Platform, Security & Integrations / Compliance

PCI DSS Compliance

Yes, when configured correctly. PCI DSS (Payment Card Industry Data Security Standard — the security standard that applies to any system handling credit card information) see Glossary: PCI DSS shapes how we encrypt, store, and control access to call recordings that might contain cardholder data.

Why does this apply to a phone system?

If your team ever takes payment details verbally — a customer reading out a card number during a call — and you record that call, the recording itself falls under PCI DSS. The standard exists to stop insecure storage or access from exposing that kind of sensitive data.

How does the system protect recordings that might contain card data?

We encrypt recordings both while a call is happening and once it’s stored (encryption at rest), and we restrict access to recordings to authorized users only — see Call Encryption for how that encryption works.

Can we pause or exclude recording during the part of a call where someone reads out card details?

You can control recording at a granular level, including pausing or masking specific segments of a call, so payment details don’t need to end up in a permanent recording at all if you’d prefer to handle it that way.

Who can access recordings that might contain sensitive payment information?

Access is role-based, so only specific authorized users can retrieve and listen to recordings, and we log every access — supporting the accountability and access-control requirements PCI DSS expects.

Does this make our business fully PCI compliant on its own?

No — PCI DSS compliance covers your whole payment-handling process, not just the phone system. What this system provides is a secure foundation (encryption, access control, configurable recording behavior) that supports the parts of PCI DSS that touch your voice channel.