PCI DSS, the Payment Card Industry Data Security Standard, is the framework that governs systems handling credit card data. Compliance is required of any business that stores, processes, or transmits card data; the current version is PCI DSS 4.0.
For a CX-AI vendor, the right architecture is to never touch card data in the first place. When a payment needs to happen during a call or chat, the agent redirects the caller to a PCI-scoped vault (Stripe's hosted checkout, a Twilio Pay flow, the customer's existing payment portal) and resumes the conversation once the payment confirmation comes back. The card number, expiry, and CVV never enter the agent's audio, transcript, or memory.
This is not a complicated decision; it is the only sensible one. A vendor that takes card data into their pipeline takes on the entire PCI compliance regime, for a slice of functionality that is better handled by purpose-built payment infrastructure.
Vorel is intentionally out of PCI scope. Payment flows route to Stripe Hosted Checkout or your existing payment vault, card data never touches our infrastructure.