6. Policy

11 min

Target audience: All users

Description: The utilities in the footer at the bottom of the left navigation — Usage & Limit, Policy, and Help and Support — and the CQA policy documents: the Password Policy and the Data Retention Policy.

Agents and Supervisors do not see Usage & Limit or Policy in the footer of the left navigation. Everyone can read the policy documents in this chapter.

Path: Policy, in the footer of the left navigation (page title: Data Retention) · Who: Admin

The in-app Policy page shows your account's configured data retention, marked Read-only. It is the live view of the Data Retention Policy below. To request changes, contact your account manager.

Region	What it shows
Permanent deletion banner	Data past the retention window is permanently deleted and cannot be recovered. Export what you need before the window ends.
Analysis Data card	Your retention for structured analysis data: a number of days, or Indefinite when purging is disabled. Shows Purging active or Purging disabled, and an INCLUDES list.
Transcripts & Recordings card	Retention for ingested media (in months), marked Purging Always Active, with an INCLUDES list.
PURGE SCHEDULE	Last run and Next scheduled purge, with status.

The Password Policy has no in-app page. It is documented below and applies on the Accept Invite and Reset Password screens.

6.1. Data Retention Policy

Purpose and scope

Exotel is committed to managing data responsibly, balancing operational efficiency with strict compliance with data privacy standards. This policy describes how CQA classifies, stores, retains, and securely disposes of data processed in the Conversation Quality Analysis platform.

It applies to all customers using CQA unless a specific custom agreement is in place.

Admins can see the retention configured for your account in Policy, in the footer of the left navigation (7.2). To request changes, contact your account manager.

Data classification

CQA classifies data into two categories.

A. Analysis Data — structured data generated and stored by CQA during analysis:

Quality Profiles and KPIs — the rules and metrics that define how interactions are scored.

Interaction details and scores — per-interaction records, evaluation results, and quality scores.

Dispute records and resolutions — agent and supervisor challenges to scores, and their outcomes.

Assignment rules and Metadata — routing logic for which Quality Profile reviews which conversation, plus the custom fields attached to interactions.

Dashboards and AI-generated Insights — aggregated views, trends, and AI-derived findings built from analysis data.

B. Transcripts & Recordings — the copies of raw media ingested into CQA:

Audio recordings ingested into CQA — call audio copied into CQA for analysis (through integrations, APIs, or manual upload in Test Evaluation).

Transcript files ingested into CQA — transcript files copied into CQA for analysis (through integrations, APIs, or manual upload in Test Evaluation).

Standard retention schedule

Unless your Master Services Agreement (MSA) or Order Form says otherwise, CQA applies these retention periods:

Data category	Description	Retention
Analysis Data	Structured analysis data and metadata stored in CQA.	Configured per account. When purging is disabled, data is kept for the lifetime of the subscription. When a retention window is configured, data older than the window is purged.
Transcripts & Recordings	Audio recordings and transcript files ingested into CQA.	6 months (about 180 days) from ingestion or upload. Same for all tenants; not configurable.

Why this structure?

Per-account Analysis Data lets each customer match retention of structured insights to their audit, coaching, and compliance needs — including indefinite retention for long-term trend analysis.

6 months for Transcripts & Recordings gives enough time for quality audits, dispute resolution, and coaching cycles while limiting how long sensitive media stays in CQA.

Data deletion and purging

When data reaches the end of its retention period, it is permanently deleted and cannot be recovered. Export any data you need before the retention window ends.

Analysis Data

When a retention window is configured for your account, CQA runs a scheduled purge that permanently deletes Analysis Data (including Metadata) older than the retention boundary. Admins can see the last and next purge runs under PURGE SCHEDULE on the Policy page.

When purging is disabled, Analysis Data is kept for the lifetime of the subscription.

Transcripts & Recordings

Purging of ingested recordings and transcripts is always active.

Files are permanently deleted 6 months after upload or ingestion into CQA.

Only the copy stored in CQA is deleted. The original file at the source URL is not affected.

What you may still see after media expires

If your Analysis Data is still retained, scores and analysis history stay visible after the related recording or transcript is deleted.

Playback and download of purged media are no longer available in CQA.

Secure disposal

Data is deleted using industry-standard secure deletion practices so that it cannot be recovered from CQA systems.

6.2. Password Policy

Purpose

The CQA Password Policy defines the standards for creating, managing, and securing user passwords. It is designed to reduce the risk of unauthorized access, brute-force attacks, and credential stuffing while keeping a user-friendly experience aligned with modern security standards, including NIST 800-63B.

Scope

This policy applies to all user accounts that sign in to the CQA platform, including Tenant Administrators, Supervisors, and Agents. API integrations authenticate with API keys, not passwords (6.2 Authentication).

Password requirements

All user-created passwords must meet these criteria.

Length

Minimum length: 12 characters.

Maximum length: 128 characters.

Longer passwords give much greater resistance to brute-force and dictionary attacks. Up to 128 characters easily accommodates passphrases.

Character complexity

Passwords must contain characters from at least three of these four categories:

Uppercase letters (A–Z)

Lowercase letters (a–z)

Numbers (0–9)

Special characters and symbols (for example, ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > / ?)

Allowed characters

All UTF-8 characters are supported.

Spaces are allowed, so you can use multi-word passphrases, along with all standard ASCII and non-ASCII symbols.

Contextual restrictions

A password is rejected if it contains your username, first name, last name, or email address. The check is a case-insensitive substring match against your account data.

Summary

Parameter	Requirement	Rule
Minimum length	12 characters	Passwords must be at least 12 characters long.
Maximum length	128 characters	Passwords can be up to 128 characters, to accommodate long passphrases.
Complexity	3 of 4 categories	At least 3 of: uppercase letters, lowercase letters, numbers, special characters.
Allowed characters	All UTF-8 characters	All standard characters, symbols, and spaces are allowed.
Contextual restrictions	No username or email	Passwords cannot contain your username, first name, last name, or email address (case-insensitive).
Usability	Paste enabled	Copy and paste are fully supported.

Where this policy is used: 2.2.2 First-time login and 2.2.3 Forgot Password.