PCI DSS for contact centers

See also

Sources

1. 1
   Encrypted Stored customer input from Amazon Connect is decrypted by the customer with the AWS Encryption SDK and its private key; AWS provides a Java sample.

   Encrypt sensitive customer input in Connect Customer · 'How to decrypt data encrypted by Connect Customer' section · Checked 2026-09-30
2. 2
   AWS recommends collecting payment card information in Amazon Connect with encrypted DTMF, or with Amazon Lex for speech input.

   Best practices for PCI compliance in Connect Customer · bullet 2 · Checked 2026-09-30
3. 3
   Amazon Connect's sample agent-assisted secure-input flow conferences agent and customer, puts the agent on hold while the customer keys card data into an encrypting Store customer input block, then reconnects them; AWS recommends encryption over this sample in production.

   Sample secure customer data entry input in a call with a contact center agent · introduction and steps 2-6 · Checked 2026-09-30
4. 4
   AWS recommends MFA for any access to card data in Amazon Connect because the service is a public endpoint.

   Best practices for PCI compliance in Connect Customer · bullet 5 · Checked 2026-09-30
5. 5
   By default an Amazon Connect screen recording carries unredacted call audio.

   Frequently asked questions about Connect Customer screen recording capabilities · Configuration > 'Is there a way to choose which audio (redacted or unredacted) gets used for screen recording?' · Checked 2026-09-30
6. 6
   Amazon Connect rule-based redaction masks whole browser or application windows that match URL or window-title rules and cannot redact a single form field.

   Frequently asked questions about Connect Customer screen recording capabilities · Rule-based redaction FAQ > 'Can I redact only part of a page, such as a single form field?' · Checked 2026-09-30
7. 7
   Amazon Connect rule-based redaction never pauses screen capture; it masks matching windows only in a separate redacted copy after the contact, and the unredacted recording is kept in the same S3 bucket.

   Frequently asked questions about Connect Customer screen recording capabilities · Rule-based redaction FAQ > 'Does rule-based redaction pause or stop the recording' and 'Does rule-based redaction affect storage costs?' · Checked 2026-09-30
8. 8
   Amazon Connect rule-based redaction applies only to screen video and does not redact audio; audio redaction needs conversational analytics sensitive data redaction.

   Frequently asked questions about Connect Customer screen recording capabilities · Rule-based redaction FAQ > 'Does rule-based redaction apply to call recordings?' · Checked 2026-09-30
9. 9
   Amazon Connect screen recording keeps recording when the agent puts the customer on hold.

   Frequently asked questions about Connect Customer screen recording capabilities · Screen recording FAQ > 'Does screen recording STOP when an agent places a customer on hold?' · Checked 2026-09-30
10. 10
    AWS states that Amazon Connect, including screen recording, is PCI DSS compliant, but the customer is responsible for deciding whether its own implementation meets its compliance requirements.

    Frequently asked questions about Connect Customer screen recording capabilities · Screen recording FAQ > General specifications > 'Is screen recording PCI compliant?' · Checked 2026-09-30
11. 11
    AWS says that if card data is captured in Amazon Connect call recordings it must be scrubbed from the recording and obscured in any logs or transcriptions.

    Best practices for PCI compliance in Connect Customer · bullet 3 · Checked 2026-09-30
12. 12
    Amazon Connect can encrypt DTMF captured by the Store customer input block with a customer-supplied public key and X.509 certificate in .pem format, with up to two encryption keys active at a time for rotation.

    Encrypt sensitive customer input in Connect Customer · introduction and note · Checked 2026-09-30
13. 13
    PCI SSC recommends a policy that keeps materials and devices that could record card data out of the telephone payment environment.

    Industry Guidance on Accepting Telephone Payments Securely · 'Process' best practice · Checked 2026-09-30
14. 14
    51 of the 64 new requirements introduced in PCI DSS v4.0 were future-dated and became effective on 31 March 2025; v4.0.1 did not change that date.

    Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x · opening paragraphs · Checked 2026-09-30
15. 15
    Genesys says it may share the Genesys Cloud PCI DSS AOC with interested parties after they sign a non-disclosure agreement.

    PCI DSS compliance - Genesys Cloud Resource Center · Attestation of Compliance paragraph · Checked 2026-09-30
16. 16
    Genesys requires customers to enable the PCI setting on the Manage Organization page and to use Secure Pause or a Secure Flow before handling cardholder data.

    PCI DSS compliance - Genesys Cloud Resource Center · customer responsibilities section · Checked 2026-09-30
17. 17
    When the PCI DSS compliance setting is enabled in Genesys Cloud, DTMF logging and media capture are disabled.

    PCI DSS compliance - Genesys Cloud Resource Center · PCI setting effects section · Checked 2026-09-30
18. 18
    Genesys's PCI DSS page states that Genesys Cloud is Service Provider Level 1 compliant with PCI DSS version 4.0.

    PCI DSS compliance - Genesys Cloud Resource Center · opening compliance statement · Checked 2026-09-30
19. 19
    Genesys Cloud provides Secure Pause, which temporarily stops recording during entry of sensitive data, and Secure Call Flows, to which agents transfer calls so the system and agent cannot capture the caller's entry.

    PCI DSS compliance - Genesys Cloud Resource Center · Secure Pause and Secure Call Flows sections · Checked 2026-09-30
20. 20
    Because PCI SSC retired PCI DSS v4.0 on 31 December 2024, the v4.0 label on Genesys's compliance page probably lags the current attestation, and the AOC itself should be checked for the version and date assessed.inferred

    PCI DSS compliance - Genesys Cloud Resource Center · opening compliance statement, read against pcissc-blog-pci-dss-v4-0-1-published · Checked 2026-09-30
21. 21
    Agent-initiated recording pause (Webex Contact Center pause, Genesys Secure Pause) depends on the agent acting in time, so a missed pause leaves SAD in the recording and triggers the FAQ 1210 duty to delete it securely after authorization.inferred

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210 answer paragraph 2, read with the cisco-help-3srgv1-wxcc-security call recordings section and the genesys-help-pci-dss-compliance Secure Pause section · Checked 2026-09-30
22. 22
    A CCaaS vendor's PCI DSS attestation does not by itself make the customer's contact center compliant; the customer keeps the requirements that the vendor's responsibility matrix assigns to it, including how recording, pause and screen capture are configured.inferred

    FAQ 1576: What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance? · FAQ 1576 responsibility matrix paragraph, read with the aws-connect-screen-recording-faq PCI answer and twilio-docs-voice-pci-workflows responsibility paragraph · Checked 2026-09-30
23. 23
    PCI SSC guidance says technology that minimizes personnel exposure to account data should be considered for telephone payments.

    Industry Guidance on Accepting Telephone Payments Securely · 'Technology' best practice · Checked 2026-09-30
24. 24
    Storing card validation codes (CAV2, CVC2, CVV2 or CID) in any form of digital audio recording after authorization violates PCI DSS Requirement 3.3.1.

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210, answer paragraph 1 · Checked 2026-09-30
25. 25
    FAQ 1210 states that PCI DSS does not override local or regional laws on retaining audio recordings.

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210, final paragraph · Checked 2026-09-30
26. 26
    Compensating controls for SAD retained in call recordings are validated during the annual PCI DSS assessment and shared with acquirers or payment brands as needed.

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210, paragraph after the compensating-control list · Checked 2026-09-30
27. 27
    Where secure deletion of SAD from recordings is not feasible, FAQ 1210 sets minimum compensating controls: a risk assessment annually and after significant change, protection of the SAD under applicable PCI DSS requirements, controls that prevent access to the SAD and querying of call recordings, and documented justification and evidence.

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210, compensating-control list · Checked 2026-09-30
28. 28
    If sensitive authentication data cannot be kept out of a call recording, FAQ 1210 requires it to be securely deleted immediately after the transaction is authorized.

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210, answer paragraph 2 · Checked 2026-09-30
29. 29
    The PCI DSS prohibition on keeping sensitive authentication data in call recordings after authorization applies even when the recording is encrypted.

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210, answer paragraph 1 · Checked 2026-09-30
30. 30
    PCI SSC FAQ 1210 says that where sensitive authentication data is collected during a call, the entity should prevent it from being recorded, enabling audio suppression or redaction technology where it exists.

    FAQ 1210: Are audio/voice recordings permitted to contain sensitive authentication data? · FAQ 1210, answer paragraph 2 · Checked 2026-09-30
31. 31
    PCI SSC says entities should assess the extra risk of processing account data at unsecured home locations and add controls to match, and that its remote-working guidance does not replace PCI DSS requirements.

    Protecting Payments While Working Remotely · 'Important note' and people controls · Checked 2026-09-30
32. 32
    PCI SSC guidance for remote workers who take payments calls for multi-factor authentication to access telephone systems or payment processing platforms.

    Protecting Payments While Working Remotely · 'Process controls' section · Checked 2026-09-30
33. 33
    The PCI SSC future-dated requirements post cites Requirement 12.5.2 as an annual exercise to confirm every aspect of PCI DSS scope.

    Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x · list of example requirements · Checked 2026-09-30
34. 34
    PCI SSC held a Request for Comments on PCI DSS v4.0.1 from 3 June to 20 July 2026 to start work on the next iteration of the standard.

    Request for Comments: PCI Data Security Standard (PCI DSS) v4.0.1 · post body, RFC window paragraph · Checked 2026-09-30
35. 35
    A third-party service provider that has a PCI DSS Attestation of Compliance is expected to give it to customers on request, and customers may also ask for the relevant sections of its ROC or SAQ D for Service Providers.

    FAQ 1576: What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance? · FAQ 1576, answer paragraphs 1-2 · Checked 2026-09-30
36. 36
    Under PCI DSS Requirements 12.9.1 and 12.9.2, a TPSP documents which PCI DSS requirements it is responsible for and which are the customer's, typically as a responsibility matrix.

    FAQ 1576: What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance? · FAQ 1576, responsibility matrix paragraph · Checked 2026-09-30
37. 37
    A TPSP's evidence must let the customer verify that the scope of the TPSP's PCI DSS assessment covered the services the customer actually uses.

    FAQ 1576: What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance? · FAQ 1576, answer paragraph 1 · Checked 2026-09-30
38. 38
    A TPSP without its own PCI DSS assessment must provide specific evidence for the applicable requirements so the customer or its assessor can confirm they are met.

    FAQ 1576: What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance? · FAQ 1576, answer paragraph 3 · Checked 2026-09-30
39. 39
    Twilio says Conversation Intelligence (classic) is not PCI compliant and must not be enabled in PCI workflows.

    Payment Card Industry Programmable Voice workflows · excluded services section · Checked 2026-09-30
40. 40
    Twilio Conversation Relay supports PCI workflows only when configured with PCI-compliant text-to-speech and transcription providers.

    Payment Card Industry Programmable Voice workflows · PCI-compliant products section · Checked 2026-09-30
41. 41
    Twilio PCI Mode is an account-wide setting turned on in the Twilio Console on the Voice general settings page.

    Payment Card Industry Programmable Voice workflows · PCI Mode section · Checked 2026-09-30
42. 42
    Once PCI Mode is turned on for a Twilio account it cannot be turned off for that account.

    Payment Card Industry Programmable Voice workflows · PCI Mode section · Checked 2026-09-30
43. 43
    By default Twilio keeps PCI voice recordings made in PCI Mode workflows for one year from creation and then deletes them permanently.

    Payment Card Industry Programmable Voice workflows · PCI voice recordings section · Checked 2026-09-30
44. 44
    Twilio points customers to its Responsibility Matrix for their own obligations when using Programmable Voice in a PCI workflow.

    Payment Card Industry Programmable Voice workflows · customer responsibility paragraph · Checked 2026-09-30
45. 45
    Twilio's native and Marketplace transcriptions are not available on an account with PCI Mode enabled.

    Payment Card Industry Programmable Voice workflows · excluded services section · Checked 2026-09-30
46. 46
    PCI DSS v3.2.1 was retired on 31 March 2024.

    Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x · key context paragraph · Checked 2026-09-30
47. 47
    PCI SSC retired PCI DSS v4.0 on 31 December 2024, leaving v4.0.1 as the only active version.

    Just Published: PCI DSS v4.0.1 · paragraph on v4.0 retirement · Checked 2026-09-30
48. 48
    As of the June 2026 RFC announcement, PCI DSS v4.0.1 was still the published standard, and the post gave no name or date for a successor version.

    Request for Comments: PCI Data Security Standard (PCI DSS) v4.0.1 · post body · Checked 2026-09-30
49. 49
    PCI DSS v4.0.1 is a limited revision that adds and deletes no requirements; it corrects and clarifies existing text.

    Just Published: PCI DSS v4.0.1 · paragraph describing the nature of the revision · Checked 2026-09-30
50. 50
    PCI SSC published PCI DSS v4.0.1 in June 2024; the announcement post is dated 11 June 2024.

    Just Published: PCI DSS v4.0.1 · post date and opening paragraph · Checked 2026-09-30
51. 51
    For business-to-business VoIP carrying card data across multiple carriers, the traffic is in the entity's scope only while it is on the entity's infrastructure.

    FAQ 1153: How does PCI DSS apply to VoIP? · FAQ 1153, business-to-business bullet · Checked 2026-09-30
52. 52
    For VoIP between a cardholder and an entity, the entity's systems are in scope but securing the transmission outside the entity's infrastructure is not, because the entity cannot control how the cardholder places calls.

    FAQ 1153: How does PCI DSS apply to VoIP? · FAQ 1153, cardholder transmissions bullet · Checked 2026-09-30
53. 53
    Inbound VoIP traffic from an external source is not in the entity's PCI DSS scope until it reaches the entity's infrastructure.

    FAQ 1153: How does PCI DSS apply to VoIP? · FAQ 1153, inbound external traffic bullet · Checked 2026-09-30
54. 54
    VoIP traffic that carries payment card account data is in scope for applicable PCI DSS controls wherever it is stored, processed or transmitted on the entity's own network.

    FAQ 1153: How does PCI DSS apply to VoIP? · FAQ 1153, internal transmissions bullet · Checked 2026-09-30
55. 55
    Webex Contact Center admins can set a duration in seconds after which a paused call recording resumes automatically.

    Set up security for Webex Contact Center · Call recordings section · Checked 2026-09-30
56. 56
    Webex Contact Center sensitive data masking applies only to Agent Desktop, not Supervisor Desktop users.

    Set up security for Webex Contact Center · Sensitive Data section · Checked 2026-09-30
57. 57
    Webex Contact Center sensitive data masking only hides data in the UI; Cisco says the data is not encrypted in the backend and network and console logs still contain it.

    Set up security for Webex Contact Center · Sensitive Data section · Checked 2026-09-30
58. 58
    In Webex Contact Center, agent pause of call recording is disabled by default; when an admin enables it, agents can pause recording from Agent Desktop while a customer shares sensitive data.

    Set up security for Webex Contact Center · Call recordings section · Checked 2026-09-30
59. 59
    While a Webex Contact Center call recording is paused, the system still records call metadata such as duration, dialed number and routing path in the Contact Center database.

    Set up security for Webex Contact Center · Call recordings section · Checked 2026-09-30
60. 60
    Cisco's November 2021 Webex Contact Center 1.0 data sheet states the platform is PCI DSS Level 1 certified through a third-party AOC audit reviewed annually.

    Webex Contact Center 1.0 Data Sheet · Security and compliance section · Checked 2026-09-30

Documents

Cite this page

WarmTransfer. (2026, September 30). PCI DSS for contact centers. WarmTransfer. https://warmtransfer.net/knowledge/pci-dss-contact-center

@misc{warmtransfer-pci-dss-contact-center,
  title  = {PCI DSS for contact centers},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/pci-dss-contact-center},
  note   = {Verified 2026-09-30}
}