Ozoo by HabileLabs

Ozoo Post Call Analytics: deployment and data handling guide

For customers who subscribe on AWS Marketplace. Ozoo Post Call Analytics is installed by AWS CloudFormation into your own AWS account and runs there. This guide covers what you need before installing, how to install, everything the installation creates, the IAM roles it uses, how your data is handled, licensing, upgrades, costs and removal.

Support: info@habilelabs.io, Monday to Friday, 10:00 to 19:00 IST. Product page: https://www.ozoo.ai/products/post-call-analytics/

1. Before you install

You need Why
An AWS account where you can create IAM roles, a VPC and an Aurora database The stack creates them. The deploying user or role needs the permissions in Deployment permissions.
Region Asia Pacific (Mumbai), ap-south-1 This release installs there only.
Access to Anthropic Claude Sonnet 4.5 and Claude Haiku 4.5 in Amazon Bedrock (global inference profiles) Summaries, classification and scoring run on Bedrock in your account. Anthropic models are sold through AWS Marketplace, so the account needs a valid payment method (Billing and Cost Management, Payment preferences); if the Bedrock console asks for the models' use-case details, submit them once. The install subscribes to the models on its first call.
Either room for one more VPC, internet gateway and Elastic IP address in ap-south-1, or two private subnets of an existing VPC By default the stack creates its own network (the default quotas are 5 VPCs and 5 internet gateways per Region; request more in Service Quotas if the account is at the limit). To use your own VPC instead, see Installing into your existing VPC.
An API key from your speech-to-text provider: Deepgram (default), Sarvam or AssemblyAI Recordings are transcribed by that provider under your own account and terms.
Your licence key Shown on the HabileLabs Marketplace portal after you subscribe.

The stack starts with a pre-flight check, before it builds anything: if the account has no room for the network or cannot use the Bedrock models, it stops within a minute and the stack's event names what to fix. New AWS accounts can also start with a Lambda concurrency limit of 10; the pre-flight requests 1,000 from Service Quotas when the limit is lower and does not wait for it, so calls are processed slowly until AWS approves it. The stack output Preflight says what it found.

2. Subscribe and get your licence key

  1. Subscribe to Ozoo Post Call Analytics on AWS Marketplace and choose a plan and term.
  2. Choose Set up your account. You arrive at the HabileLabs Marketplace portal (https://marketplace.habilelabs.io). Register with your work email; the email address is required and is where we send your account confirmation.
  3. The portal shows your licence key (it starts with PCA-), your plan and launch links for your production and non-production installs. Each licence allows one production and one non-production install.

3. Install

Use Quick Launch on the AWS Marketplace page, or the launch link in the portal. Both open the CloudFormation quick-create page in ap-south-1 with the release template. Fill in:

Parameter What to enter
Licence key Your PCA- key (pre-filled by the portal's link)
Which install of your licence this stack is production or nonprod
Administrator email The first administrator; the sign-in invitation and a temporary password go here
Administrator username Default admin
Speech-to-text provider DEEPGRAM, SARVAM or ASSEMBLYAI
Speech-to-text API key Your key for that provider
Days to keep recordings and results Recordings and analysis files are permanently deleted from the stack's S3 buckets after this many days (default 365)
Existing VPC, Two private subnets of that VPC Optional. Leave both empty for the stack to create its own network; see below
Advanced Database capacity, Bedrock model and licensing portal; keep the defaults unless support asks

Acknowledge that the template creates IAM resources and choose Create stack. Installation takes about 40 minutes, most of it the database and the content delivery network. Use one stack name per install (the portal suggests ozoo-pca and ozoo-pca-nonprod).

When the stack is complete, open WebAppURL from the stack outputs and sign in with the administrator username and the temporary password from the email.

Installing into your existing VPC

Give the stack one of your VPCs and two of its private subnets, and it installs the database and the Lambda functions that use it there instead of creating a VPC. It then creates no VPC, internet gateway, NAT gateway or Elastic IP, and changes nothing in your network: it adds one security group for its functions and one for the database (PostgreSQL from those functions only). The subnets must:

The pre-flight checks all of this before anything is built and names any subnet that does not qualify. S3 and DynamoDB traffic then goes through your egress path; add S3 and DynamoDB gateway endpoints to those subnets' route tables if you want it kept off your NAT gateway. The choice is made at installation and cannot be changed by updating the stack.

4. Send calls

This is post-call analysis; it does not listen to live calls.

5. What the installation creates in your account

All in ap-south-1, named after your stack.

Area AWS services
Network Amazon VPC across two Availability Zones: two public subnets with an internet gateway and one NAT gateway, two private subnets, S3 and DynamoDB gateway endpoints, security groups. Nothing accepts inbound connections from the internet except the web application and its API. With your existing VPC: only two security groups, in that VPC.
Database Amazon Aurora PostgreSQL Serverless v2 in the private subnets, encrypted at rest, accessible only from the application's Lambda functions, 7-day automated backups, final snapshot on deletion. Its password is generated by AWS Secrets Manager.
Storage Amazon S3 buckets for recordings (input), analysis results (output), bulk upload, supporting files and prompts; encrypted (SSE-S3), expiring after your retention period, and kept when the stack is deleted.
Pipeline AWS Step Functions state machine, AWS Lambda functions, Amazon SQS queues with dead-letter queues, Amazon EventBridge rules, Amazon DynamoDB tables for pipeline state and fallback prompts, AWS Glue Data Catalog tables over the results.
Analysis Amazon Bedrock model invocations from your account.
Web application Amazon CloudFront distribution and S3 website bucket, Amazon API Gateway, Amazon Cognito user pool (sign-in, optional self-signup restricted to your email domain).
Operations Amazon CloudWatch log groups and alarms, an Amazon SNS topic for alerts, AWS Systems Manager Parameter Store parameters for settings, AWS Secrets Manager secrets for the database and provider keys.
Licensing A Lambda function that activates the install with your licence key and checks in daily (see section 9).

6. IAM roles and how they are used

The template creates IAM roles only for AWS services in your account; it does not create IAM users, access keys, or any role that HabileLabs or another account can assume.

Role Assumed by Used to
Pipeline step roles AWS Lambda Read recordings from the input bucket, write results to the output bucket, invoke Amazon Bedrock models, read and write the pipeline's SQS queues and DynamoDB tables, read the database secret, report task results to Step Functions
State machine role AWS Step Functions Invoke the pipeline Lambda functions and send messages to the pipeline queues
API roles AWS Lambda Serve the web application's API: read results and the database, presign audio playback URLs, read and write settings in Parameter Store, call Bedrock for on-demand questions about a call
Indexer and call-status roles AWS Lambda Load results into the database when they land in S3; follow pipeline status changes
Database bootstrap role AWS Lambda (CloudFormation custom resource) Apply the database schema and create the first administrator's application account on install and upgrade
Licence role AWS Lambda Store and read the licence state in Parameter Store under /<stack name>/license/, read the database to count analysed call minutes, describe its own CloudFormation stack
Deployment helper roles AWS Lambda (CloudFormation custom resources) Build Lambda layers, copy the web application into its bucket, check network quotas, check (and on first use subscribe to) the Bedrock models, request the Lambda concurrency quota

Lambda functions that use the database run in the private subnets and carry the standard permissions to create their network interfaces there. Each role's policy names the specific buckets, queues, tables, secrets and parameters of this stack; see the template for the exact statements.

7. Deployment permissions

The principal that creates the stack needs the permissions in quick-launch-iam-policy.json (also shown next to the template in Quick Launch). They cover creating and deleting the resources in section 5 and the roles in section 6. After installation they are no longer needed; the application runs with the roles it created.

The policy lets the deployer pass roles only to AWS Lambda, AWS Step Functions and AWS CloudFormation, and create only the Amazon RDS service-linked role. The rest cannot be narrowed to named resources, because every resource name comes from the stack name you choose and from suffixes CloudFormation generates. For least privilege, attach the policy to a CloudFormation service role (a role that only cloudformation.amazonaws.com can assume) and choose it under Permissions when you create the stack: the person deploying then needs only CloudFormation permissions and iam:PassRole for that one role, and the broad permissions can be used only by CloudFormation on this stack's behalf.

8. How your data is handled
Collection Call recordings you place in the input bucket or upload; metadata in their file names; the users, agents, teams, categories, scorecards and settings you enter in the application.
Storage In your AWS account in ap-south-1 only: recordings and analysis files in your S3 buckets, structured results in your Aurora database, settings in your Parameter Store. Encrypted at rest (SSE-S3, Aurora storage encryption) and in transit (TLS).
Usage To transcribe, redact personal data from, summarise, classify and score each call and to show the results to your users.
Sharing Call audio is sent to the speech-to-text provider you selected (Deepgram, Sarvam or AssemblyAI) for transcription, under your account and your agreement with that provider. Transcripts are sent to Amazon Bedrock in your account; with a global. inference profile Bedrock may serve a request from another AWS commercial Region, while an apac. profile keeps inference in Asia Pacific. HabileLabs receives no call audio, transcripts or results. The daily licence check-in sends HabileLabs only: your AWS account ID, the stack's ID, name and Region, the software version, a health flag, the number of active users and agents, and the number and total minutes of calls analysed this month and last month.
Retention Recordings and analysis files are deleted automatically after the retention period you chose at install. Database records are kept until you delete them or the stack. HabileLabs keeps your portal account, licence and check-in records for the life of your subscription plus the period required by law, and deletes them on request.
Backup Aurora automated backups for 7 days and a final snapshot when the stack is deleted, all in your account. S3 data is not backed up by the product; enable S3 Versioning or AWS Backup on the buckets if your policy requires it.
Deletion Delete the CloudFormation stack to remove the application. The S3 buckets and the database's final snapshot are kept so that deletion never destroys your data by accident; delete them yourself when you no longer need them. To delete your portal account and licence records, email info@habilelabs.io.
Access HabileLabs has no access to your AWS account. Your users sign in through the Amazon Cognito user pool in your account; access inside the application is role-based, and score overrides are recorded in an audit trail.

Security incidents: report suspected vulnerabilities or incidents involving the product to info@habilelabs.io with the subject "Security". We acknowledge within one business day and notify affected customers of any incident relevant to them.

9. Licensing

10. Upgrades

New releases appear on the portal's Upgrades page with release notes. To upgrade, update the stack with the new release's template URL and keep the existing parameter values. Schema changes are applied automatically during the update.

11. Costs

Your subscription covers the software licence. AWS bills your account directly for the infrastructure the installation uses, and your speech-to-text provider bills you for transcription. The fixed part in ap-south-1 is about USD 110 a month before traffic and storage: the NAT gateway (about USD 41, plus USD 0.056 per GB it processes), its public IPv4 address (about USD 4) and the database's minimum capacity of 0.5 Aurora capacity units (about USD 66). Installed into your existing VPC, the NAT gateway and address are yours already and only the database's minimum applies. The rest scales with call volume: Lambda, Step Functions, SQS, S3, CloudFront and Amazon Bedrock tokens per call. Prices are AWS list prices on 16 October 2026; check the AWS pricing pages for current ones.

12. Removing the product

Delete the CloudFormation stack. The licence function frees your install slot. The S3 buckets and the database's final snapshot remain in your account until you delete them. Cancelling the AWS Marketplace subscription stops billing for the licence; it does not delete anything in your account.

13. Third-party software

The installation copies FFmpeg 4.4 (John Van Sickle's static build for Linux, unmodified) into a Lambda layer in your account, where it converts and splits call recordings. It is downloaded from the HabileLabs release bucket and is licensed under the GNU General Public License, version 3. Its notice, its source and our written offer of the complete corresponding source are published beside it: https://pca-releases-ap-south-1.s3.ap-south-1.amazonaws.com/third-party/ffmpeg/NOTICE.txt