Datatel Expands IVR Payment Deployments to Eliminate AI Agent Handling of Card Data

Organizations are moving quickly to deploy AI agents across customer service operations. From voice assistants to chat-based automation, AI is increasingly becoming the front line of customer interaction.

But as AI systems take on a greater role, a new risk is emerging.

Payment data is being pulled into environments that were never designed to securely handle it.

In many deployments, AI agents are being asked to assist customers end-to-end, including during payment moments. That means cardholder data can pass through voice transcripts, conversational logs, and third-party AI infrastructure, introducing significant compliance, security, and governance concerns, particularly under evolving requirements such as PCI DSS v4.0.1.

The issue is not the use of AI. It is how payment flows are structured around it.

“AI is incredibly effective at guiding conversations, but it should not be responsible for handling payment data,” said Barnard Crespi Datatel’s Co-CEO . “Under PCI DSS v4.0.1, organizations are expected to have greater control and visibility over where cardholder data flows. The moment that data enters an AI environment, that control becomes significantly more complex.”

To address this, Datatel Communications Inc. (USA) and Datatel Inc. (Canada), a leader in IVR Payments, is expanding its IVR payment deployments with the introduction of CryptoIVR AI AgentGuard, a purpose-built solution designed to isolate payment capture from AI-driven interactions.

The approach is simple in concept, but critical in execution.

AI agents manage the interaction.
CryptoIVR AI AgentGuard manages the payment.

When a customer is ready to make a payment, the interaction is securely transferred to the CryptoIVR AI AgentGuard environment, where card data is captured using DTMF tones and tokenized directly at the payment gateway. The AI agent never sees, hears, or processes the card data.

This architectural separation supports alignment with PCI DSS v4.0.1 by:

• Preventing cardholder data from entering AI transcripts and conversational logs

• Reducing PCI scope across AI and customer interaction systems

• Maintaining clear segmentation between interaction layers and payment environments

• Supporting auditability and control over sensitive data flows

This model is already being adopted across healthcare, utilities, and the public sector, where the combination of AI-driven service and secure payment handling must align with stricter compliance expectations.

As AI continues to evolve, the design of payment flows is emerging as a critical factor in determining both risk and performance.

Organizations that treat payments as just another step in the AI conversation may be introducing unnecessary compliance exposure under PCI DSS v4.0.1, whereas those that separate interaction from transaction are building more resilient, audit-ready systems.

To support organizations in evaluating their current payment environments, Datatel is offering a working session called “How Money Flows.”

This 20–30-minute session is not a product demonstration. It is a structured diagnostic designed to help organizations understand how payments move across their business, from the moment a customer decides to pay through to settlement and reconciliation.

Participants receive:

• A clear view of how payment flows operate across channels

• Identification of areas where AI or operational design may be introducing risk

• Insight into where card data may be unnecessarily exposed

• A structured report aligned to PCI DSS v4.0.1 considerations and best practices

Organizations can book a session here:
https://www.datatel-systems.com/money-flow-session/

As AI becomes more embedded in customer interactions, the question is no longer whether to use it, it’s how to design around it.

And in payment environments, that design decision is becoming a defining factor in security, compliance, and long-term operational control.