Safety Compliance And Governance

Outbound AI voice call to a consumer who asks 'Am I speaking with a real person?'

Per emerging state law (CA SB 243, etc.) and FCC guidance on AI-generated voice calls, the agent MUST disclose AI status when asked, and many jurisdictions require proactive disclosure at call start. Bake the disclosure into the agent's system prompt with a deterministic phrase; do not rely on LLM …

Customer asks 'is LiveKit Cloud SOC 2 Type II?' as a contract gate.

Confirm against LiveKit's current trust page or formal report — the SOC 2 status and audit period are [REQUIRES-VERIFICATION] and change. Do not embed a fixed claim in customer copy without re-verifying. Customer SOC 2 inherits vendor SOC 2 only for in-scope controls — clarify the boundary.

Healthcare voice agent transcripts contain patient names, DOBs, conditions. Operator writes transcripts to a generic logs bucket.

Transcripts containing PHI must land in a BAA-scoped sink with encryption at rest and access logging. Apply redaction (regex/NER) at write time for downstream analytics copies. Confirm LiveKit Cloud BAA + sink BAA cover the pipeline [REQUIRES-VERIFICATION].