Proposed lead: A qualified payments assessor, with the buyer’s payments owner; Iliana Peters for related health-data boundaries where applicable.
Why it matters: PCI SSC’s June 2025 FAQ states that sensitive authentication data, including card verification codes, must not be stored after authorisation—even encrypted—and addresses prevention, suppression, deletion and compensating-control considerations for recordings. (pcisecuritystandards.org)
Question to put to the expert:
If a caller starts reading card details aloud, what happens to the audio, transcript, model input, debugging logs and backups?
A strong answer should cover:
- Whether payment collection belongs in the initial workflow at all.
- The assessed design of a payment link, secure keypad entry or specialised transfer.
- Controls covering every recording and transcription path, not just the main dashboard.
- Handling of unsolicited card details.
- Evidence that suppression or deletion works in the configured environment.
- Payment-scope responsibilities across the business, suppliers and assessor.
Do not accept “we redact the transcript” as the complete response. Ask which other copies exist and who verifies the design.
Evidence to request: A payment data-flow diagram, assessor-reviewed scope and a controlled demonstration using test data.
Follow-up: Where could the verification code survive after authorisation, and how have you tested that path?
Expert quote: [Reserved for an approved interview quotation.]