An auditable voice AI stack lets a security reviewer answer three questions about any call: what the agent said and in which step, which agent version and models ran it, and who opened the records afterwards. Keep call records, traces and access logs on systems you control, and sample live calls with QA so the evidence keeps coming.
Key Takeaways
- Tag every transcript turn with the step of the call it ran in.
- Store the agent version and model settings with each call record.
- Your own access logs show who opened a recording, so keep them on your systems.
This post is part of our guide to compliant AI voice agents. The guide's section "Security reviews: SOC 2 scope and audit evidence" sets the bar in one line: "A reviewer wants to see what the agent said in each step, and with which settings." Here is how to build that evidence, record by record, in Dograh, an open-source, self-hostable voice agent platform.
An auditable voice AI stack answers three questions
A security review of a voice agent comes down to three questions about any single call, and the stack is auditable when each has an answer on file.
IBM's 2026 Cost of a Data Breach study, covering breaches at 602 organizations, found that more than 20% had a breach targeting AI models or applications. The most common causes were weak spots around the model, led by compromised APIs, applications or plug-ins at 27%. A voice agent calls tools and APIs on every call, so a reviewer will ask for proof of what it did.
The standard most reviewers work from is NIST SP 800-53. Its control AU-3 asks that audit records establish "What type of event occurred; When the event occurred; Where the event occurred; Source of the event; Outcome of the event; and Identity of any individuals, subjects, or objects/entities associated with the event."
For a voice call, that becomes three questions. What did the agent say, and in which step of the call? Which version of the agent, and which models, ran it? And who opened the recording or transcript afterwards? The rest of this post answers each one.
What the agent said, and in which step
The first answer comes from the call record, and it holds more than a transcript. Every event in a call is saved with its turn number, a timestamp, and the ID and name of the node the agent was in. Moves from one node to the next are logged too, with the node the call came from. Each tool call is logged with the arguments the agent sent and the result it got back. In a self-hosted install, this record sits in your own database, and the recording and transcript files sit in your own object storage. Dograh is the orchestration layer: it runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose, so the live audio stays in-house only when those models run on your own servers too.
The node name on every turn matters more than it looks. You cannot prove a language model never said a banned sentence. You can prove the call went through the identity check and the disclosure step, in order, because each turn carries the name of the step it ran in. That proof needs transcripts you own.
The same record needs care. Recordings and transcripts keep whatever is said, so the call never asks for a full account, card or Social Security number; use a short check such as the last four digits, and send payment links by text or email from your own system. Tool arguments are logged as sent, so keep secrets out of them too.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Which agent version and models ran the call
The second answer is the configuration behind the call, and it has to survive later edits. Each call record points at the exact agent version that ran it, and live calls run the published version. Agent versions are kept as draft, published or archived, each with a version number. When someone edits the prompt and publishes a new version, past calls still point at the version they ran, so last month's evidence stays true to last month's agent. Each call also stores a snapshot of its model settings, so a reviewer can see which speech, language and voice models handled it.
For a turn-by-turn view, tracing sends each call's trace to the Langfuse project you configure, and each call's View Trace button opens it. Host Langfuse yourself and the traces stay on your servers with everything else. Our post on reading call traces to debug a voice agent shows what a trace holds.
Who opened the records afterwards
The third answer is about people, and it comes from outside the call record. Audit logs are listed on Dograh's Enterprise plan. On a self-hosted install, who opened which recording comes from your own infrastructure, in the access logs kept by your database and object storage and by your reverse proxy. Those systems are already inside your security program, and your team decides how long their logs are kept and who can read them.
SP 800-53 asks for these pieces to line up. AU-12(1) calls for records compiled "into a system-wide (logical or physical) audit trail that is time-correlated". Dograh stamps each call event to the millisecond, so a reviewer can line up a call's turns with the access logs around it. Which controls your team owns once the agent sits inside your boundary is covered in How to Pass a SOC 2 Review With a Self-Hosted Voice Agent.
Logs show the past; QA keeps checking
Logs prove what happened on a call, and they need a second control that keeps checking new calls.
A 2026 study of attacks on AI voice agents found that they "remain vulnerable to behavioral attacks that cannot be addressed through access restrictions alone", and called for "access control, policy enforcement, and behavioral monitoring" together. Access logs cover the first part. Monitoring needs someone, or something, reading the calls.
A QA node does that reading. It scores each step of a call separately, with its own tags, a 1-10 score, sentiment and a summary. It runs on test calls from the editor and on live calls of the published agent, and a Sample Rate below 100 picks calls at random.
NIST's Generative AI Profile points the same way: "Use real-time auditing tools where they can be demonstrated to aid in the tracking and validation of the lineage and authenticity of AI-generated data." Our post on automated QA for voice agents covers how to set it up.
The table is the evidence map to hand a reviewer.
| Reviewer question | Record that answers it | Where it lives, self-hosted |
|---|---|---|
| What did the agent say, and in which step? | Turn, timestamp, node ID and node name on every event; node moves; tool calls with arguments and results | Your database (call record) and object storage (recording, transcript) |
| Which version and models ran it? | Agent version and model settings snapshot on the call record; the call's trace | Your database; the Langfuse project you configure |
| Who opened the records? | Access logs from your database, object storage and reverse proxy | Your infrastructure |
| Is it still behaving? | QA tags, score, sentiment and summary per step, on a random sample | Your database (call record) |
Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost); Dograh Cloud has a 1¢-a-minute platform fee. If the review is part of a purchase, Why Procurement Stalls on Closed Voice Vendors (and How to Skip It) covers the buying side.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Glossary
- Audit record
- A saved entry showing what happened, when, where, from what source, with what outcome and who was involved, as NIST SP 800-53 control AU-3 describes. For a voice call, each transcript turn and tool call is one.
- Agent version
- A saved state of a Dograh agent: draft, published or archived, with a version number. Each call record points at the version that ran it, so later edits never change past evidence.
- Model settings snapshot
- The copy of the model configuration stored with each call, showing which speech, language and voice models handled it at the time.
- Time-correlated audit trail
- Logs from different systems combined so their timestamps line up, as NIST SP 800-53 AU-12(1) asks. It lets a reviewer match a call's turns to the access logs around it.
