August 18, 2026
How Long Should You Keep Call Recordings?
A call recording retention policy answers two questions: how long recordings are kept, and who can play them. For most small offices the honest answer to the first is shorter than instinct suggests — 30 to 90 days covers nearly every legitimate use — because every recording you keep is discoverable.
Storage cost is not the constraint. Liability is. That reframing changes the whole calculation.
Are call recordings discoverable in a lawsuit?
Yes. A call recording is a business record, and business records are subject to discovery in civil litigation and to subpoena in criminal and regulatory matters.
If you have it, you can be made to produce it. If it helps the other side, it still gets produced. And if you destroyed it after a preservation obligation attached, you have a spoliation problem that is frequently worse than whatever the recording contained.
That is the asymmetry worth internalizing. A recording that no longer exists because your stated policy deleted it on schedule is unremarkable. One deleted after a demand letter arrived is a separate cause of action.
Pick a period, write it down, and apply it uniformly. A policy applied consistently is a defense. Ad hoc deletion is not.
How long should a small business keep call recordings?
Long enough to serve the reason you record, and no longer. Work backwards from the purpose rather than picking a round number.
Why you record | Working retention | Reasoning |
|---|---|---|
Coaching the front desk | 30 days | You review recent calls, not last quarter's |
Verifying an order or appointment detail | 60–90 days | Covers the window where a dispute surfaces |
Dispute resolution on service work | 6–12 months | Matches a typical warranty or complaint cycle |
Regulated recordkeeping | Whatever your regulator says | Not your decision, and not your vendor's |
"Just in case" | Not a reason | Retention without a purpose is exposure without a benefit |
The regulated row deserves emphasis. If you are a broker-dealer, an insurance agency, a debt collector, or anyone else with a records rule, your regulator sets a floor and your phone system does not get a vote. Get the number from your compliance counsel, write it in the policy, and treat it as a minimum rather than a target.
Everyone else should be suspicious of long windows. "We keep everything forever" is not a policy, it is the absence of one.
Who should be able to play back a call recording?
Fewer people than currently can, in most offices we look at.
A recording contains whatever the caller said, which in a medical practice means symptoms, in a law firm means facts of a matter, and in a home-services company means the inside of someone's house and when they are not home. Access control is the part of retention people forget is part of retention.
Signal supports client-side user roles — owner, admin, agent, and read-only — so who can reach recordings and call history in the portal is something you decide rather than a default. Set it deliberately:
- Owner and admin — full access, and a short list.
- Agent — operational access to the day-to-day, not a general archive.
- Read-only — reporting visibility without the ability to change configuration.
- Departed staff — removed the same day, alongside email and building access.
Two habits go with the roles. Review who holds each role when staff change, not annually. And use the audit history to see who changed what and when — an access policy nobody can verify is an intention rather than a control.
What is a legal hold and how does it change retention?
A legal hold suspends your normal deletion schedule for the material relevant to an anticipated or pending dispute. It overrides the policy, and it starts earlier than most people expect.
The obligation attaches when litigation becomes reasonably foreseeable — not when you are served. A demand letter, a regulator's inquiry, a serious injury on your premises, a formal complaint: any of those can start the clock.
What to do when it happens:
- Identify what is in scope — which numbers, which date range, which callers.
- Stop routine deletion for that material immediately.
- Preserve it somewhere the routine process cannot reach.
- Document the date the hold started and who was told.
- Release the hold in writing when counsel says so.
Signal does not delete recordings on a schedule you have not set, so a hold here is about not deleting rather than stopping an automated process. The discipline is yours: if your policy says 90 days and nobody applies it, your real policy is "forever," and that is what a discovery request will find.
What should a call recording retention policy say?
Six elements, on one page. Longer than that and nobody reads it, which makes it worse than nothing.
- What is recorded — which numbers or lines, inbound only, and what is deliberately excluded.
- How consent is obtained — the announcement text and the confirmation that it plays before recording starts. See call recording laws by state for why this is load-bearing in all-party states.
- How long recordings are kept, stated as a number of days, with the reason.
- Who may access them, by role rather than by name.
- How a legal hold is invoked, and who can invoke it.
- Who reviews the policy and when — annually is fine, and the review should confirm that practice matches the document.
If your practice handles protected health information, add a seventh line about which lines are excluded from recording entirely, and read HIPAA and your phone system before you turn recording on. A recorded clinical call is PHI in storage, and unbounded storage of PHI is an exposure that grows on its own.
Where recordings fit next to everything else the system keeps
Recordings are not the only thing your phone system retains, and they are usually not the highest-volume sensitive item.
Voicemail is. Callers state names, account numbers, and reasons for calling in messages, and those recordings persist until someone deletes them. Voicemail-to-email moves a copy into your email system, extending the retention question to a platform your phone policy does not govern. The voicemail box setup guide covers per-box PINs and behavior.
Call history is the low-sensitivity end: numbers, times, durations, no content. It is the record you will want in a billing dispute, and it costs nothing to keep — see call reporting basics.
Treat the three separately. They carry different risk and deserve different windows.
Frequently asked questions
How long should a small business keep call recordings?
Work backwards from purpose. Coaching needs about 30 days; order or appointment verification needs 60 to 90; service disputes may justify 6 to 12 months. Regulated industries follow their regulator's floor. If you cannot state a reason for the period you chose, the period is too long.
Are call recordings discoverable in a lawsuit?
Yes. Recordings are business records subject to discovery and subpoena. A recording deleted on schedule under a consistent written policy is unremarkable; one deleted after a preservation obligation attached creates a spoliation problem. Consistency is what makes a retention policy defensible.
Who should be able to play back a call recording?
A short list. Signal's owner, admin, agent, and read-only roles let you scope portal access deliberately rather than by default. Remove departed staff the same day they leave, and use audit history to verify that access matches the policy rather than assuming it does.
What should a call recording retention policy say?
Six things: what gets recorded, how consent is obtained, how many days recordings are kept and why, who may access them by role, how a legal hold is invoked, and when the policy is reviewed. Keep it to one page so it is actually read and actually followed.
If you are turning recording on and want a second opinion on the retention window before you do, tell us which lines you plan to record and what you expect to use the recordings for. That conversation usually shortens the answer.