Compliance brief · v1.0 · May 2026

The legal homework is already done.

Capturing audio from a government employee’s workday touches five distinct legal frameworks at once: biometric privacy, public-records law, public-sector labor law, federal health privacy, and a 50-state patchwork of wiretap rules. Each one is its own legal universe. This brief is the plain-English version of how Tenure handles every one — before your counsel asks.

Prepared forGovernment agency review — HR, IT, Legal, and union counsel
JurisdictionNew York State pilot framework — 50-state platform compliance map
Designated officerJason Amos, Founder & CEO — jason@withtenure.ai
PostureSOC 2-aligned controls. $1M Cyber Liability. US-only data residency. Annual agency audit rights.
NY SHIELD ActVoiceprints treated as biometric data
FOIL · §87(2)(d)Raw audio is trade secret, not agency record
Taylor LawPre-negotiated Side Letter for the union
HIPAABAA available before any PHI-adjacent role
50 states · 4 tiersPlatform tells the specialist what to do
The architectural keystone

Raw audio never lives on your servers.

Most of the legal work in front of a government agency comes from one question: who’s holding the audio? We answered that once, in the architecture, and it solves the hardest parts of SHIELD, FOIL, and Taylor Law in a single decision. Audio stays with us. You get what comes out the other side.

Tenure custody

What stays with us, encrypted, in a single hardened environment

Raw biometric data lives in one place under one team’s control. Limits exposure, simplifies the audit story, and keeps it out of your FOIL queue.

  • Raw audio recordings 14 days max
  • Raw transcripts 14 days max
  • PII-redacted transcripts 30 days max
  • Acoustic-filtered processing buffers In-memory only
Agency custody

What you keep, indefinitely, with no audio attached to any of it

Everything you receive is human-reviewed, derivative content. No raw audio, no verbatim transcripts, no biometric data sits inside any of it.

  • Approved Standard Operating Procedures Indefinite
  • Knowledge nodes & role relationships Indefinite
  • Executive analysis Indefinite
  • Certificate of Destruction Permanent record
Why it matters · FOIL
Records held for a government agency are subject to public disclosure under NY Public Officers Law §87. Vendor-only custody means raw audio isn’t an agency record — and is also classified as Tenure trade secret under §87(2)(d).
Why it matters · SHIELD
Biometric exposure is contained to a single, security-hardened environment. The agency’s independent SHIELD Act notification obligations with respect to audio are eliminated.
Why it matters · Taylor
No supervisor, manager or department head ever gets near the raw recording. That guarantee is written into the Union Side Letter and enforceable under PERB.
The lifecycle of one engagement

What happens to an audio file, from the moment it’s recorded to the day it’s gone.

Eight steps. Every one is documented, audit-logged, and bounded by a written retention schedule. The maximum lifespan of any raw audio file in our system is 14 days from the end of the engagement.

Day 0 · Consent01

Written informed consent, voluntarily signed.

The retiring employee signs a consent form their union has had five business days to review. They can withdraw consent any time during the week. No reason needed, no penalty.

Side Letter · Consent Form
Days 1–7 · Capture02

Recording stays on a vendor-owned device.

A small wearable lapel mic, encrypted at the device level, handled only by the Tenure specialist. Signage at every department entrance during the engagement. Off in restrooms, locker rooms, HR rooms — without exception.

Tascam DR-10L Pro · Device encryption · Tally light
Each evening · Upload03

Encrypted in transit to private US storage.

End of day, the audio uploads over TLS 1.3 to a private storage bucket in AWS us-east-1 or us-west-2. Never crosses an international border. Never lands in a public URL.

TLS 1.3 · AWS US region · Private bucket
At rest · Storage04

AES-256 encrypted, no public URLs.

Files are reachable only by short-lived signed URLs that expire in 15 minutes. Every access is logged with user ID, timestamp, IP and action. Audit retention is three years.

AES-256 · 15-min signed URLs · Audit log
Pre-processing · Filter05

Acoustic filtering removes everyone else.

Before any model sees the audio, segments in which the consented employee isn’t an active conversational participant are excluded from processing. Non-consenting colleagues, visitors and constituents get filtered out automatically.

Speaker diarization · Active-participant gating
Transcription · Redact06

PII gets stripped before any extraction.

Names, SSNs, phone numbers, addresses, dates of birth are automatically redacted from transcripts before any analysis runs. Raw audio is transcribed by a single US-region subprocessor. No raw audio ever leaves our pipeline for an LLM.

Automated PII redaction · US-region transcription
Day 7 · Review07

A specialist reviews every SOP before it ships.

Nothing publishes to your wiki unreviewed. Human-in-the-loop is the product promise, not a compliance checkbox. The Tenure specialist edits, approves, and signs off on each SOP and knowledge node before the agency administrator ever sees it.

Human review · Specialist sign-off
Day 14 · Destroy08

Secure deletion. Certificate to both sides.

Raw audio and raw transcripts are permanently and irreversibly deleted within 14 days of engagement end. The redacted derivative is gone by day 30. A signed Certificate of Destruction goes to your administrator and your union representative.

Secure deletion · Certificate of Destruction
The five legal frameworks

Five overlapping laws, in plain English, with the work we did about each one.

A competitor adding voice capture to their product roadmap is signing up for at least a year of legal work on each one of these — separately. We did that year before our first engagement. Your counsel gets the finished work, not the discovery process.

NY State

SHIELD Act

New York treats a recording of your voice the same way it treats a Social Security number — top-tier private information that the people storing it have to actively defend with administrative, technical and physical safeguards.

What we doVoiceprints are classified as biometric data from the moment of capture. AES-256 at rest, TLS 1.3 in transit, private US storage, role-limited access, audit-logged. Designated security officer. Breach notice within 24 hours of awareness.
NY State

FOIL

New York’s public-records law says anything an agency holds is requestable by anyone. Without the right architecture, that includes the raw audio of an employee’s entire workday — which would be a privacy disaster.

What we doRaw audio never lives on agency infrastructure. It stays in our custody only, classified as trade secret under Public Officers Law §87(2)(d). The deliverables that do become agency records — the SOPs — have no audio, no transcripts, no biometric data inside.
NY State

Taylor Law

New York’s public-employee labor law. Among other things, it says you can’t introduce workplace monitoring without negotiating with the union first — and if you do it wrong, it’s an Improper Practice Charge at PERB.

What we doA pre-drafted Union Side Letter goes to the local before any recording starts. It codifies the absolute non-disciplinary-use guarantee, names the union as a co-recipient of the Certificate of Destruction, and gives the union the right to demand immediate cessation on reasonable belief of misuse.
Federal

HIPAA

If the retiring employee’s job touches anyone’s health information — Health Department staff, Social Services, benefits coordinators — federal health-privacy rules apply to anything our microphone picks up near them.

What we doA HIPAA Business Associate Agreement is on the shelf, ready to execute. For any role where PHI exposure is possible, the BAA is signed before the recording device is even configured. No BAA, no recording. The HIPAA minimum-necessary standard is applied to any incidentally captured PHI.
Multi-state

State-by-state wiretap law

Some states need just the consenting employee’s permission to record (“one-party”). A dozen states need every voice in the conversation to consent (“all-party”) — and getting it wrong is a felony. A few states are ambiguous enough that we don’t deploy there until counsel reviews. Our platform tells the specialist what to do every time, state by state, before they even press record. The map below shows where we stand.

What we doEvery engagement opens with a compliance banner that names the state’s recording mode, the exact verbal disclosure required (if any), and the pre-recording checklist. Tier 2 states use session-only recording with a 3-second eye-contact pause before activation. Tier 3 states are blocked at the upload UI until counsel signs off in writing.
50-state recording compliance

A four-tier platform map. The specialist doesn’t guess.

This is the part most vendors haven’t finished. We’ve mapped every state to one of four recording modes, with verbal-disclosure scripts and pre-record checklists baked into the platform. Counsel-reviewed; refreshed annually.

Tier 1 · 37 states + DC
Ambient permitted
Consented employee’s participation is sufficient. Standard signage and Side Letter cover the engagement.
Tier 2 · 12 states
Session-only recording
All-party consent required. Toggle off between sessions, verbal disclosure read at the start of each one, three-second pause for objection.
Tier 3 · 3 states
Counsel review required
Hawaii, Missouri, Nevada. Platform blocks the upload UI. Engagements paused pending written counsel sign-off.
Tier 4 · 0 states
Not currently deployed
Reserved tier. If state law changes and a jurisdiction becomes prohibitive, the platform blocks deployment entirely.
ALT1
AKT1
AZT1
ART1
CAT2
COT1
CTT2
DET2
DCT1
FLT2
GAT1
HIT3
IDT1
ILT2
INT1
IAT1
KST1
KYT1
LAT1
MET1
MDT2
MAT2
MIT1
MNT1
MST1
MOT3
MTT2
NET1
NVT3
NHT2
NJT1
NMT1
NYHome · T1
NCT1
NDT1
OHT1
OKT1
ORT2
PAT2
RIT1
SCT1
SDT1
TNT1
TXT1
UTT1
VTT1
VAT1
WAT2
WVT1
WIT1
WYT1
Six documents that travel with every engagement

The paper trail your counsel will ask for — pre-drafted and ready to review.

Every one of these was written before our first engagement, reviewed by counsel, and is available to your legal team before procurement closes. They’re live links in the platform, not slide-deck promises.

DPA

Data Processing Agreement

The master contract. Specifies vendor-only custody, US data residency, encryption standards, the subprocessor list, retention and deletion schedules, breach notification timelines (24h preliminary / 72h written), audit rights, and a hard prohibition on training AI models on agency data.

Signed by · Agency · Tenure · Corporation Counsel
SL

Union Side Letter

The Taylor Law instrument. Locks in the non-disciplinary-use guarantee, the union’s right to receive the Certificate of Destruction, the right to demand immediate cessation on reasonable belief of misuse, and the “no precedent” clause so the agreement doesn’t bind future engagements.

Signed by · Agency · Union local · Tenure
CF

Participant Consent Form

The retiring employee’s instrument. Layperson language. Voluntary participation, right to withdraw any time, list of what the recording will never be used for, who has access at what level, where it lives, how long. Union has five business days to review before it’s presented.

Signed by · Participant · Tenure rep
BAA

HIPAA Business Associate Agreement

Triggered when the retiring employee’s role touches PHI. Executed before any recording device is configured. Applies the HIPAA minimum-necessary standard to anything incidentally captured. No BAA, no recording.

Signed by · Agency · Tenure · before recording
SEC

SHIELD Act Security Summary

One-page security posture for procurement and legal review. Covers administrative, technical and physical safeguards, biometric data classification, the subprocessor list, breach notification commitment and insurance coverage. Attached as Exhibit C to the Side Letter.

Issued by · Tenure Security Officer
COD

Certificate of Destruction

The closing instrument. A signed, dated, numbered certificate listing every audio file destroyed, the deletion method, timestamp, storage location, and verification method. Certifies SHIELD Act biometric data deletion compliance. Goes to your administrator and your union representative.

Issued to · Agency administrator · Union representative
The shortlist

Twelve things your security review will want to confirm.

The points your IT director, agency counsel and procurement officer ask first. The full controls live in the DPA — this is the version that fits in one column of a board memo.

100%US data residencyAWS us-east-1 / us-west-2 only. No data crosses an international border under any circumstances.
AES-256Encryption at restEvery audio file, every transcript. Private buckets with no public URLs.
TLS 1.3Encryption in transitMinimum for every byte that moves between the device, our servers and a subprocessor.
15minSigned URL expiryMaximum lifetime for any authorized access link. No persistent file URLs exist.
14daysRaw audio retentionHard cap from engagement end. Redacted transcripts gone by day 30.
24/72hBreach notification24-hour preliminary notice by phone/email. 72-hour written notice with full detail.
$1MCyber Liability insuranceMinimum per-occurrence coverage. Certificates of insurance available pre-procurement.
SOC 2Aligned from day oneControls designed to SOC 2 standards from launch. Type II audit on the roadmap.
0AI training on your dataHard contractual prohibition. Your recordings never train any model.
0Third-party sale or transferNo commercial use beyond the engagement itself. No marketplace, no broker, ever.
Annual agency audit rightsWritten into the DPA. On-site or certification-by-officer at your discretion.
3yrsAudit log retentionEvery access event logged with user ID, timestamp, IP and action. Retained three years.
Who else touches your data

The complete subprocessor list.

Four. That’s it. Every one bound by a data processing agreement equivalent to ours. Every one operating exclusively in US regions. You get 30 days written notice before this list changes, and the right to object before any new subprocessor is added.

Request the subprocessor binding documentation →

SubprocessorFunctionWhat it touchesRegion
AssemblyAIAudio transcriptionRaw audio files (transcription only)US only
AnthropicContent extraction (Claude API)Cleaned text transcripts. Never raw audio.US region
SupabaseDatabase & private storageTranscripts, SOPs, metadata, audit logUS (AWS)
VercelApplication hostingNo agency data stored at restUS region
One person owns this

Your compliance question has a name and an email.

Tenure has a designated Security Officer. Not a ticket queue, not a security@ alias. If your agency counsel needs a Data Processing Agreement reviewed, a subprocessor question answered, or a breach posture confirmed, they email Jason and get a written reply within one business day.

Designated Security Officer
Jason Amos
Founder & CEO · Tenure Systems LLC
Webwithtenure.ai
OfficeBuffalo, NY
Response SLA1 business day · written