Compliance Recording API: Consent, Retention, Control
Record Zoom, Google Meet and Microsoft Teams meetings for compliance. A visible, named bot joins the call, you set retention per bot, and recordings go to storage you control.
The consent law, stated plainly
US federal law allows recording with one party's consent (18 U.S.C. 2511(2)(d)). At least nine states require all parties to consent or know: California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. The Reporters Committee guide covers each state.
Across state lines, California's rule can still apply. In Kearney v. Salomon Smith Barney (Cal. 2006), the court applied it to a recorder in another state and treated disclosure at the start of the call as the remedy. In the EU, a recording is personal data. It needs a lawful basis, notice when it is collected, and limited retention.
So the design that travels best is a visible, named recorder that announces itself. MeetStream bots join under the name you choose and appear in the participant list. They can post or speak a recording notice. Washington requires the announcement itself to be recorded (RCW 9.73.030(3)), which is why speaking it matters. This is general information, not legal advice.
Retention you set, in storage you own
Recordings are kept for 30 days by default, included in the rate. Set a shorter or longer window per bot. Delete any bot's media through the API at any time, and get a deletion webhook when media expires or is removed.
Or write every recording and transcript to your own bucket: Amazon S3, Alibaba Cloud OSS or any S3-compatible store. Then Object Lock, legal holds and deletion schedules run on your systems. A write-only mode keeps reads on your side.
Bots run in the United States by default, with the EU, Australia, Japan and the Middle East available and other regions on request.
Who controls what
| Artefact | MeetStream storage (default) | Your own bucket |
|---|---|---|
| Recording, audio and video | 30 days by default, set per bot, deletable through the API | Written to your bucket; your lifecycle, Object Lock and hold rules apply |
| Per-participant audio and video | Same as the recording | Same: your bucket, your policy |
| Transcripts | Same as the recording | Same: your bucket, your policy |
For SEC 17a-4(f) and FINRA 4511 records, AWS names S3 Object Lock as its WORM control. Recordings in your bucket can sit under your Object Lock policy from the moment they are written. The attestation stays with your compliance team.
The audit trail per recording
Every bot reports its path into the meeting: joining, the waiting room, admission or denial, and one ending event that names the cause. Participant join and leave events and the speaker timeline record who was present and who spoke when. On Zoom, Google Meet and Teams, per-participant audio and video tie each voice and each face to one person. Webhooks deliver each event to an endpoint you control.
Platform notices add to that record. Zoom asks the host before a bot records, and it shows its recording notice to guests. On Google Meet, someone in the call admits a guest bot. The Teams recording banner stays on. Each rule is sourced on the Zoom, Google Meet and Teams recording pages.
Certifications and compliance
MeetStream is ISO 27001 certified, GDPR compliant, and HIPAA compliant with a BAA on request. SOC 2 Type 2 is under audit. Certificate details, policies and the sub-processor list are on the security page and the Trust Center.
The design fits financial services, legal and healthcare work, where retention control and consent decide the vendor.
Frequently asked questions
Is it legal to record meetings for compliance?
It depends on where the people in the call are. US federal law needs one party's consent. At least nine states need all parties. In the EU, a recording is personal data under GDPR. A visible, named bot that announces the recording works best. This is general information, not legal advice.
How long are compliance recordings kept?
Thirty days by default, included in the rate. You can set a different window per bot or delete media through the API at any time. Or write recordings to your own bucket, where your own retention rules apply.
Can recordings stay in a specific region?
Yes. Bots run in the United States by default, with the EU, Australia, Japan and the Middle East available and other regions on request.
Is MeetStream HIPAA compliant?
Yes. MeetStream is HIPAA compliant and signs a Business Associate Agreement on request. Ask for the BAA before you process protected health information.
What security and compliance does MeetStream offer?
MeetStream's security and compliance: ISO 27001 certified, GDPR, HIPAA compliant with a BAA on request, SOC 2 Type 2 under audit. The details are on the security page and in the Trust Center.
What audit trail exists per recording?
Join, waiting room, admission and ending events, participant join and leave events, the speaker timeline, and webhook delivery to endpoints you control.
Do participants know they are being recorded?
Yes. The bot joins under a name you choose and appears in the participant list, it can post or speak a recording notice, and each platform adds its own recording notice.
How is this different from the compliance recording use case?
The use-case page describes the workload. This page covers the product: consent, retention, residency, the audit trail and certifications.
What does it cost?
The standard rates: $0.35 per bot-hour, $0.45 with in-house transcription, and 30 days of storage included. Compliance controls are not an add-on.
Compliance recording, in storage you control
One API call puts a visible, named bot in Zoom, Google Meet or Teams. Retention per bot, your own bucket, and $5 of free credit to start.