Home/Use cases/Legal and compliance
Recordings that will still hold up later.
Consent, declarations, terms acceptance, remote inspections: when a recording is the record, it needs to say when it was made, by what, and where it has been since. AddPipe captures it in the browser and attaches that provenance automatically.
SOC 2 Type I attested. Encrypted in transit and at rest. EU, US or your own storage.
delivered
Used for member testimony, consent and declarations by
Where a recording is the record.
The same embed covers all of these; what changes is the prompt on screen, the time limit, and which of your identifiers travel with the file.
Consent and authorisation
Medical, research, financial or employment consent, spoken on camera by the person giving it, with the wording they were shown.
Declarations and statements
Affidavit-style statements, witness accounts and attestations recorded remotely instead of in person.
Terms and policy acceptance
Acceptance of contract terms, disclosures or training content, recorded alongside the form the user submitted.
Remote audits and inspections
Screen recording with the auditor on camera, for software audits, remote inspections and walkthroughs that need a witness.
Member and constituent testimony
Unions, associations and advocacy groups collecting first-person video from members, at scale, without an app.
Training attestations
Proof that a person completed and understood required training, recorded at the end of the module.
What a recording needs to be a record, and where AddPipe provides it.
Six questions counsel or an auditor will ask about any recording, and the answer the platform gives to each.
01Provenance
When was it made, from what, and by whom?
- Server-side timestamp on every recording, set by AddPipe's clock, not the user's device.
- IP address, user agent, camera and microphone names, resolution and codecs stored as metadata with the file.
- Your own identifiers attached via
payload: the matter, the signer, the form version. They come back in the webhook and REST API.
02Integrity
Is this what the camera saw?
- Media is streamed to AddPipe as it's recorded, not assembled and uploaded from the device afterwards.
- Keep the original file alongside the processed mp4, so the untouched browser output is retained.
- No editing in the client: users can re-record, not trim or splice.
03Residency
Where has the data been?
- Ingestion and processing in the EU or US , pinned per environment.
- The EU silo: EU users' recordings and personal data never leave EU infrastructure, including client delivery.
- Push to your own storage in the jurisdiction you choose.
04Retention
How long is it kept, and who can delete it?
- Lifecycle rules expire recordings on a schedule you set.
- Delete on demand through the dashboard or the REST API, for legal holds ending or data-subject requests.
- Do not store: keep nothing on AddPipe at all; files go only to your bucket.
05Minimisation
Are we collecting more than we need?
- Choose which PII AddPipe collects with each recording, or none.
- Audio-only mode when the face isn't the point.
06Access and assurance
Who can reach it, and who has checked?
- Encrypted in transit and at rest, across ingestion, processing and storage.
- Whitelisted hosts so the recorder only runs on your domains.
- SOC 2 Type I for the Security criteria; the report is available on request.
- Storage, webhook and
getUserMedialogs give an audit trail of what happened to each file.
From the signer's browser to your system of record.
Record
The AddPipe client sits in your consent or intake page, with the statement to read on screen and a time limit.
Stamp
Timestamp, network and device metadata and your identifiers are written with the recording as it lands.
Store
Processed mp4 and, if you choose, the original, pushed to the bucket and region you control.
Link
A webhook delivers the file location and metadata, so the recording is attached to the matter, contract or member the moment it exists.
Keep it where the rules say.
Europe eu2 · eu3
Two zones. With the EU silo enabled, ingestion, processing, storage and even the recorder script are served from EU infrastructure only.
United States us1 · us2
Two zones, Amazon S3 storage behind CloudFront, encrypted at rest.
Your own storage
S3, S3-compatible, SFTP, FTP(S), Dropbox or Box, anywhere you run it, with Do not store so nothing remains on Pipe.
Questions compliance teams ask.
Where does the timestamp come from?
From AddPipe's servers when the recording is received, in UTC, not from the user's device clock. It's stored with the recording's metadata and returned in the webhook and REST API.
Can we prove the file wasn't altered?
You can keep the original browser output next to the processed mp4, and every step after capture is logged. AddPipe doesn't currently produce a cryptographic hash or third-party timestamp; if your process needs one, compute it when the webhook fires and the file is in your bucket.
How do we tie a recording to a person or matter?
Pass your identifiers in the payload field when you embed the recorder. They're stored with the recording and included in every webhook, so no lookup by filename is needed.
Can we control how long recordings are stored?
Yes: lifecycle rules for scheduled expiry, deletion through the dashboard or REST API, and the option to store nothing on AddPipe at all by pushing straight to your own bucket.
Can EU data stay in the EU?
Yes. Pin the environment to the EU region and enable the EU silo; the recorder script, ingestion, processing and storage are all EU-hosted. See the GDPR page.
Does the person recording need an app or account?
No. Recording runs in their browser on your page, on desktop or mobile, with no download and no AddPipe account.
What if the signer's connection drops mid-statement?
Media is streamed as it's recorded. If the connection fails, the client attempts to reconnect, and AddPipe tries to process what was received. You'll see the outcome in the logs.
Is there a security report we can review?
Yes, the SOC 2 Type I report. Request it here.
What if we need help integrating?
Contact us and an engineer will reply. For work beyond AddPipe, our custom development partners can help.
Something else? Email us.
Record one, then read its metadata.
Embed the recorder, make a test statement, open the record in the dashboard. Free for 14 days, no card required.