AI voice agent security and compliance: questions to ask a vendor
Searching for a secure voice AI or an enterprise AI calling platform? Start with the questions, not the badges. Here is what SOC 2, PCI DSS, call recording consent, data retention and synthetic voice disclosure mean, with official sources, and what to ask any AI voice agent vendor before you sign.
This is a buyer's guide, not legal advice. Rules depend on your country, state and industry, so confirm them with your own counsel.
1. SOC 2: ask for the report, not the logo
SOC 2 is an attestation framework from the AICPA. An independent CPA firm examines a company's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Two details matter. A Type 1 report describes controls at a single point in time. A Type 2 report tests them over a period. Source: AICPA, SOC 2 overview (aicpa-cima.com, "SOC 2 - SOC for Service Organizations: Trust Services Criteria").
Ask the vendor:
Do you have a SOC 2 report, Type 1 or Type 2? Which criteria and which systems does it cover? What is the audit period? Can you share it under NDA? Are the telephony, speech and AI subprocessors in scope or listed separately?
A claim such as "SOC 2 aligned" or "built to SOC 2 standards" is not a report. Only the report is evidence.
2. PCI DSS: the key question for phone payments
PCI DSS is the Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council. It applies to any business that stores, processes or transmits cardholder data. Card numbers spoken on a call, and any recording or transcript that captures them, are in scope. Source: PCI Security Standards Council, pcisecuritystandards.org (document library, PCI DSS).
Ask the vendor:
Does the agent ever hear, record or transcribe card numbers? Is payment handled by redirecting the caller to a payment processor's own flow, so card data never reaches the agent, the recording or the transcript? Which processor is used, and what is its PCI status? Who is responsible for PCI compliance, the vendor or you?
For the practical side, read Can an AI voice agent take payments over the phone?.
3. Call recording consent
Recording laws vary. In the United States, federal law allows recording with the consent of at least one party, and some states require every party to consent. Other countries have their own rules. The FCC publishes a consumer guide on recording telephone conversations at fcc.gov (search "Recording Telephone Conversations"). Because callers can be anywhere, many businesses simply announce recording at the start of every call.
Ask the vendor:
Can the greeting include a recording notice that I control? Can I turn recording off? Is the recording notice configurable per agent or per number?
4. Retention, transcripts and deletion
Recordings and transcripts are personal data. You need to know how long they live and who can read them.
Ask the vendor:
How long are recordings and transcripts kept? Can I delete one call or all of them? Who at the vendor can access them? Are they used to train models? Where are they stored? What happens to the data when I cancel?
If you handle payments, health or legal matters, also ask whether sensitive data can be kept out of transcripts.
5. Synthetic voices and disclosure
In February 2024 the FCC ruled that calls made with AI-generated voices are "artificial" voices under the Telephone Consumer Protection Act. For outbound calls this generally means prior consent from the person called. Source: FCC, "FCC Makes AI-Generated Voices in Robocalls Illegal" (fcc.gov, February 2024). The FTC's Telemarketing Sales Rule sets further rules for sales calls, including the National Do Not Call Registry. Source: FTC, "Complying with the Telemarketing Sales Rule" (ftc.gov, business guidance).
Ask the vendor:
Does the agent tell callers it is an AI? Can I configure that disclosure? What help is there for consent and do-not-call handling on outbound campaigns? Whose voice is used, and are cloned voices allowed only with the speaker's permission?
6. Access, integrations and subprocessors
Every integration moves data. Ask which third parties see call data, how access is controlled for your team, whether there are separate user roles, and how a security incident would be communicated to you.
What you can check on InfiVoice today
We prefer to be precise. On infivoice.com you can verify these things yourself:
InfiVoice lists call recording with full transcription among its features. It supports 30+ languages and local numbers in 100+ countries. It connects to Twilio and Plivo for telephony, to Google Sheets and Google Calendar, and to Stripe and PayPal for payments. Free includes 100 credits and Pro costs $79 per month with 250 credits. One credit equals 60 seconds of call time.
This guide does not claim any certification for InfiVoice. For SOC 2, PCI, retention terms or any other compliance document, ask us in writing, as you should with every vendor, and review the answer with your own advisers before you decide.
Quick checklist to copy
Ask for the SOC 2 report and its period. Ask how card data is kept out of the agent and transcripts. Ask who controls the recording notice. Ask for retention and deletion terms in writing. Ask how AI disclosure and outbound consent are handled. Ask for the list of subprocessors. Then test with real calls.
For a broader comparison, see What to ask before choosing an AI voice agent.
FAQ
Is SOC 2 a certification?
Not exactly. It is an independent attestation report from a CPA firm. Ask for the report itself.
Does PCI DSS apply if the agent never touches card numbers?
That depends on how payment is handled. If card data never passes through the agent, recording or transcript, the scope is smaller. Confirm the flow with the processor and your advisers.
Do I have to tell callers I record?
Many places require it and it is good practice everywhere. Check the rules where your callers are.
Do I have to disclose that the caller is talking to an AI?
Rules differ by place, and outbound AI voice calls face specific consent rules in the United States. Check with counsel and keep the disclosure on by default.