traces and knows who holds them. Without this inventory, it would only have mentioned the audio file.

Frequently asked questions

Does a call that is not recorded leave any data?

Yes. The call history keeps the numbers, time and duration of each call, and the carrier also keeps a record. Only the content of the conversation does not exist.

Can my phone system provider listen to my calls?

An operator can technically access the data it hosts. Ask when it accesses it, whether access is logged and which law applies to it. The framework is developed in Protecting a company from the CLOUD Act.

How long should call history and recordings be kept?

There is no single period. It depends on the purpose. See How long to keep call recordings.

Is hosting in Europe enough?

Location is a useful answer, but not the only one. See “Data hosted in Europe”.

Where Klytic fits

With Klytic Tel, each organization has its own phone server. It is hosted by default in a European cloud, in Mauritius or in a geographic zone compliant with the applicable jurisdiction, at your request, or installed on your servers. In the cloud, Klytic Tel relies on a leading cloud hosting provider, with an enterprise-grade availability commitment of 99.99% (excluding planned maintenance announced in advance) and failover between several hosting sites in the event of an outage: resilience to outages is very high. Klytic can also deploy the solution with another cloud provider of your choice. Klytic is operated by Dedicace Software, a French company.

Communications between phones or apps and Klytic servers, as well as communications within the platform, are encrypted (SRTP and TLS). Once the call leaves the Klytic infrastructure for an external network, its level of protection depends on the networks and carriers it passes through.

Telephony is backed up every day. Backups are encrypted and kept for 30 days; the maximum data loss objective is 24 hours for Klytic Tel. At the end of the contract, Klytic helps you retrieve your data, then deletes it on request.

Call recording is a feature of the offering. It is not an obligation enabled on every line: you decide where it serves a purpose. You can keep your current carrier, subject to compatibility: in that case, it remains one of the four parties described above. Klytic is not a SecNumCloud-qualified offering.

This page describes a general framework. It does not replace an analysis of your contract or the advice of your DPO.

Sources

Consulted in October 2026.

  • GDPR, Article 5: data collected for specified, explicit and legitimate purposes, and kept for no longer than is necessary for those purposes. cnil.fr
  • CNIL, “L’écoute et l’enregistrement des appels sur le lieu de travail” (Listening to and recording calls in the workplace): access limited to the departments concerned by the purpose pursued and logging of the actions performed. The page is marked “obsolète, en cours de mise à jour” (obsolete, being updated). cnil.fr
  • Klytic, “What is a sovereign cloud?”: backups and logs are copies; telephony encryption up to the platform, dependence on carriers beyond it. klytic.com
  • Klytic, Klytic Tel page: dedicated server per customer, hosting zones, call recording, voicemail by email, keep your carrier. klytic.com
  • Klytic, frequently asked questions: daily backup of Klytic Tel, 30-day retention, 24-hour RPO, data retrieval then deletion on request. klytic.com

Know where your telephony data is

We will walk you through Klytic Tel’s hosting, backup and reversibility for your organization.

Talk to an advisor →

Discover Klytic Tel

Further reading

Understand · TelephonyHow long to keep call recordingsNo universal period: a purpose, informing the people concerned, a proportionate period. The CNIL benchmark, and why backup runs on a different clock.7 min readRead →Use · TelephonyWho can listen to recordings in Klytic TelWhere your recordings are in Klytic Tel, how to restrict listening to a few people, which lines to record, and the case of voicemail sent by email.5 min readRead →Understand · TelephonyVoIP, SIP, IP PBX and UCaaS: which architectureVoIP, SIP, IP PBX, UCaaS: definitions useful when buying, then the choice between a shared service, a dedicated server or on-premises, and multi-site setups.7 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing