The Retention Window Ends, but the Recording Doesn't Vanish: A Callbot Recording Retention-and-Purge Gate

Recordings Pile Up, but Nobody Wrote a Purge Rule

When a callbot loop records calls, the files keep accumulating in S3 unless a deletion rule is set. AWS's own Amazon Connect blog notes that without an S3 Lifecycle rule, recordings persist indefinitely, and on a versioned bucket a delete only adds a marker while the original version stays recoverable, quietly growing both storage cost and exposure surface. If retention and destruction are treated as a cleanup task for later, the recording store becomes the single largest PII exposure surface in the whole loop.

Retention Windows Differ by Call Type

Payment calls, general inquiries, and complaint- or dispute-prone calls rest on different legal grounds, so one retention window cannot cover all of them. AWS's documentation recommends that contact centers running multiple lines of business stream a custom per-contact attribute through Kinesis, then let a Lambda function tag the S3 object so each line gets its own retention period. By contrast, the Amazon Connect analytics data lake defaults to a 25-month rolling window, with the cutoff advancing every day at 00:00 UTC, automatically excluding older data from queries. A callbot loop has to manage the recording body's lifecycle and the analytics data lake's rolling window under one retention design.

From Design to Operations: A Checklist for the Callbot Recording Retention-and-Purge Gate

At the planning stage, pin retention periods and purge success rate to numbers. Set payment-call recordings to a 180-day retention window to cover dispute handling, general-inquiry calls to 90 days, require a 99.5%+ success rate for scheduled purge batches, and a 0% recovery rate on post-purge sample checks as the pre-deployment bar — so an audit gets a number instead of "kept for a reasonable while."

The most common failure is a missing call-type tag. When the custom attribute arrives empty, the Lambda function applies the default retention tag, so a payment-call recording ends up bound to the same 90-day rule as a general inquiry — either breaching a statutory retention duty or being kept far longer than necessary.

The second failure sits in the purge pipeline itself. Lambda concurrency limits or Kinesis shard lag can delay tagging, opening a gap of several days between when the S3 Lifecycle rule applies and the actual retention target; once that lag compounds, thousands of recordings queue up past their purge date.

The third is versioning. With S3 versioning enabled, a delete only creates a delete marker while the original version remains intact — so a dashboard can show "purged" while the underlying object is still recoverable.

Recovery splits into quarantine and retry. Tagging failures should route immediately into a separate quarantine queue, apply the most conservative retention period (the dispute-prone call bar) as a stopgap, and page the responsible owner. For pipeline lag, monitor per-shard Kinesis processing delay and trip a circuit breaker to manual batch purging once it crosses a threshold.

The operating checklist needs a pre-deployment purge dry run (building the deletion target list without actually deleting), mandatory purge log fields (tag value, execution time, failure reason, whether the old version was deleted), and a quarterly process of sample-restoring a random batch to check for leftover versions.

Collect purge failure causes weekly into three buckets — missing tags, pipeline lag, and leftover versions — so that a retention-period policy change and a pipeline bug fix stay in separate change histories. Mixing the two into one deployment makes it hard to trace, in next quarter's audit, which change actually moved the retention window.

Takeaways

A callbot's call recordings don't vanish the moment their retention period ends. Pin retention periods per call type to numbers, route tagging failures and pipeline lag through a quarantine queue and a circuit breaker instead of one shared path, and sample-verify leftover versions every quarter — that's what keeps the recording store from becoming the blind spot in your PII risk surface.

References

Customize retention policies for contact recordings in Amazon Connect — AWS official blog

Amazon Connect PCI Compliance Best Practices — AWS official documentation