Section 19 · Safety, Deliverability & Governance
19.8Call recording consent, disclosure, retention & access governance
Built — needs DMA's data- No.
- 19.8
- DMA's reference
- Decision Book p.35
- Phase
- Phase 1
- Autonomy
- L1 · Recommend
- DMA's decision
- Yes
◆ Amended in v3 of the book.
What DMA asked for · Decision Book p.35
Clear rules for recording consent (including two-party-consent states), disclosure to the other party, how long transcripts are kept, and who may read them.
Why it matters to DMA: Every feature that reads calls depends on it, and it is legally different from email. DMA's amendment: use existing Zoom transcripts rather than DMA-owned recording in version 1.
In our words, from DMA's Product Decision Book v3, page 35.
How we do it
- As DMA's amendment asks, the POC doesn't record calls. It works from transcripts that already exist (a Zoom transcript uploaded or pasted), so Zoom's own recording notice covers disclosure; DMA should switch that setting on for sales calls.
- Each call stored from a transcript records its recording-consent details and a sensitivity level; website chats carry a retention date (two years by default) for the deletion routine DMA's retention policy sets.
- Message bodies are stored encrypted. Restricted conversations can be opened only by the owner, the president and the sales lead; everyone else sees the summary.
- Any future DMA-owned recording needs legal review first; the kickoff checklist tracks access to Zoom transcripts and the legal review.
The flow
It plays on its own while it's on screen; hover or use the controls to pause or step through.
An existing transcript
A rep uploads the Zoom transcript of a sales call; Zoom announced the recording.
- Person
- Stored data
- Rule in code
- AI
Where the data goes
The same six stages on every page. Nothing reaches Nutshell except through the write gate.
- 1Zoom
Source
An existing transcript, uploaded or pasted.
- 2Sync
Copies Nutshell changes into the bridge database
Not involved.
- 3Bridge database
A copy of the CRM data, plus what the AI works out
The call's messages (encrypted), consent details, sensitivity and retention date.
- 4AI
Claude models, only through DMA's own gateway
Writes the summary, fields and tasks from it.
- 5Write gate
The only way back into Nutshell: checked, approved when needed, sent once
Only approved summaries and tasks are written.
- 6Nutshell
The system of record
The summary, never the transcript.
The tables behind it
Drawn from the POC's database catalogue: structure only, no data.
PK primary keyFK reference the database enforces (solid line)ID reference kept by id (dashed line)
| Table | What it holds | Columns |
|---|---|---|
| conv.conversations | Each call or chat: channel, sensitivity, recording-consent details and retention date. | 22 |
| ai.scribe_runs | Each transcript processed: format, fingerprint and the approval it produced. | 24 |
How the tables connect (3)
| Column | Points to | Kept by |
|---|---|---|
| conv.conversations.agent_version_id | agent.agent_versions | The application (by id) |
| ai.scribe_runs.conversation_id | conv.conversations | The database (foreign key) |
| ai.scribe_runs.approval_id | ctrl.approvals | The database (foreign key) |
Worked example
Synthetic demo data: every name, business and number is made up.
The rules as the POC applies them (the legal review comes from DMA).
Governance
| Topic | In the POC |
|---|---|
| Recording | None by DMA; existing Zoom transcripts only |
| Disclosure | Zoom's recording notice (to be switched on for sales calls) |
| Retention | A retention date on every chat (two years by default); DMA's policy sets the final period |
| Access | Restricted calls: owner, president and sales lead only |
| Storage | Message bodies encrypted; Nutshell gets the approved summary, never the transcript |
In the running POC
The kickoff checklist: Zoom access and the legal review are tracked items.
- 1Progress across what DMA provides.
- 2One item, with who owns it and when it is needed.
Dashboard · Kickoff checklist. Captured from the running POC on September 25, 2026; synthetic data.
See it live
Opens the exact screen in the running POC, in a new tab.
| Open | Where | What to try |
|---|---|---|
| Kickoff checklist | DMA AI dashboard | Zoom access and the legal review, with owners and dates. |
Status
Built — needs DMA's data. This capability runs in the POC today. It needs DMA's own content or data to go live; no code change is needed for that.