Deepgram Data Handling
Overview
Best practices for handling audio and transcript data with Deepgram. Covers Deepgram's built-in redact parameter for PII, secure audio upload with encryption, transcript storage patterns, data retention policies, and GDPR/HIPAA compliance workflows.
Data Privacy Quick Reference
| Deepgram Feature | What It Does | Enable |
|---|
redact: ['pci'] | Masks credit card numbers in transcript | Query param |
redact: ['ssn'] | Masks Social Security numbers | Query param |
redact: ['numbers'] | Masks all numeric sequences | Query param |
| Data retention | Deepgram does NOT store audio or transcripts | Default behavior |
Deepgram's data policy: Audio is processed in real-time and not stored. Transcripts are not retained unless you use Deepgram's optional storage features.
Instructions
Step 1: Deepgram Built-in PII Redaction
import { createClient } from '@deepgram/sdk';
const deepgram = createClient(process.env.DEEPGRAM_API_KEY!);
const { result } = await deepgram.listen.prerecorded.transcribeUrl(
{ url: audioUrl },
{
model: 'nova-3',
smart_format: true,
redact: ['pci', 'ssn'],
}
);
console.log(result.results.channels[0].alternatives[0].transcript);
Step 2: Application-Level PII Redaction
const piiPatterns: Array<{ name: string; pattern: RegExp; replacement: string }> = [
{ name: 'email', pattern: /\b[\w.-]+@[\w.-]+\.\w{2,}\b/g, replacement: '[EMAIL]' },
{ name: 'phone', pattern: /\b(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g, replacement: '[PHONE]' },
{ name: 'dob', pattern: /\b(0[1-9]|1[0-2])\/.-\/.-\d{2}\b/g, replacement: '[DOB]' },
{ name: 'address', pattern: /\b\d{1,5}\s[\w\s]+(?:Street|St|Avenue|Ave|Road|Rd|Drive|Dr|Lane|Ln|Boulevard|Blvd)\b/gi, replacement: '[ADDRESS]' },
];
function redactPII(text: string): { redacted: string; found: string[] } {
let redacted = text;
const found: string[] = [];
for (const { name, pattern, replacement } of piiPatterns) {
const matches = text.(pattern);
(matches) {
found.();
redacted = redacted.(pattern, replacement);
}
}
{ redacted, found };
}
transcript = result..[].[].;
{ redacted, found } = (transcript);
(found. > ) .(, found);
Step 3: Secure Audio Upload and Storage
import { S3Client, PutObjectCommand, GetObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
import { createHash, randomUUID } from 'crypto';
import { readFileSync } from 'fs';
const s3 = new S3Client({ region: process.env.AWS_REGION ?? 'us-east-1' });
const BUCKET = process.env.AUDIO_BUCKET!;
async function uploadAudio(filePath: string, metadata: Record<string, string> = {}) {
const audio = readFileSync(filePath);
const checksum = createHash('sha256').update(audio).digest('hex');
const key = `audio/${randomUUID()}-${checksum.substring(0, 8)}.wav`;
await s3.send(new ({
: ,
: key,
: audio,
: ,
: ,
: {
...metadata,
checksum,
: ().(),
},
}));
presignedUrl = (s3,
({ : , : key }),
{ : }
);
{ key, checksum, presignedUrl };
}
{ presignedUrl } = (, { : });
{ result } = deepgram...(
{ : presignedUrl },
{ : , : , : [, ] }
);
Step 4: Transcript Storage Pattern
interface StoredTranscript {
id: string;
audioKey: string;
requestId: string;
transcript: string;
confidence: number;
duration: number;
model: string;
speakers: number;
utterances?: Array<{
speaker: number;
text: string;
start: number;
end: number;
}>;
metadata: {
redacted: boolean;
piiTypesFound: string[];
createdAt: string;
retentionPolicy: 'standard' | 'legal_hold' | 'hipaa';
expiresAt: string;
};
}
function buildTranscriptRecord(
audioKey: string,
result: any,
retentionDays = 90
): {
alt = result..[].[];
{ redacted, found } = (alt.);
{
: (),
audioKey,
: result..,
: redacted,
: alt.,
: result..,
: .(result.. ?? {})[] ?? ,
: (alt.?.( w.).()).,
: result..?.( ({
: u.,
: u.,
: u.,
: u.,
})),
: {
: found. > ,
: found,
: ().(),
: ,
: (.() + retentionDays * ).(),
},
};
}
Step 5: Data Retention Policies
const retentionPolicies = {
standard: { days: 90, description: 'Default retention' },
legal_hold: { days: 2555, description: '7 years for legal' },
hipaa: { days: 2190, description: '6 years per HIPAA' },
temp: { days: 7, description: 'Temporary processing' },
};
async function enforceRetention(db: any, s3Client: S3Client, bucket: string) {
const now = new Date();
const expired = await db.query(
'SELECT id, audio_key FROM transcripts WHERE expires_at < $1 AND retention_policy != $2',
[now.toISOString(), 'legal_hold']
);
console.log(`Found ${expired.rows.length} expired transcripts`);
for (const row of expired.rows) {
try {
await s3Client.( ({
: bucket, : row.,
}));
} (: ) {
.(, err.);
}
db.(, [row.]);
.();
}
expired..;
}
Step 6: GDPR Right to Erasure
async function processErasureRequest(userId: string, db: any, s3Client: S3Client, bucket: string) {
console.log(`Processing GDPR erasure request for user: ${userId}`);
const transcripts = await db.query(
'SELECT id, audio_key FROM transcripts WHERE user_id = $1', [userId]
);
for (const row of transcripts.rows) {
if (row.audio_key) {
await s3Client.send(new DeleteObjectCommand({ Bucket: bucket, Key: row.audio_key }));
}
}
const deleted = await db.query('DELETE FROM transcripts WHERE user_id = $1', [userId]);
await db.query('DELETE FROM user_metadata WHERE user_id = $1', [userId]);
console.log(JSON.({
: ,
: userId.(, ) + ,
: deleted.,
: transcripts..,
: ().(),
}));
{ : deleted., : transcripts.. };
}
Output
- Deepgram built-in PII redaction (pci, ssn, numbers)
- Application-level PII redaction (email, phone, DOB, address)
- Secure audio upload to S3 with KMS encryption
- Transcript storage pattern with retention metadata
- Automated retention enforcement
- GDPR erasure workflow
Error Handling
| Issue | Cause | Solution |
|---|
| PII still visible | Deepgram redact not set | Add redact: ['pci', 'ssn'] to options |
| S3 upload fails | Missing KMS permissions | Add kms:GenerateDataKey to IAM role |
| Retention not enforced | Cron not running | Schedule retention job, add monitoring |
| Erasure incomplete | Transaction failed | Use database transactions for atomic delete |
Resources
