# Deepgram Data Handling

> Implement audio data handling best practices for Deepgram integrations. Use when managing audio file storage, implementing data retention policies, or ensuring GDPR/HIPAA compliance for transcription data. Trigger with phrases like "deepgram data", "audio storage", "transcription data", "deepgram GDPR", "deepgram HIPAA", "deepgram privacy".

- Skill: `micsapp/deepgram-data-handling` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add micsapp/deepgram-data-handling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/micsapp/deepgram-data-handling/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: micsapp (https://skillmd.com/u/micsapp)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/micsapp/deepgram-data-handling

---

# Deepgram Data Handling

## Contents
- [Overview](#overview)
- [Prerequisites](#prerequisites)
- [Instructions](#instructions)
- [Output](#output)
- [Error Handling](#error-handling)
- [Examples](#examples)
- [Resources](#resources)

## Overview
Best practices for handling audio data and transcriptions with Deepgram, including secure upload with encryption, PII redaction, data retention policies, GDPR compliance, and audit logging.

## Prerequisites
- Understanding of data protection regulations
- Cloud storage configured (S3/GCS)
- Encryption capabilities (KMS)
- Data retention policies defined

## Instructions

### Step 1: Implement Secure Upload
Validate audio format (WAV/MP3/FLAC headers), encrypt with AES-256-GCM via KMS data keys, upload to S3 with server-side encryption, and set expiration metadata.

### Step 2: Configure PII Redaction
Apply regex-based redaction for SSN, credit card, phone, email, and date of birth patterns. Also use Deepgram's built-in `redact` option for PCI/SSN/numbers.

### Step 3: Set Up Data Retention
Define policies: standard (30 days), legal hold (7 years), HIPAA (6 years). Auto-enforce retention by scanning S3 objects and deleting expired items in batches.

### Step 4: Implement GDPR Right to Erasure
Process deletion requests by removing transcripts from database, audio files from S3, and user metadata. Log all deletions for audit. Support data export for portability.

### Step 5: Enable Audit Logging
Log all data access events with tamper-evident hashing. Forward to external SIEM if configured.

See [detailed implementation](${CLAUDE_SKILL_DIR}/references/implementation.md) for advanced patterns.

## Output
- Secure audio upload with KMS encryption
- PII redaction (regex + Deepgram built-in)
- Automated data retention enforcement
- GDPR erasure and data export
- Tamper-evident audit logging

## Error Handling
| Issue | Cause | Solution |
|-------|-------|----------|
| Invalid audio format | Wrong file type | Validate magic bytes before upload |
| Encryption failure | KMS unavailable | Retry with backoff, alert ops |
| Retention miss | Cron failure | Monitor retention job, add alerts |
| GDPR incomplete | Partial deletion | Transaction-based deletion with rollback |

## Examples

### Data Lifecycle
```
Upload -> Process -> Store -> Retain -> Archive -> Delete
  |         |         |        |         |          |
Encrypt  Transcribe  Save   Review   Compress   Secure Delete
```

### Compliance Requirements
| Regulation | Key Requirements |
|------------|------------------|
| GDPR | Data minimization, right to deletion, consent |
| HIPAA | PHI protection, access controls, audit logs |
| SOC 2 | Security controls, availability, confidentiality |
| PCI DSS | Data encryption, access logging |

## Resources
- [Deepgram Security](https://deepgram.com/security)
- [GDPR Compliance Guide](https://developers.deepgram.com/docs/gdpr)
- [HIPAA Compliance](https://deepgram.com/hipaa)