Built in India, Hosted in India: What Data Residency Actually Means for a Voice Stack

Before a bank, lender or insurer signs off on an AI voice agent, someone in risk or legal asks the question that stalls the deal: where does the call data live? Not just the recording, but the transcript, the extracted fields, the logs and the audio a speech model turns into text. For a voice stack, data residency in India is not one checkbox. It is a chain of answers, and the weakest link decides whether you comply.

Teams get this wrong in both directions. Some assume the Digital Personal Data Protection Act (the DPDP Act) keeps every byte in India, and over-engineer. Others assume “hosted in India” means every hop is processed here. This post separates the general law from the sector rules, then traces where a live call’s data actually goes.

What the DPDP Act Says About Data Residency in India

Section 16(1) of the DPDP Act 2023 is not a blanket localisation mandate. It lets the Central Government restrict, by notification, transfers of personal data to countries or territories it names. Transfers are allowed by default, except to places on that list.

Section 16(2) keeps stricter laws in force. Nothing in the section limits any other law that “provides for a higher degree of protection for or restriction on transfer” of personal data. In practice this clause often matters more than the first, because it keeps the Reserve Bank of India’s payment data rule and other sector rules binding, however permissive the general rule is.

The DPDP Rules 2025 add two separate transfer provisions:

• Rule 13(4) requires a Significant Data Fiduciary, an organisation the government designates for extra obligations, to keep personal data the government specifies, and “the traffic data pertaining to its flow”, inside India. If you are not designated, or your data is not specified, it does not apply.
• Rule 15 applies to every Data Fiduciary. Personal data may go abroad, but the government can set requirements, by general or special order, on making it available to a foreign State or to any entity under that State’s control.

None of this is live yet. The Rules were notified on 13 November 2025, and Rule 1(4) brings Rules 13 and 15 into force eighteen months later, expected on 13 May 2027. MeitY has floated shortening this window to 12 months for Significant Data Fiduciaries, which would bring Rule 13 forward to 13 November 2026. As of 21 October 2026 no amending notification had been found, so check the Gazette before relying on either date. Section 16 of the Act is on the same eighteen-month track. As of publication, no restricted-country list under Section 16 and no order under Rule 15 has been notified. Plan for them, and check the Gazette before you rely on any date.

The Sector Rules That Decide Most Voice Stacks

For most banking, financial services and insurance (BFSI) deployments, the binding residency duties come from sector regulators and India’s cyber-security directions, not from the DPDP Act’s general rule. Each one reaches a different part of a voice stack.

RBI: payment data stays in India

The RBI directive of 6 April 2018 (DPSS.CO.OD.No 2785/06.08.005/2017-18) applies to payment system providers authorised under the Payment and Settlement Systems Act, 2007. Through them, it may reach the vendors that handle payment data on their behalf. According to the RBI’s FAQ on storage of payment system data, “The entire payment data shall be stored in systems located only in India.” Processing abroad is allowed, but the data must then be deleted abroad and brought back to India within one business day or 24 hours of processing, whichever is earlier.

For a voice agent, the question is whether payment data ever enters the conversation. A collections call where a customer reads out a transaction reference may put regulated content into audio, transcripts and summaries. Decide with your compliance team whether the rule reaches your flows. Then either keep that content out of the conversation, or keep the whole pipeline in India.

SEBI: cloud use by regulated entities

SEBI’s cloud framework (circular SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033, 6 March 2023) is stricter than most teams expect. Under Principle 2, storage and processing of a regulated entity’s data, including logs, must happen in the data centres of MeitY-empanelled cloud providers. Principle 3 adds: “The data should reside/be processed within the legal boundaries of India.” Entities already on the cloud had up to 12 months from issuance to comply, which means by March 2024. Because processing counts, not just storage, a speech or language model running abroad is likely a problem for a SEBI-regulated entity’s voice stack, not a footnote. Confirm the details in the circular with your compliance team.

CERT-In: logs and incident reporting

The CERT-In directions of 28 April 2022 require covered entities to enable logs of all their ICT systems and “maintain them securely for a rolling period of 180 days” within Indian jurisdiction. Covered cyber incidents must be reported within 6 hours of noticing them. In a voice stack, those systems include telephony gateways, application servers and the AI pipeline, and their logs often hold phone numbers and caller identifiers.

IRDAI: insurance records stay in India

For insurers, IRDAI’s Maintenance of Information Regulations, 2025, dated 1 January 2025 and published in the Gazette on 3 January 2025, replaced the 2015 insurance records regulations. Proviso (iii) to Regulation 9 requires records of policies issued and claims made in India, including electronic records, to be “held in data centres located and maintained in India only.” Whether a sales or claims call recording forms part of those records is a question for your compliance team. This post does not cover IRDAI’s outsourcing rules or the IRDAI Information and Cyber Security Guidelines, 2023.

Stored in India Versus Processed in India

On a live call, the caller’s audio arrives through a carrier at a media server, streams to a speech-to-text model, and the text goes to a large language model, possibly with passages from a knowledge base. The reply goes to a text-to-speech model and back along the same path. Each stage can be a different vendor in a different region. After the call, the platform keeps a recording, transcript, summary, extracted fields and logs.

This is where “hosted in India” claims break down. A recording stored in an Indian region says nothing about where speech-to-text or the language model processed it. When OpenAI announced data residency for India, Japan, Singapore and South Korea in May 2025, TechCrunch reported that it covers data “stored at rest in supported countries”. OpenAI now documents inference residency separately, and its current data residency docs list India as regional storage only, without regional processing. Check each provider’s current documentation rather than assuming.

The table below maps a typical call. It is illustrative: the components depend on your telephony set-up, your vendors and where your models run.

Artefact	Where it usually lives	Question to ask
Live call audio	Carrier and media server	Where is the call terminated, and is media encrypted in transit?
Streamed audio for transcription	Speech-to-text provider	Which region runs inference, and is audio retained afterwards?
Prompts and model replies	Language model provider	Is inference in-country, and are prompts logged by the provider?
Synthesised speech	Text-to-speech provider	Where is the reply text sent, and is it stored?
Recordings, transcripts, summaries	Platform storage	Which region, for how long, and who can read them?
System and audit logs	Platform and cloud provider	Are they kept in Indian jurisdiction for the required period?

The infrastructure exists. AWS opened its Hyderabad region (ap-south-2, three Availability Zones) in November 2022, after Mumbai in 2016. Google Cloud opened its Delhi NCR region, its second in India after Mumbai, with three zones in July 2021. An open region does not mean every AI model is served from it, so check which models each provider actually runs there.

That leaves three patterns. The strictest runs every hop, including inference, on Indian infrastructure: clearest, but costliest. The second stores in India and redacts sensitive content before any cross-border hop. The third accepts at-rest residency where no sector rule applies. Choose per workload, not per company.

How Zoice Handles the Storage Side

Zoice is an Indian company with an Indian team, and its Vocal for Local commitment includes keeping your data stored in India. With data residency selection, your organisation’s conversations, recordings and audit logs are stored in the region you choose, and retention and purge jobs run in that region. Retention is set per data class. Auto-purge enforces each window, and manual purges report the exact number of records deleted, which gives you evidence of disposal.

Recording redaction can strip Aadhaar, PAN and OTP patterns before transcripts are stored. It is a transcript control, so check separately how payment details, audio and the speech-to-text hop are handled in your flows. Audit events can stream to your own security information and event management (SIEM) system, with a delivery inspector showing what was sent and whether it arrived.

With SIP trunking and bring-your-own-carrier, calls stay on your carrier. TLS signalling and SRTP media encryption are configurable per trunk, and SRTP requires TLS. Transcript access is limited by roles built from a permission catalogue, and admins can enforce multi-factor authentication and an IP allowlist. Details are on the security page.

Apply the same standard to Zoice as to any vendor, and get processing locations for each model hop in writing. These four questions settle most residency reviews:

• For each model in the call path, where does inference run, and does the provider retain inputs or outputs?
• Which region stores recordings, transcripts, summaries and logs, and can you choose it per organisation?
• Which sensitive identifiers can be redacted before transcripts are stored, and are retention windows set per data class?
• Can logs and audit events be exported to systems you control?

Frequently Asked Questions

Does data residency in India mean call recordings can never leave the country?

Not under the DPDP Act alone. Its transfer provisions are not yet in force, and Section 16 restricts transfers only to countries the government notifies. Sector rules can be stricter: RBI payment data, for example, must be stored only in India.

Do RBI data localisation rules apply to a voice AI agent?

The 2018 directive applies to payment system providers authorised under the Payment and Settlement Systems Act, 2007, and may reach the vendors that handle payment data for them. If your agent hears or transcribes payment details in such a flow, those artefacts may be in scope. Designing flows that never collect payment details by voice is usually simpler.

If my vendor uses a foreign LLM or speech API, is my call data leaving India?

Possibly, even when storage is in India. A provider can keep data at rest in the country while running inference elsewhere. Ask where inference runs and whether inputs are retained, then check whether your sector rules allow it.

Is a made-in-India AI voice agent automatically India-hosted?

No. Where a company is based tells you who builds the product, not where your data is processed. Ask for the hosting answer per component.

Planning a residency review? Talk to our team and bring your data map.