Adding DTMF Masking to Aircall, Genesys, Five9 & Talkdesk

Aircall is one of the easier cloud phone systems to run. The CRM integrations work, the routing rules behave, and you can onboard a new agent in an afternoon. What it doesn't do — and was never built to do — is take card payments without pulling your call recordings into PCI scope.

If you're taking payments over the phone through Aircall today, every recorded call that includes a card number is a piece of cardholder data sitting in your storage. The recording archive, the QA tool that plays it back, the transcription service that turns it into text — all of it inherits PCI obligations the moment a customer reads out their PAN. That's not an Aircall problem; it's a problem with any call recording layer that captures payment conversations without masking.

The fix is a DTMF masking layer between the customer's keypad and the audio Aircall records. Paytia is the masking service we run. Aircall users keep their existing setup and add PCI-compliant card capture without rewiring telephony. Here's how it works and what setup looks like — and if you're on Genesys Cloud, Five9, Talkdesk, NICE CXone, or another CCaaS platform, the same approach works there too. We've got a section further down covering the platform-by-platform specifics.

The PCI problem with Aircall call recordings#

Aircall records calls by default, and that's usually a feature — recordings drive coaching, dispute resolution, and quality scoring. The trouble starts when payments enter the conversation. If your agent asks a customer to read out their card number, the recording captures it. The recording sits in Aircall's storage, gets pulled into your QA workflows, downloaded into training datasets, and replayed during dispute investigations. Each of those touchpoints now handles cardholder data.

Under PCI DSS, anywhere a Primary Account Number lives is part of your cardholder data environment. The recording archive is in scope. The QA platform is in scope. Agents who can replay calls are in scope. Our broader piece on PCI compliance for telephone payments walks through the full set of requirements, but the headline is simple: a single payment call with an unmasked PAN can pull your entire Aircall estate into a SAQ D obligation.

The same problem on Genesys, Five9, Talkdesk and other CCaaS platforms#

Aircall isn't unusual here. Every cloud contact centre platform we work with has the same gap: the call recorder doesn't know what's in the audio. It just records. So whether your agents are taking payments through Genesys Cloud, Five9, Talkdesk, NICE CXone, RingCentral, 8x8, Amazon Connect, or Avaya OneCloud, the moment a customer reads out a card number on a recorded call, that recording is in PCI scope. The platform doesn't care that the audio is a card number. The QA tool doesn't care. The transcription engine actively turns it into searchable text.

What changes between platforms is the integration mechanics, not the underlying problem. Genesys Cloud and NICE CXone give you deep API hooks and Architect flows you can route through. Five9 has its own IVR studio. Talkdesk has Studio and the AppConnect marketplace. Aircall is simpler — you wire a number into call routing and you're done. The Paytia masking layer works the same way on all of them: the agent stays on the line, the customer's keypad tones go to Paytia rather than the CCaaS recorder, and the recording captures comfort tones instead of card digits.

If you're researching CCaaS DTMF masking for the first time, the short version is: any cloud contact centre that records calls and takes phone payments needs a masking layer between the customer's keypad and the recorder. The platform you're on changes the wiring diagram, not the principle. We cover the broader pattern in our DTMF masking overview and the practical buyer-side considerations in how to choose DTMF masking software.

What you need before you start#

Three things need to be in place before we touch anything. First, Aircall admin access — the integration is configured through your account's call routing layer, so you'll need someone who can edit numbers and IVR flows. Second, a payment gateway. We integrate with Stripe, Worldpay, Adyen, Braintree, and most of the major UK and European acquirers, so you can keep whatever processor you've already got. Third, a Paytia account configured against your gateway credentials — that's a 30-minute onboarding call with our team, not a procurement project.

You don't need to upgrade your Aircall plan, change phone numbers, or pause your existing flows. The integration adds a parallel path for the payment portion of a call rather than replacing anything Aircall already does well.

Want to see this working in your setup? Book a working-demo call — we'll wire up your actual phone system and show you a live capture.

How the Paytia + Aircall integration works#

The flow looks like this. An agent is on a normal Aircall call and reaches the point where a card payment is needed. They click "Secure Pay" in their Paytia console, which sits in a browser tab alongside the Aircall workspace. Paytia generates a payment session tied to the order amount, currency, and reference.

At that point, Aircall briefly bridges the customer into Paytia's DTMF capture service. The agent stays on the line throughout — they can talk to the customer, reassure them, read out the amount being charged. What changes is the audio path during the few seconds of card entry. The customer's keypad tones go to Paytia, not Aircall. Paytia plays neutral progress audio back into the Aircall leg, so the recording captures flat tones or comfort noise instead of card digits. Our deep-dive on channel separation guide covers the audio-path mechanics if you want the full technical picture.

The customer keys their card number, expiry, and CVV. Paytia validates each field in real time and shows the agent a masked progress view — typically the first four digits and the rest as dots, so they can confirm with the customer it's the right card. Paytia then tokenises the card, sends the authorisation through your existing gateway, and returns a result. Approved or declined, the answer comes back to the agent's Paytia console within seconds, and the agent can move straight into thanking the customer or handling a retry.

From Aircall's perspective, it's a normal call. The recording runs from start to finish. The CRM logs the activity. Reporting works as it always did. The only thing missing from the recording is the card data — because the card data never travelled down that path. That's what DTMF masking delivers in practice.

Setting it up step by step#

The setup is short. Most Aircall teams are taking live payments through Paytia within a working day, sometimes faster if they've got their gateway credentials handy.

Step one is gateway configuration. Inside the Paytia portal, you add your payment gateway credentials — API keys for Stripe or Adyen, merchant IDs for Worldpay, that sort of thing. Paytia handles tokenisation and the processing call to the gateway. Your acquirer relationship doesn't change.

Step two is connecting Aircall. We route the masked payment leg through a Paytia-managed number that bridges into your Aircall flow. There's no SIP trunk surgery and no Aircall plan change. If you've already used a guide like our 3CX setup walkthrough, the Aircall version follows the same pattern — connect the number, point the secure-pay action at the masked service, and you're done. Our team does this part with you on a screenshare; it's not a self-serve config the first time around.

Step three is testing in sandbox. Paytia ships with a full sandbox that mirrors live, so you can run a payment from start to finish without moving real money. You'll dial in as a test customer, the agent triggers a secure-pay session, you key a test card, and you watch the result flow back to the console. Your QA team can listen to the test recording afterwards and confirm there's no card data in the audio. A recording with no card data in it usually convinces compliance faster than a slide deck.

Step four is going live. Once you're comfortable in sandbox, we flip the same configuration to production. The Paytia console handles the environment switch — there's no separate redeploy on the Aircall side. The first live payment is normally taken with our implementation team on a call so any small wrinkles get sorted in real time.

Setting it up on Genesys Cloud#

Genesys Cloud has the most flexible routing layer of any CCaaS we plug into, which means the integration looks slightly different. The customer-facing experience is identical — agent stays on the line, customer keys their card, recording captures comfort audio — but the wiring is done in Architect rather than a simple call-flow editor.

The pattern is: build a small Architect call flow that handles the secure-pay branch. When the agent triggers a payment from the Paytia console, Genesys consults that flow, bridges the customer to Paytia's masked number, plays our prompts, and brings the customer back to the agent once the payment finishes. Genesys recording carries on through the bridge, but the audio it captures during the keying phase is the comfort audio we inject — no DTMF tones, no spoken card digits.

If your team uses Genesys Cloud Voice for telephony, the Paytia number sits as an external bridge. If you're on Genesys-provided trunks, the routing happens entirely inside Architect. Either way, no SIP trunk changes are needed. We supply the Architect flow template; your Genesys admin imports it, adjusts the queue references, and you're ready to test in sandbox. Most Genesys Cloud teams are running from start to finish inside a working week — slightly longer than Aircall because Architect needs admin review, not because the integration itself is harder.

Setting it up on Five9#

Five9's IVR studio gives us a clean route in. The Paytia secure-pay action is triggered from the agent desktop via the Five9 CTI adapter, which signals our service that a payment session is starting. Five9 then bridges the customer leg to Paytia for the keying phase and returns control once we've passed the authorisation back.

The thing to know about Five9 specifically: their recording layer is on by default for compliance reasons, and most enterprise Five9 deployments archive recordings into a long-retention store. That's exactly the architecture that benefits most from masking, because masked recordings can keep their long retention without dragging cardholder data along for the ride. Once Paytia is in place, the Five9 recording archive comes out of PCI scope and your existing retention rules carry on unchanged.

For deployments that use Five9 Intelligent Virtual Agent for self-service payment flows, Paytia can plug into the IVA's payment branch as well, so customer-driven flows get the same masking treatment as agent-assisted ones.

Setting it up on Talkdesk#

Talkdesk goes through Talkdesk Studio for the routing and the AppConnect marketplace for the agent-side actions. Paytia is configured as a payment connector inside AppConnect, so the agent triggers a secure-pay session from their normal Talkdesk Conversations workspace without switching tabs.

Talkdesk's call recording sits in its own storage tier, and like every other CCaaS, it records what's in the audio without any awareness of payment data. The Paytia integration uses Studio to route the keying phase through our masking service. Talkdesk Voice continues to record the call; what reaches the recorder during the masked window is comfort audio.

If your Talkdesk setup uses the Talkdesk QM (quality management) or Talkdesk Interaction Analytics products, those tools depend on call recordings as their input. Masking keeps the recordings audible and intact — QM still scores agent behaviour, analytics still extract sentiment and topics — but removes the card data from the audio they're working with. That's the combination compliance teams usually want: real recordings for everything except the few seconds of card entry.

NICE CXone, RingCentral, 8x8 and Amazon Connect#

The same pattern holds across the rest of the CCaaS landscape we work with. NICE CXone uses Studio scripts for routing and the open-channel API for agent-side integration. RingCentral Contact Centre exposes its routing through SmartRoute and CTI hooks similar to Five9. 8x8 Contact Centre uses its own IVR scripting layer. Amazon Connect uses Contact Flows for routing and the Streams API for agent-desktop integration.

In every case the Paytia integration follows the same logic: the agent stays on the line, the customer's card-entry audio is diverted from the platform's recorder to Paytia, and the recording captures comfort audio for the few seconds of keying. The platform-specific work is matching that pattern to the platform's routing tools — Contact Flows on Amazon Connect, Studio scripts on NICE CXone, SmartRoute on RingCentral, IVR scripts on 8x8. None of these platforms need you to change phone numbers, swap SIP trunks, or run a separate payment-only call queue.

If you're on a CCaaS we haven't named here, the rule of thumb is: if the platform supports external transfer or bridge to a third-party number, and lets you trigger that bridge from the agent desktop, Paytia will integrate. We've yet to find a mainstream cloud contact centre platform where that's not the case.

What stays the same in Aircall#

This is the part that matters to operations teams. Agent workflow doesn't change. They still answer in Aircall, see the customer's CRM card pop, and wrap up in the same screen. The only new step is clicking "Secure Pay" when a payment is due — most teams pick that up in a single training session.

Routing rules stay where they are. IVR menus, business-hours flows, voicemail behaviour, ring groups — none of it needs reworking. CRM integrations carry on as before, so your payment activity still surfaces in HubSpot, Salesforce, Zoho, or whichever system you've connected. Aircall reporting still measures call volumes, talk time, and outcomes. Recordings still run for the full call.

What changes after integration#

The big shift is PCI scope. Once card data stops landing in Aircall recordings, the recording archive comes out of your cardholder data environment. So do the QA platform, the transcription pipeline, the analytics tools that read call metadata, and the agent workstations themselves. The systems that touch cardholder data narrow to the Paytia integration layer plus your gateway.

Recordings stay full-length. No pause-and-resume, no audio gap, no risk of an agent forgetting to hit pause. Compliance becomes a vendor management exercise — reviewing Paytia's Attestation of Compliance once a year — rather than an operational one. For most Aircall users we work with, that's the difference between an SAQ D and an SAQ A, which is a roughly tenfold reduction in annual compliance workload.

How CCaaS pricing changes after masking#

One thing CCaaS buyers often miss when costing a masking project: the platform-side savings. CCaaS vendors charge per recording storage in many enterprise contracts, and the storage tier for PCI-in-scope recordings is usually more expensive than the equivalent non-PCI tier. Genesys, Five9 and NICE CXone all have separate compliance-grade archives with audit logging and tighter access controls — they cost more per minute of recording stored.

Once your recordings are out of PCI scope, you can move them to the cheaper archive tier. For a 200-seat contact centre we worked with last year, that storage shift on its own paid for the Paytia subscription. Talk to your CCaaS account manager about it before renewal — it's a line in the contract that often gets overlooked. We cover this in more depth alongside the agent-productivity angle in our channel separation guide piece.

What about Aircall AI and CCaaS analytics tools?#

Aircall has been adding AI features — call summaries, conversation intelligence, automatic CRM logging. Genesys, Five9, Talkdesk and NICE all have heavier conversation analytics products. These tools work by reading transcripts of call recordings. If the recording contains a card number, the transcript contains a card number — and now your AI vendor is in PCI scope too.

Masking solves that cleanly. The recording the AI sees has no card data in it, because no card data ever entered the audio path the recorder taps. Your call summaries, sentiment scores, agent-coaching reports, and topic-extraction flows all keep working — they just stop ingesting cardholder data along the way. For anyone planning to scale conversation AI across a contact centre that takes payments, masking first, AI second is the sequencing that keeps your scope flat.

Frequently asked questions#

Does Paytia require an Aircall paid plan upgrade?

No. The integration works with any Aircall plan that supports outbound and inbound calls. You don't need a higher tier, custom routing add-ons, or the developer API. We've onboarded teams on the entry-level Aircall plan and on the enterprise tier with no difference in setup.

Can we keep our existing payment gateway?

Yes — that's the usual setup. Paytia integrates with Stripe, Worldpay, Adyen, Braintree, Opayo, and most major UK and European acquirers. Your gateway relationship, pricing, settlement terms, and fraud rules stay exactly as they are. Paytia sits in front of the gateway as the secure capture layer, not as a replacement processor.

Does it work with Aircall's CRM integrations (HubSpot, Salesforce, Zoho)?

Yes. Aircall's CRM integrations log the call activity as normal, and Paytia's own integrations write the payment outcome back into the same CRM record. So you end up with the call note and the payment result on the same contact, without duplicate data entry. We've got direct hooks into HubSpot, Salesforce, and Zoho, and a generic webhook for anything else.

Does Paytia integrate with Genesys Cloud?

Yes. We integrate via an Architect call flow that you import into your Genesys org, plus an agent-side action that triggers secure-pay sessions from the Genesys desktop. Genesys recording, QM, and analytics all carry on as normal — the masked audio just doesn't contain card data. Setup typically runs five to seven business days because Architect changes need internal review on the customer side.

Does Paytia integrate with Five9?

Yes. The Five9 integration uses the CTI adapter to trigger payment sessions from the agent desktop and the Five9 IVR studio to route the masked leg. Five9 Intelligent Virtual Agent can also call Paytia for self-service payment flows. Setup is similar to Aircall — most teams are taking live payments within a week.

Does Paytia integrate with Talkdesk?

Yes. Paytia ships as a connector in Talkdesk AppConnect, so the agent triggers secure-pay from Talkdesk Conversations without leaving the workspace. Talkdesk Studio handles the routing of the masked leg. Talkdesk QM and Interaction Analytics continue working against the recordings, which are now clean of cardholder data.

What about NICE CXone, RingCentral, 8x8 or Amazon Connect?

We integrate with all of them using each platform's native routing tools — Studio scripts on NICE CXone, SmartRoute on RingCentral, the IVR scripting layer on 8x8, and Contact Flows on Amazon Connect. The customer experience is identical across platforms; the wiring on the admin side differs. If you're on one of these and looking at a masking project, get in touch and we'll talk through the platform-specific bits.

What's the typical setup time?

From signed contract to first live payment, most Aircall teams are running in two to five business days. CCaaS platforms with more configuration overhead (Genesys, NICE CXone) typically run five to ten business days because admin teams need time to review the routing changes. The bulk of the timeline is your internal scheduling — agent training, finance sign-off, picking a go-live window. The technical setup itself runs in a couple of hours on a screenshare with our implementation team.

How is pricing structured?

Paytia pricing is built around your volume and the gateways you use, so it's quoted per customer rather than from a public price list. There's a small monthly platform fee plus a per-transaction charge for the masking and capture service. Your gateway fees are unchanged. Get in touch and we'll give you a number based on your actual call and payment volumes.

Will masking break our conversation AI or QA tools?

No. The recording still runs for the full call — what changes is what's in the audio during the few seconds of card entry. QA scoring, conversation intelligence, transcription, sentiment analysis, agent coaching reports — they all keep working on the masked recordings. They just stop ingesting cardholder data along with the rest of the call audio.

Aircall suits teams that want a cloud phone system without running their own telephony stack. Adding Paytia DTMF masking keeps the parts of Aircall you rely on and removes the one part that's bloating your PCI scope. The same logic applies whether you're on Genesys Cloud, Five9, Talkdesk, NICE CXone, RingCentral, 8x8, Amazon Connect, or any of the other cloud contact centre platforms — masking is the bit that takes the recording archive out of scope without taking the recording away. If you're taking payments through a CCaaS without a masking layer today, the scope reduction usually pays for the integration inside a year.

If you'd like to see the integration on a real call rather than a slide deck, book a demo and we'll walk through it with one of our customers' setups on whichever platform you're running. Or if you'd rather start with a conversation about your specific call flow and gateway, get in touch and we'll work through it with you.

Related reading#

• Pillar guide: channel separation guide
• How to Choose DTMF Masking Software: A Practical Checklist
• DTMF Masking vs Pause-and-Resume: Which Should You Use?
• Is DTMF Masking PCI Compliant? The Real Picture
• What Is DTMF? A Plain-English Guide to Phone Tones

Want to see this working in your setup? Book a working-demo call — we'll wire up your actual phone system and show you a live capture.