Odoo Call Recording: Options and Compliance (2026)

Odoo can attach every call recording directly to the res.partner or crm.lead chatter as an ir.attachment. That's the easy part. The hard part is doing it without stepping on TCPA, state two-party consent laws, GDPR or your own retention policy. This is the checklist we run every US deployment through.

How Odoo actually stores call recordings

Recordings are captured at the SIP provider (Axivox, Twilio, Ringover), then either streamed live to Odoo as an ir.attachment or fetched on demand via the provider's API. The attachment lives in filestore/ on the Odoo server or in your configured object storage (S3, Wasabi, GCS) if you've enabled the ir_attachment_url or S3 modules.

The four compliance layers

1. Consent — you must announce recording on outbound calls in two-party consent states (CA, FL, IL, MD, MA, MT, NH, PA, WA and a handful more). A pre-recorded 'this call may be recorded' notice at connect satisfies most.
2. TCPA — separate rule. Governs whether you can dial at all (autodialer, prior express consent for cell phones, DNC). Recording is a downstream question.
3. Retention — set a retention window in Odoo. Common defaults: 12 months for sales, 7 years for regulated verticals (finance, healthcare).
4. Access control — record-level rules so only supervisors and the assigned rep can play the attachment.

Where to store recordings

• filestore/ on the Odoo server — fine under 50GB, backup with your DB.
• S3 / Wasabi / GCS via ir_attachment_url — mandatory past 100GB; use lifecycle rules to enforce retention automatically.
• SIP provider cloud — cheapest but the recording lives outside your Odoo backup; not recommended for regulated verticals.

PII redaction

For regulated workflows, redact credit card numbers and SSNs from both the transcript and the audio itself. Odoo doesn't do this natively — you need a transcription pipeline that runs regex masking on the transcript and beeps out the corresponding audio segment before the file lands in the chatter.

Retention automation

1. Add a retention_date field to ir.attachment via a small custom module.
2. Schedule a nightly cron that deletes attachments where retention_date < today.
3. Log the deletion to a separate audit table so you can prove compliance.

Next step

Need a recording + retention setup reviewed against TCPA and state consent rules? Email business@geniedial.in — we do this walkthrough as part of every US pilot.