--- title: "PCI-Compliant Phone Payments for AI Voice Agents: 2026 Guide" canonical: https://telnyx.com/voice-ai-agents/pci-compliant-payments --- # PCI-Compliant Phone Payments for AI Voice Agents: 2026 Guide [View as page](https://telnyx.com/voice-ai-agents/pci-compliant-payments) [Back to Voice AI Agents](https://telnyx.com/voice-ai-agents) Last updated 6 Nov 2026 # How do AI voice agents take PCI-compliant payments during a call? Learn how AI voice agents take PCI DSS v4.0.1-compliant card payments mid-call, and how Telnyx Pay over Voice encrypts and deletes card data. By [Antonia Morais](https://telnyx.com/authors/antonia-morais)Product Marketing Manager * PCI DSS is the global security standard for any business that stores, processes or transmits payment card data. * v4.0.1 is the current version. It has been the only supported version since v4.0 retired at the end of 2024. * Telnyx's 2026 assessment covers Pay over Voice, Voice (VoIP), SMS APIs and Bare Metal, with a Compliant rating. * With Pay over Voice, callers pay by card mid-call. Card digits are encrypted on capture, sent to the processor, and deleted when the session ends. The CVV is deleted as soon as the processor responds. Telnyx has completed its 2026 PCI DSS v4.0.1 assessment with a Compliant rating, and Pay over Voice is in scope. That means AI agents built on Telnyx can take card payments in the middle of a live call, on our network and our stack, under the industry's payment security standard. Voice AI is moving from answering questions to completing transactions. An agent that can book an appointment but has to hand the caller to a human, or bounce them to a third-party IVR, to collect payment is only half an agent. Payments are one of the core primitives an agent needs to act in the real world, and they come with the strictest rulebook in commerce: PCI DSS. This guide explains what PCI DSS v4.0.1 is, why it matters for voice AI, and how Telnyx handles card data during a call. ## What is PCI DSS v4.0.1? The Payment Card Industry Data Security Standard (PCI DSS) is the baseline set of technical and operational controls for protecting cardholder data. It is maintained by the PCI Security Standards Council, founded by the major card brands, and applies to every merchant and service provider that touches card data. Version 4.0 was the biggest rewrite in a decade. It moved the standard toward continuous security and customized, risk-based controls. Version 4.0.1, [published 11 June 2024](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1), is a limited revision that clarifies intent without adding or removing requirements. Its new, future-dated requirements became mandatory on 31 March 2025. For a service provider like Telnyx, PCI DSS compliance is validated annually and documented in an Attestation of Compliance (AOC) that customers can request during vendor review. ## The six goals and 12 requirements of PCI DSS PCI DSS organizes 12 core requirements under six goals. Each one maps directly to how card data must be handled when a caller reads or keys their card number to an agent. | Goal | Requirements | What it means on a voice call | | ----------------------------------------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------- | | Build and maintain a secure network and systems | 1\. Network security controls · 2\. Secure configurations | The call path carrying card digits is segmented and hardened | | Protect account data | 3\. Protect stored account data · 4\. Strong cryptography in transit | Card digits are encrypted from capture to processor, and not kept | | Maintain a vulnerability management program | 5\. Anti-malware · 6\. Secure systems and software | The payment flow is built and patched under a secure SDLC | | Implement strong access control | 7\. Need-to-know access · 8\. Identify and authenticate users · 9\. Physical access | Neither agents, developers nor support staff can see card numbers | | Regularly monitor and test networks | 10\. Log and monitor access · 11\. Test security regularly | Access to payment systems is logged and tested continuously | | Maintain an information security policy | 12\. Organizational policies and programs | Security is owned, documented and reviewed every year | ## Why PCI DSS matters for voice AI agents The moment an agent asks for a card number, the call becomes part of the cardholder data environment. Every system that touches those digits, from the carrier to the speech pipeline to the logs, falls into PCI scope. That is why most voice AI deployments stop short of payments. Teams typically choose one of three workarounds: * **Transfer to a human.** It breaks the automated experience and puts live agents back in scope. * **Bolt on a third-party payment IVR.** It adds another vendor, another hop of latency and another contract to review. * **Send a payment link by SMS.** It moves the transaction off the call, and many callers never complete it. Running payments on the same network and stack as the agent removes the handoff. The caller stays in one conversation, and the business inherits a payment flow that has already been assessed. ## How Telnyx Pay over Voice handles card data Pay over Voice lets a caller complete a card payment during a live call, whether they are talking to an AI agent or a call flow. Card data is held only as long as the transaction needs it. 1. **Capture.** The caller enters their card details on the keypad. The digits are collected as DTMF tones, not spoken aloud to the agent. 2. **Encrypt.** The digits are encrypted the moment they come in and held only in temporary, encrypted storage. 3. **Process.** The encrypted data is sent to the payment processor for authorization. 4. **Delete the CVV.** The security code is deleted as soon as the processor responds. 5. **Clear the session.** The remaining card data is deleted when the payment session ends. The agent gets the payment result, not the card number. The model, the transcript and the call recording never need to carry card data. ## What's covered in Telnyx's 2026 assessment Telnyx's assessment covers four services, all rated Compliant against PCI DSS v4.0.1. | Service | What it does | | -------------- | ------------------------------------------------------------ | | Pay over Voice | Card payments collected during a live call | | Voice (VoIP) | Programmable voice and SIP for AI agents and contact centers | | SMS APIs | Programmable messaging | | Bare Metal | Dedicated bare metal servers | ### How PCI DSS fits alongside other frameworks PCI DSS is one piece of a regulated buyer's vendor review. It sits next to frameworks that cover other kinds of data. | Framework | What it protects | Who asks for it | | ----------- | ----------------------------------------- | ------------------------------------------------- | | PCI DSS | Payment card data | Any business taking card payments | | HIPAA | Protected health information | US healthcare providers, payers and their vendors | | SOC 2 | Security and availability of a service | Enterprise procurement and security teams | | GDPR / LGPD | Personal data of EU / Brazilian residents | Businesses serving those markets | ## Where in-call payments matter most * **Financial services.** Loan and card repayments, collections and account top-ups, handled by an agent without a transfer. * **Healthcare.** Copays, outstanding balances and appointment deposits taken during scheduling or billing calls. * **Contact centers.** Payments taken in the IVR or by an AI agent, keeping live agents and recordings out of PCI scope. * **Utilities, travel and retail.** Bill payments, bookings and order changes completed in a single call. ## Build agents that can take payments Telnyx runs voice AI on its own private global IP network, with GPU infrastructure co-located with its telephony PoPs. Now the payment step runs on that same stack, under PCI DSS v4.0.1. Your agents can greet the caller, verify them, resolve the request and take the payment, in one call and with one vendor. Need our Attestation of Compliance for a vendor review? Contact your account team. ## Frequently asked questions ### Is Telnyx PCI DSS compliant? Yes. Telnyx completed its 2026 PCI DSS v4.0.1 assessment as a service provider with a Compliant rating, covering Pay over Voice, Voice, SMS APIs and Bare Metal. ### Can an AI agent take card payments on a call? Yes. With Pay over Voice, the caller enters their card on the keypad mid-call. The agent receives the payment result, never the card number. ### Does Telnyx store card numbers from Pay over Voice calls? No. Card digits are encrypted on capture, held temporarily for processing, and deleted when the session ends. The CVV is deleted as soon as the processor responds. ### Do I still need my own PCI compliance? Yes, if you accept card payments. Using a compliant provider can reduce your scope, but each business validates its own compliance. Check with your QSA or acquirer. ### How often is PCI DSS compliance validated? Every year. Telnyx's 2026 attestation is the current one. ### Can I get a copy of Telnyx's Attestation of Compliance? Yes. Customers and prospects can request it from their Telnyx account team. Build voice agents that take payments Take PCI DSS v4.0.1-compliant card payments mid-call, on the same network and stack as your agent. [Sign up](https://telnyx.com/sign-up)[Contact us](https://telnyx.com/contact-us) [Start building](https://telnyx.com/sign-up)