Recording Storage

Session recordings can be archived to external object storage (S3, GCS, Azure Blob) with configurable retention per tenant. Recordings are encrypted at rest with a workspace-scoped data key wrapped by the tenant KEK, and storage credentials are themselves stored in the CoreLink vault for rotation.

Rekey operations re-wrap existing recordings under a new KEK without re-encrypting the underlying recording payload -- fast and cheap even across millions of recordings. Retention policies enforce automatic deletion after the configured window.

Key Configuration

• Storage backend (S3, GCS, Azure Blob)
• Retention period (days)
• KEK rotation schedule
• Storage credential source (vault secret reference)