Safe Harbor Record-Keeping: The 5-Year Rule

The last FTC Safe Harbor provision is not about how you dial; it is about what you keep. A telemarketing company has to hold on to records of its calling for up to 5 years and produce them when asked. If you cannot show your work, the other four provisions do not help you much during an audit. For a VICIdial operator this is mostly good news, because the system already stores a lot of this in the database by default.

What the 2024 Update Added

In 2024 the FTC expanded the list of records you must retain for 5 years. On top of the call logs you already kept, you now need to hold campaign prerecorded messages, telecom carrier details, DNC (do not call) compliance logs, and customer business relationship records. In practice that means the audio you played on a campaign, who carried the traffic, proof that you scrubbed against the National DNC Registry and honored your Internal DNC requests, and the evidence behind any prior-business-relationship exemption you relied on. A clean Disposition history ties these together, because it shows the outcome of every call.

VICIdial keeps many of these records in the database indefinitely by default. There is an optional archiving process that moves call logs out of the easily searchable log tables to keep day-to-day reporting fast, but archived data still lives on the system. To see how record-keeping fits with scrubbing and Safe Harbor as a whole, read the VICIdial compliance overview, and review what FTC Safe Harbor is for the full set of provisions.

Where Records Live Over 5 Years

flowchart LR
  A[Live call data] --> B[Main log tables]
  B --> C{Archive process}
  C -->|Archived| D[Archive tables, still on system]
  D --> E{Cold storage}
  E -->|Moved| F[Separate DB server]
  F --> G[Searchable in Admin Lead Search]
  B --> H[Retain up to 5 years]

The diagram follows a record through its life. Fresh data sits in the main log tables, archiving moves older entries aside while keeping them on the system, and cold storage can push the oldest archived logs to a separate server. At every stage the data stays retrievable, which is exactly what the 5-year rule requires.

The point is not to hoard data; it is to be able to answer a request quickly and completely. VICIfast retains your calling records on managed infrastructure so the 5-year obligation is covered without you babysitting backups. See pricing for details.