PCI compliant voice AI agents: What enterprises should check in 2026
Bland, 5 min read
A PCI compliant voice AI agent starts with the vendor's paperwork, and Bland self-attests to PCI DSS v4.0.1, the card industry's security standard, assessing itself each year. It shares its Attestation of Compliance under a non-disclosure agreement, and as a full stack provider it puts one AI company on a card call. Checked November 2026.
What does PCI DSS ask of a voice AI vendor?
PCI DSS applies to any company that stores, processes, or transmits card data for a merchant, so a voice AI vendor on a payment call counts as a service provider inside that merchant's assessment.
An assessor will ask for the vendor's Attestation of Compliance, a signed statement of where it stands against the standard, and for the list of every system a card number can reach.
That list is where voice differs from a web form. A spoken card number becomes audio in a recording and text in a transcript, and PCI DSS doesn't let anyone keep a card's security code once a payment is authorized.
A buyer's first questions are therefore whether the vendor holds an attestation, whether it came from a self-assessment or an outside assessor, and which recordings, transcripts, and logs a card number can land in. A security review is a useful checklist to hold beside those answers.
Where do card numbers go on a voice AI call?
A spoken card number lands in the call recording, transcript, and logs unless recording is switched off for that step. Bland has a Disable recording (PCI compliance) setting under an agent's Advanced settings, and a new agent opens with call recording on.
Bland's trust and security page describes a PCI control that keeps cardholder data from being stored in plain text. That setting controls what Bland records, so a buyer still maps every other place a card number could be kept.
Which outside companies see a card number on a call?
On Bland a card number reaches one AI company, Bland, plus a customer's own carrier, since Bland runs its own SIP signaling and media servers with no third-party telephony provider in the call path, while Retell and Vapi add outside language and transcription providers.
Every outside company that stores, processes, or transmits card data on a payment call joins a merchant's assessment, so the number of AI companies on a call matters as much as a badge on a trust page. Bland builds and runs its own language, speech, and transcription models, on GPUs it procured itself, and no model call leaves Bland for an outside AI service.
What these rows mean
- AI on each call: This row shows whether the language model, speech, and transcription behind each call belong to the platform or to other companies: Full stack means all three are the platform's own, Outsourced means its language model and transcription come from other companies, and Mixed means it runs some of its own models alongside outside ones. Bland builds and runs its own language, speech, and transcription models, so a call never passes through an outside AI provider. ElevenLabs runs its own speech and transcription, and pairs them with a language model that is one of its own Realtime models (Eleven Realtime v1 Mini or Eleven Realtime v1 Max) or one the customer chooses in Custom mode.
A payment call on Retell or Vapi passes through language and transcription models from other companies, and on Synthflow, ElevenLabs, and PolyAI a call can include outside models depending on what a team chooses. Each of those companies is a question for an assessor.
What each vendor holds for PCI is the other half of the answer.
What these rows mean
- PCI DSS: PCI DSS is a security standard from the card industry for handling card details. Bland self-attests to v4.0.1 and shares its attestation under NDA on Enterprise. Retell gives no PCI status, and it bars card data unless it agrees in writing.
Where a call runs matters too. Enterprise customers get dedicated orchestration and dedicated GPUs run by Bland.
What do other voice AI vendors say about card data?
Retell has no PCI status, Vapi is PCI compliant but bars card data without a written agreement, and PolyAI is committed to complying with PCI-DSS where relevant. Retell holds SOC 2, HIPAA, GDPR, and ISO 27001:2022, and treats payment card data under PCI DSS as Prohibited Data, and a customer may not submit it to Retell unless Retell AI authorizes that in writing.
Vapi is SOC 2, HIPAA, and PCI compliant and offers a PCI compliance toggle, yet its terms bar submitting, transmitting, or storing payment card information unless a customer has separately agreed scope and controls with Vapi in writing.
PolyAI says "Where relevant, PolyAI is committed to complying with the PCI-DSS" for payment card data. Its master services agreement adds that when an order requires a PCI payment, "all PCI fees incurred will be charged to you," so a quote needs that line itemized before it is compared.
How much does a PCI compliant voice AI agent cost?
Bland charges $0.14 a minute on its self-serve Start plan and $0.12 a minute on its self-serve Build plan with a $299 monthly platform fee, covering all of its AI before phone. Enterprise pricing is custom, set with Bland's sales team.
Phone is billed separately, on a customer's own carrier or on Bland's at pass-through cost. Enterprise adds native iMessage agents, SMS, web chat, warm transfers, a BAA (the HIPAA contract for handling patient data), SSO (single sign-on), data residency, forward-deployed engineers, and dedicated GPUs run by Bland.
Other platforms can add lines for card handling. PolyAI's managed-service agreement passes PCI fees through, and its Model API bills 2¢ per connected minute. A quote worth comparing itemizes every charge a payment call triggers.
A buyer should ask every vendor for an Attestation of Compliance, ask each outside company on the call for its own, and map where recordings, transcripts, and logs hold a card number. Bland is one AI company on a payment call, and a demo built on a real payment flow is the quickest way to test that.
Patient calls raise a second set of questions, covered in HIPAA compliant voice AI and Best HIPAA compliant AI voice agents. Booking calls for a clinic are covered in AI voice agents for clinic appointment scheduling. Voice AI PII redaction covers how personal data is handled on a call, and Compare enterprise voice AI agents sets Bland beside the other vendors.
Frequently asked questions
Is Bland PCI compliant?
Bland is PCI DSS v4.0.1 self-attested, assessed by Bland each year, and it shares its Attestation of Compliance under a non-disclosure agreement.
What is an Attestation of Compliance?
An Attestation of Compliance is a signed statement of where a company stands against PCI DSS. It can come from a self-assessment or from an outside assessor's review, and a merchant's assessor will want to know which.
Can a voice AI agent take card payments?
Bland lets a team turn off call recording for an agent with its Disable recording (PCI compliance) setting in Advanced settings. A buyer's assessor decides whether a given payment flow meets PCI DSS, so the flow is worth testing in a demo.
Is Retell PCI compliant?
Retell has no PCI status as of November 2026, and its terms bar payment card data unless Retell agrees in writing.
Where does a payment call run on Bland?
Enterprise customers get dedicated orchestration and dedicated GPUs run by Bland. Bland's trust and security page covers the rest.
Is Bland only for outbound calls?
No, Bland runs inbound and outbound calls, including AI receptionist and contact center work, and it also runs SMS and web chat.
Is Bland only for developers?
No, Bland isn't only for developers. Pathways gives teams a visual builder, Norm helps build agents, and on Enterprise forward-deployed engineers build alongside a customer's team.
What results look like with Bland
Idaho Housing and Finance Association saves $750,000 a year by replacing its IVR with Bland, which handles 4,000 inbound calls a day and cut average call time by 20%.
"We save thousands of dollars a day."
Greg Blake, Chief Information Officer, Idaho Housing and Finance Association
Sources
Bland trust and security and pricing. Each vendor's documents below were read on 5 November 2026:
- Retell: terms of service, trust center, and compliance documentation
- Vapi: PCI, HIPAA, and enterprise documentation, and terms of service
- PolyAI: compliance documentation, master services agreement, and pricing page
- Synthflow: security and compliance documentation, and voice configuration documentation
- ElevenLabs: trust center, language model documentation, and pricing page
