A compliant AI voice agent is a deployment that meets the rules for your calls. No platform is compliant on its own. Start by listing every place call data goes: the platform, the speech and language models, the phone carrier, telemetry, traces and storage. Self-hosting with local models and telemetry off leaves only your servers and the carrier.
Key Takeaways
- No software is compliant on its own. How you run the call decides it.
- Self-hosting with local models and telemetry off leaves only your servers and the carrier.
- Never take card numbers by voice, since recordings and transcripts keep everything said.
This guide follows one call's data through privacy law, recording consent, payments, security reviews and buying, and how each one runs in Dograh, an open-source voice agent platform that can keep call recordings and transcripts on the servers you run. You can self-host it or run it on Dograh Cloud.
Compliant AI voice agents: count where the call goes
No software is HIPAA or GDPR compliant on its own. Compliance depends on how a call is run and what happens to its audio and records afterwards, so the first job is a map of where the data goes.
The audio travels through the phone carrier to the voice platform, then to speech-to-text, language and text-to-speech models. The recording, the transcript and any extracted fields land in storage, and telemetry, traces, webhooks and tools can copy parts of the call again.
Each of those places is a party that can see the call and one more thing an attacker can reach. IBM's 2026 Cost of a Data Breach study, based on breaches at 602 organizations, found that one in four malicious breaches were AI-enabled. Those cost an average of $6 million, against a global average of $4.99 million. In Cisco's 2026 Data and Privacy Benchmark Study, a survey of 5,200 IT, technology and security professionals in 12 markets, 90% said their privacy programs have expanded because of AI.
Moving the stack onto your own servers is the strongest single step, because it shortens the list, but it does not finish the job. You still build access control, encryption, backups, monitoring and breach response around it, as for any system that holds personal data.
Self-hosting: what stays and what still leaves
Dograh is the orchestration layer: it runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. You can fill that layer with Dograh's own models, with any provider through your own API keys (BYOK), or with open-weight models you run yourself. Bringing your own key changes whose contract covers the audio, but the audio itself still reaches the provider. The call audio stays in-house only when the speech and language models run on your own servers too.
Dograh starts every account on its own managed models. To keep call audio away from Dograh, open Models, switch the Organization default to BYOK with your own speech and language providers (or local models), and check that no agent has its own model override.
| Where the data goes | Hosted voice platform | Self-hosted Dograh, hosted models | Self-hosted Dograh, local models |
|---|---|---|---|
| Call flow and platform | Vendor's cloud | Your servers | Your servers |
| Recordings and transcripts | Vendor's storage | Your database and object storage | Your database and object storage |
| Live audio for speech and language models | Vendor's model providers | Each provider you hold a key with | Your servers |
| Phone calls | Your carrier | Your carrier | Your carrier |
| Telemetry | Vendor's own | Sent until you switch it off | Sent until you switch it off |
| Call traces | Vendor's own | Only where you set up tracing | Only where you set up tracing |
A self-hosted install runs on servers you choose with Docker Compose. A few things still leave, and each one has a setting. Every call over the phone network passes through your carrier, but browser calls do not. Telemetry is on by default in the Docker setup. Set ENABLE_TELEMETRY=false, and remove POSTHOG_API_KEY from the api service in docker-compose.yaml (or set it to an empty value).
The quickstart also opens a public trycloudflare.com tunnel to the API for quick testing. A production install uses your own domain and ingress instead. If you turn on tracing, each call's trace goes to the Langfuse project you configure, so host Langfuse yourself or leave tracing off. Any HTTP API tool, webhook or integration you add sends the data you give it to its own endpoint, so list those too.
Storage needs its own policy. Recording upload is on by default. It can be switched off only for the whole server, with ENABLE_CALL_RECORDING_UPLOAD=false, and transcripts are still saved. There is no retention setting, and nothing is deleted automatically, so your own storage rules decide how long calls are kept and who deletes them.
Our data residency checklist for voice AI turns each of these into a line to check off. Running Voice AI on Local, Self-Hosted Models covers which open-weight models fit on which server.
Privacy law: GDPR, controllers and processors
Under the GDPR, the business running the agent is generally the controller, and every outside party that handles the call on its behalf is a processor.
Article 28(1) of the GDPR says the controller "shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures". A hosted voice platform is generally one processor. Each hosted speech or language model behind it is generally another, with its own agreement and its own subprocessors.
The GDPR's transfer rules generally govern personal data moving to, or being reached from, countries outside the EU, so storage inside the EU does not settle the question alone. A support team abroad that can open EU call records, or a model provider that processes the audio in another region, can raise the same transfer questions as storing the data there.
Self-hosting Dograh in an EU data centre, with open-weight speech and language models running there too, generally takes the platform and model processors off the list. The carrier remains for phone calls.
Controllers, processors and transfers, quoted from the regulation, are covered in GDPR and Voice AI: Keeping Call Data Inside Your Borders. This is general information, not legal advice. Confirm your position with counsel, or in the UK, check with a data protection adviser.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Recording consent and AI disclosure
Two rules meet in the first seconds of a call: consent to record and, in some places, telling the caller they are talking to an AI.
On recording, US federal law generally allows a call to be recorded when one party consents. Several states, such as California, generally require the consent of everyone on the call. When callers can be in an all-party state, the simplest course is generally to announce recording on every call, before anything else is said.
Recording starts as the call connects, so the notice goes in the Greeting Text, the fixed line Dograh plays word for word at the start of the call, as text or a pre-recorded clip. A language model never paraphrases it, which matters when that wording is your evidence of notice.
If you want to tell callers they're speaking with an automated assistant, or your location requires it by law, write it in the Greeting Text along with the business's name. In the EU, Article 50(1) of the AI Act says AI systems that interact directly with people must be designed so that people are "informed that they are interacting with an AI system, unless this is obvious". Who carries that duty in your setup is a question for counsel.
State-by-state wording, quoted from each statute, is in Call-Recording Consent Laws and How to Configure Your Agent. This is general information, not legal advice; confirm your position with counsel.
Payment calls: keep card numbers off the line
A card number read aloud would land in five places at once: the speech-to-text provider, the language model's context, the transcript, the recording and any trace. Recordings and transcripts keep whatever is said, so the call never asks for a full account, card or Social Security number; use a short check such as the last four digits, and send payment links by text or email from your own system. Dograh has no keypad (DTMF) tool and no feature for taking customer payments on a call.
The PCI Security Standards Council states: "If SAD is collected during a call, every effort must be made to prevent the data from being recorded."
That leaves two clean designs. In the first, after verifying the caller, an HTTP API tool asks your payment provider to send its secure payment link by text or email. In the second, the agent hands the caller to a payment line that is already set up for card data. Transfer Call works on Twilio, Telnyx and Asterisk ARI. It passes no summary by default; on Twilio it can play a short spoken introduction to both people. Write the details to your system with an HTTP API tool before the transfer.
Tell the agent in the prompt to stop any caller who starts reading card digits and offer the link instead. If digits get recorded anyway, your team finds and deletes them from your own storage. The full setup is in Handling Payment-Sensitive (PCI) Calls in a Voice Agent Safely. Confirm your scope with your Qualified Security Assessor (QSA) or acquirer.
Security reviews: SOC 2 scope and audit evidence
A security review asks two things of a voice agent: whose controls cover it, and what evidence shows each call went as designed.
What sits inside your SOC 2 scope
A SOC 2 report is an examination, by a CPA firm, of a service organization's controls. With a hosted voice vendor, you collect the vendor's report and review its subprocessors. Self-hosted, the voice agent is software inside your own system boundary. Your existing controls for access, change management, monitoring and vendor management cover it.
There is no Dograh report to collect for a self-hosted install, because Dograh does not operate it. What stays outside your boundary is the list from the self-hosting section: hosted model providers, the carrier and any tool or integration you switch on. Those go through your vendor management.
Which controls you own, and what an auditor asks about each, is in How to Pass a SOC 2 Review With a Self-Hosted Voice Agent.
The evidence a reviewer opens
A reviewer wants to see what the agent said in each step, and with which settings. Every transcript turn is saved with its turn number and the node it ran in, by ID and name. Each call record also points at the exact agent version that ran and a snapshot of its model settings, so a change to the prompt never rewrites the history of past calls.
A QA node scores each step of a call separately, with its own tags, a 1-10 score, sentiment and a summary. Its Sample Rate picks a random share of calls, so you can review a steady sample of live traffic. Each call's View Trace button opens its trace in Langfuse when tracing is set up.
Audit logs are listed on Dograh's Enterprise plan. On a self-hosted install, your own infrastructure's access logs show who opened which recording. Building an Auditable Voice AI Stack for Security Reviews shows how these records answer a reviewer's questions one by one.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Buying: why procurement stalls on closed vendors
A hosted vendor sends a security questionnaire, a data processing agreement, a subprocessor list, a data region and a certification report. Each answer is a claim your team checks, and the model providers behind the platform each add their own. Every round of questions adds weeks before the first real call.
Because you self-host Dograh inside your existing compliance perimeter, you don't need a separate vendor review for Dograh. The speech and language model providers you choose may still need their own review, unless those models run on your servers too. What your team reviews instead is the code, open under the BSD-2-Clause licence, and your own deployment.
Teams that want a contract behind the install can take the Enterprise plan, which lists "On-premise / private-cloud deployment, data residency & data perimeter". Dograh Cloud handles the security work for you. Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost); Dograh Cloud has a 1¢-a-minute platform fee.
What is left to review when you run the platform yourself is in Why Procurement Stalls on Closed Voice Vendors (and How to Skip It).
Sector rules: healthcare, legal and contact centers
Healthcare runs on business associate agreements (BAAs). For patient calls, self-host Dograh. No BAA with Dograh is needed, because Dograh never sees the data. Your speech and language providers may need their own BAA, and your phone carrier may too. That holds once the Organization default points at your own providers. If the servers run in a cloud account, that cloud provider generally needs a BAA as well. HIPAA-Compliant Voice AI for Hospitals counts every vendor that hears a patient call; HIPAA-compliant voice AI for pharmacy does the same for pharmacy.
Law firms face a stricter test. Attorney-client privilege has no equivalent of a business associate agreement, so legal intake generally calls for the platform and the models on the firm's own servers. On-Prem Voice AI for Law Firms follows every place an intake call goes.
Contact centers that run calls for several clients answer to each client's rules at once. Our post on on-prem voice AI for BPOs covers that setup.
A checklist before your first live call
Before real callers reach the agent, write down an answer for each line.
- List every party that hears or stores the call, and the agreement you hold with each.
- Decide where the models run (open-weight models on your servers, or providers you review and contract with) and set them as the Organization default.
- Switch off telemetry and replace the quickstart tunnel with your own domain.
- Write a storage policy for recordings and transcripts, since nothing is deleted automatically.
- Put the recording notice, and any AI disclosure, in the Greeting Text.
- Keep card, account and Social Security numbers off the call.
- Check that transcripts, agent versions and QA results answer a reviewer's questions.
- Confirm your position with counsel for each law that applies to your callers.
Run the list once per agent, and again whenever anything on the map changes.
To try the setup, self-host Dograh from GitHub or start on Dograh Cloud. Each part of the map has its own deep dive:
- Data Residency for Voice AI: A Buyer's Checklist
- GDPR and Voice AI: Keeping Call Data Inside Your Borders
- Call-Recording Consent Laws and How to Configure Your Agent
- Handling Payment-Sensitive (PCI) Calls in a Voice Agent Safely
- How to Pass a SOC 2 Review With a Self-Hosted Voice Agent
- Building an Auditable Voice AI Stack for Security Reviews
- Why Procurement Stalls on Closed Voice Vendors (and How to Skip It)
Glossary
- Controller and processor
- GDPR roles. The controller decides why and how personal data is processed; a processor handles it on the controller's behalf. A business running a voice agent is generally the controller, and a hosted model provider is generally a processor.
- Open-weight model
- A speech or language model whose weights you can download and run on your own servers. It is the only way to keep call audio off a model provider's systems.
- Sensitive authentication data (SAD)
- PCI DSS term for card data such as the security code on the back of the card. It must not be stored after authorization, which is why a voice agent should never hear it.
- System boundary
- The systems a SOC 2 examination covers. A self-hosted voice agent sits inside your own boundary, so your existing controls cover it.
