DTMF Masking: How Secure Phone Payments Actually Work

What is DTMF masking?

DTMF masking is a security technique that intercepts the keypad tones a customer generates when entering card details on a phone call. The tones are replaced with flat audio the agent can't decode, and the actual digits are sent directly to a PCI-certified payment processor, so card data never touches your contact centre.

Every time a customer enters their card details on a phone call, there's a fork in the road. Either your agent hears the numbers and the call recording captures them — dragging your entire contact centre into PCI DSS scope — or you do something about it. DTMF masking is what most serious payment processors do about it. It intercepts the tones generated by the customer's keypad, replaces them with flat audio the agent can't decode, and routes the actual digits directly to a PCI-certified payment processor.

We've been building this since 2014. We've deployed it for insurance call centres processing millions of pounds a month (including MOTO flows — see our MOTO payments primer), retail customer service teams handling refunds, housing associations taking rent, and charities running donation lines. Along the way we've learned exactly where DTMF masking wins, where it loses, and how it compares to the alternatives your auditor might also be suggesting — pause-and-resume, channel separation, conference pay. We've also written a side-by-side on channel separation vs DTMF suppression vs conference pay. If you're researching the wider picture we've also written practical walkthroughs on accepting card payments over the phone and the specific UK regulations for taking card payments by phone.

This guide covers all of it. How the technology actually works. The PCI DSS rules it solves for. Real numbers from customers who've deployed it. What implementation looks like. And — because every other guide skips this bit — what DTMF masking doesn't cover.

What DTMF masking actually is

DTMF stands for Dual-Tone Multi-Frequency. It's the signalling system your phone has used to dial numbers since the 1960s, when Bell Labs replaced rotary dials with push-button keypads. Press "5" on your keypad and your phone plays two audio tones at once — one from a "low" group of frequencies and one from a "high" group. The pair is unique to that key. The network decodes it as the digit 5 and routes your call.

The system was designed for reliability, not secrecy. Every digit produces a predictable, decodable pair of frequencies. If you can hear the tones, you can work out the digit. Anyone with basic audio software — or just a trained ear — can reconstruct a card number from a recording that captured the keypress tones during entry. You don't need to be a hacker. You need a laptop.

That's the problem DTMF masking solves. Instead of letting the tones travel through the audio stream to the agent's headset and into the call recording, the masking system intercepts them before they get there. The actual DTMF tone is captured, decoded into its digit value, and sent directly to the payment processor through an encrypted channel. The audio that reaches the agent gets a replacement tone — a flat, uniform sound that tells them the customer is entering a digit but carries none of the frequency information needed to identify which digit.

It's worth being precise here because people confuse it with other things. DTMF masking is not the same as muting the call. Muting cuts the audio entirely — the customer can't speak to the agent, and the agent has no idea whether the customer is entering anything at all. Masking keeps the conversation open. The customer can still ask "which card should I use?" and the agent can still answer. It's only the DTMF tones themselves that get replaced.

It's also not the same as screen-recording protection. If your agents work in a setup where they can see or type card numbers into a form, DTMF masking won't save you — the data is flowing through a different channel. DTMF masking handles the keypad entry path specifically. For full coverage you usually want DTMF masking and a policy (or technical control) that stops agents ever seeing card data on screen.

One last thing people miss: DTMF masking is most effective when it's applied at the network layer, not the endpoint. Doing the masking on the agent's computer means you trust every workstation, every headset driver, every local process. Doing it in the network means the card data never touches your side of the call at all. That's the model we run. It's also the model your QSA will find easier to sign off.

How does DTMF masking work?

1. The customer calls your contact centre and speaks to an agent as normal.
2. When it's time to pay, the agent triggers the secure payment step from their interface.
3. The customer types their card number on their own phone keypad.
4. The DTMF masking platform intercepts each tone at the network layer before it reaches the agent.
5. The agent hears a flat replacement tone for every keypress — enough to follow along, not enough to decode a digit.
6. The actual digits are decoded and sent straight to a PCI-certified payment processor over an encrypted channel.
7. The authorisation result is returned, the agent confirms it with the customer, and the call continues.

The compliance trap nobody warned you about

Here's the bit most contact centres learn the hard way. PCI DSS doesn't care whether you intended to store card data. It cares whether your systems could have. If an agent can hear a card number, your telephony is in scope. If a call recorder captures the keypress tones, your recording platform is in scope. If those recordings sit in a cloud storage bucket, that bucket is in scope. The blast radius spreads as far as the card data could have travelled.

That matters because PCI DSS compliance isn't cheap. A full SAQ D self-assessment is 329 questions. It covers everything from network segmentation and vulnerability scans to key management, access control, and tokenisation. For a contact centre of any size, it typically costs tens of thousands of pounds a year to maintain — quarterly ASV scans, annual penetration tests, staff training, documented procedures, audit evidence, remediation cycles, and the QSA's time.

And that's if you're compliant. If you're not, and there's a breach, the numbers get worse fast. The Payment Card Industry Security Standards Council can levy fines of $5,000 to $100,000 per month for non-compliance. Card networks (Visa, Mastercard) can add their own penalties on top. Then there are the regulatory costs: the ICO can fine UK businesses up to £17.5 million or 4% of global turnover under UK GDPR for a breach involving personal data. That's before you count forensic investigation fees, legal costs, customer notification, card reissuance, and reputational damage. Contact centres that experienced a breach in 2024 reported average total recovery costs north of £3 million.

Most contact centre managers know all of this in the abstract. What they don't always realise is how little it takes to put themselves in scope. If a single agent can hear a card number once — even from a single customer on a single call — your recording system is in scope for every recording you've stored. Because PCI DSS auditors don't assess what you typically do, they assess what's technically possible. Technical possibility is the standard.

A lot of teams try to solve this by telling agents not to let customers read their card number aloud. Others set up complicated processes — "pause the recording, then resume it, then confirm the customer has finished." We'll cover those approaches later on, but the short version is: if the solution relies on an agent doing something manually every time, it fails under audit because humans forget, get distracted, or improvise. PCI DSS auditors know this. They're not going to accept a process that depends on everyone being perfect every time.

DTMF masking takes the problem off the agent's plate entirely. The card data is never in a place where a human could fail to protect it. That's the bit that matters for scope reduction — not the specific technology, but the fact that it removes the human from the data flow.

How DTMF masking actually works

Here's the sequence, step by step, with no hand-waving. A customer calls your contact centre to pay. Your agent answers, confirms their order, and reaches the payment step. At this point, the agent clicks a button in their interface — or Paytia's platform detects the payment stage automatically — and the secure payment session begins.

From this moment, three things happen at once. First, Paytia's platform inserts itself into the audio path between the customer and the agent. Second, the platform plays a short audio prompt to the customer: "Please enter your card number followed by the hash key." Third, the platform starts listening for DTMF tones from the customer's side of the call.

When the customer types their card number on their phone keypad, each key press generates its DTMF tone as normal. But those tones don't travel through to the agent's headset. The platform intercepts them in real time, decodes each one into its digit value, and holds the digits in encrypted memory. The audio that reaches the agent during this period is a flat replacement tone — the same neutral sound, repeated, giving no indication of which digit was pressed.

What are DTMF tones?

DTMF stands for dual-tone multi-frequency. It's the audio signalling system your phone uses to tell the network which button you just pressed. Bell Labs invented it in the 1960s as the replacement for rotary dialling, and it's been the standard for keypad signalling on every fixed line and mobile phone since. When you press a digit, your handset plays two sine-wave tones at the same time — one from a "low" group of frequencies (697, 770, 852, or 941 Hz) and one from a "high" group (1209, 1336, 1477, or 1633 Hz). Each key on the keypad maps to a unique low/high pair, and the network decodes the pair back into the digit you pressed.

Here's the short version of the mapping. The digit 1 is 697 Hz plus 1209 Hz. The digit 5 is 770 Hz plus 1336 Hz. The digit 9 is 852 Hz plus 1477 Hz. Every key from 0-9, plus * and #, has its own deterministic pair. Because the frequencies are fixed and public, anyone with basic audio software — Audacity, a spectrum analyser, even a trained ear — can reverse-engineer a sequence of digits from a clean recording of the tones. This is not a theoretical attack. It's a ten-minute lunch break with a laptop.

That's why DTMF masking matters. The tones were designed for reliability and interoperability, not secrecy. The system assumes the signalling channel is trusted. When a contact centre records a call, every key the customer pressed during payment is sitting in the audio file as a decodable pair of frequencies. Our masking platform intercepts those tones at the network layer before they reach the agent's headset or the recording system, so the audio that gets stored has none of the frequency information needed to reconstruct a card number.

Crucially, the voice channel stays open throughout. If the customer says "hang on, I need to find my card" or "which card would you prefer, debit or credit?", the agent hears that. They can respond, reassure, help. It's just the DTMF signals that are suppressed. Everything else — the conversation, the context, the rapport — keeps running.

Once the customer has entered their full card number, expiry, and CVV, Paytia's platform hands the captured digits directly to your payment processor over a PCI DSS Level 1 certified channel. The processor attempts the authorisation. If it succeeds, Paytia tells the agent "payment successful" and provides a transaction reference. If it fails, the platform tells the agent "payment declined" so they can try a different card. At no point does the raw card number, expiry, or CVV touch your systems, your agent's screen, your call recording, or your agent's ears.

A few technical details worth knowing. First, Paytia's masking happens at the network layer, not on the agent's device. That means it works regardless of what softphone your agents use, what operating system they're on, or what headset is plugged in. Second, the platform is stateless with respect to card data — we don't store digits after the transaction clears. Third, the replacement tone the agent hears is explicitly designed not to interfere with voice codecs or call quality metrics. Your call recording keeps working normally, with a clean audio stream throughout. No gaps, no drop-outs, no awkward silence that auditors will later question.

DTMF masking vs the alternatives

Your auditor probably isn't going to mandate DTMF masking specifically. PCI DSS is technology-neutral — it tells you what outcomes are required, not how to achieve them. There are three other approaches to the same problem, and you'll hear about all of them from different vendors. Here's an honest comparison.

Pause-and-resume

Pause-and-resume is the oldest approach and the one we'd most like you to stop using. The idea is simple: when the customer is about to read their card details aloud, the agent manually pauses the call recording. The customer reads the number, the agent types it into a payment form, and the agent then resumes the recording.

The problem is that it only solves one part of the problem — the recording — and it relies entirely on the agent doing the right thing every single time. Your agent still hears the card number. Your agent's workstation is still a point of exposure. Your agent could write it down, remember it, share it with a colleague, or get social-engineered into reading it back. None of that is addressed by pausing a recording. PCI DSS is concerned with protecting cardholder data across your entire environment, not just the audio file.

There are practical problems too. Agents forget to pause. Agents forget to resume. The QSA wants to see evidence that every pause happened at the right moment, and call recording metadata often can't give you a clean answer. Recordings with missing segments are harder to use for training and dispute resolution. Handle times go up because the process adds friction. We don't offer pause-and-resume at Paytia — we don't think it adequately protects customers, and we don't think it holds up under audit.

Channel separation

Channel separation takes a different approach: during payment entry, the audio path between the customer and the agent is disconnected entirely. The system plays instructions to each party separately — the customer hears "please enter your card number", the agent hears hold music and progress messages. Card details go straight from the customer's keypad to the payment processor, and nothing about them reaches the agent at all.

Channel separation's biggest strength is that it removes the possibility of social engineering during payment. The agent can't accidentally or deliberately ask the customer to read their card aloud, because the audio path isn't connected. Call recordings come out clean — no gaps, because hold music plays throughout. It's the approach we'd recommend for any contact centre operating across multiple sites, because the process is identical regardless of which agent or office takes the call.

The trade-off is that the customer loses the ability to ask the agent questions during payment entry. For most calls that's fine — the customer has already confirmed what they're paying for and just needs to enter their details. For calls where the customer is uncertain or needs hand-holding, channel separation can feel colder than DTMF masking. We offer channel separation alongside DTMF masking for exactly this reason: different contact centres need different trade-offs.

Conference-pay / third-party IVR

A third option is to route the call out to a separate IVR system during payment. The agent conferences the customer into a secure IVR, the customer types their details into the IVR, and then the agent is brought back into the call when payment completes. It works, and the card data stays out of your systems, but customers generally hate it — the experience is clunky, the handoff feels awkward, and the switch to "the machine" often makes people abandon the transaction. It also creates integration complexity because you now have two voice systems to maintain.

Quick comparison

Our honest take: DTMF masking wins when you want your agents staying on the line and talking to customers throughout payment. Channel separation wins when you're after maximum security and don't mind the slightly colder customer experience. Pause-and-resume doesn't win anywhere. Conference-pay IVR wins only if you've already got a compatible IVR platform and don't mind the integration overhead.

What DTMF masking does to your PCI DSS scope

The whole point of any of these approaches — from the contact centre manager's perspective — is getting out of PCI DSS scope. When card data never enters your systems, your PCI obligations collapse from "massive" to "manageable". Here's what that looks like in practice.

Without any card data protection in place, a contact centre handling phone payments qualifies for SAQ D. That's the full Self-Assessment Questionnaire: 329 controls covering network security, access management, encryption, vulnerability management, logging, monitoring, and more. It's designed for organisations that store, process, or transmit large volumes of card data, and it's the most time-consuming tier to maintain.

With DTMF masking properly implemented, you typically qualify for SAQ A instead. SAQ A is 22 controls. Same standard, dramatically smaller surface area. You're attesting that you've outsourced all cardholder data handling to a PCI DSS Level 1 provider (Paytia, in this case) and that your own systems never touch card data. That's a scope reduction of roughly 95% in terms of requirement count — and the 22 controls that remain are mostly about secure links to the third party, which are straightforward to document.

The cost savings are significant. Insurance customers we've worked with typically report 75% reductions in ongoing PCI compliance spend after switching — that's staff time, QSA fees, penetration testing, and training costs combined. One insurer, Insure and Go, achieved full PCI compliance scope reduction across all agent locations while enabling hybrid working. Another, All Clear Travel, cut payment processing costs by 45% during off-peak periods through usage-based licensing.

PCI DSS 4.0 makes this more urgent, not less

PCI DSS 4.0 became mandatory in March 2025, replacing the older 3.2.1 standard. For contact centres, the relevant changes tighten the expectations around scoping. Under 4.0, you have to actively demonstrate that the systems in your environment are out of scope, not just assume they are. If your phone system sits in the same VLAN as anything that handles card data — or could, in theory — the whole thing goes in scope.

DTMF masking remains the cleanest answer to this. Because the card data is handled by Paytia's infrastructure and never touches your environment, your phone system sits cleanly on the "out of scope" side of the line. You can demonstrate it to your QSA with a network diagram and an attestation from us. You don't have to audit controls on a system that never handles regulated data in the first place.

PCI DSS 4.0 also introduced new requirements around authentication, password policies, and encryption. Those apply to the systems you do have in scope, so the fewer systems you have in scope, the fewer places you have to meet the new controls. That's where scope reduction compounds: less scope means less audit work, less training, less remediation, less disruption when the next version of the standard comes out.

What customers actually get from it

Compliance is the reason contact centres start looking at phone payment security. But the outcomes our customers care about — once they've deployed — aren't usually expressed in audit language. They're expressed in handle time, conversion rates, and hours of staff time recovered per week. Here's what the numbers look like from real deployments.

Warby Parker: 35% reduction in call handling time

When eyewear retailer Warby Parker deployed Paytia for phone-order card capture, the goal was PCI compliance. The side effect was that average call handling times dropped by 35% — because their customer service reps didn't need to go through the pause-resume-dictate-type-confirm cycle anymore. Customers entered their own details via keypad. The agent stayed on the line, helped if needed, and confirmed payment. The call finished faster, the customer got a smoother experience, and the agent got through more calls per shift.

Total Tiles: 80% increase in daily orders

Total Tiles, a UK tile retailer, saw their daily order throughput jump from 25-30 orders per day to 45-50 within the first week of switching to Paytia's phone payments. That's an 80% lift. The reason wasn't the payment technology itself — it was that the old "pause the recording, read the number, type it in, hang up, call back if the card declines" workflow had been the bottleneck on their whole order process. Once that friction disappeared, the team could handle a much bigger volume without hiring more staff.

Insure and Go and All Clear Travel: 75% PCI scope reduction

Both Insure and Go and All Clear Travel are travel insurance specialists with large phone-sales operations. Both reported 75% reductions in PCI DSS scope after deploying Paytia. For All Clear specifically, that translated to 45% lower payment processing costs during off-peak periods, because their flexible licensing model charges per active seat rather than per seat overall. During quiet periods, they simply need fewer seats under the compliance umbrella.

Enjoy Fitness: 15 hours per week of admin recovered

Enjoy Fitness is a chain of gyms. Before Paytia, their staff spent roughly 15 hours per week on payment admin — chasing failed direct debits, re-taking card details over the phone, manually reconciling receipts. After Paytia, that dropped to close to zero. Payment tracking became automatic. The recovered staff time went into member retention activities like welcome calls and follow-ups.

Pinnacle Group: housing management transformed

Pinnacle Group manages residential properties across the UK. Their phone payment line handles rent, service charges, and ad-hoc requests. After switching to Paytia, they report faster collection cycles, less invoice chasing, and happier tenants. "Apartment owners now have more choice in how they pay," their operations team noted. "Collection operations are more efficient, and customer security and the Pinnacle brand have been protected throughout."

Those numbers aren't the ceiling — they're the floor. We see similar patterns across customers in retail, insurance, healthcare, housing, and charity. The consistent thread is that removing the "read your card out loud" moment from the call speeds everything up, lowers error rates, and takes a huge compliance weight off operations. DTMF masking is the technology. Faster calls and smaller audit scope are the outcomes.

Implementing DTMF masking: what it takes

The honest answer to "how hard is it to roll out?" depends on your telephony setup. For most contact centres we deploy to, the timeline is one day to one week from kickoff to first live transaction. For more complex integrations — multi-site, multi-country, custom CRMs, on-prem PBX — it can take two to four weeks. We've never had one take longer than six weeks.

Here's what's actually involved. First, we need to understand your call flow. Where do customers come in? How are calls routed? Which of your teams take payments? What PBX or softphone are you using? We run through this in a 30-minute discovery call with your operations lead. No NDAs, no procurement cycles — we just need to know what we're integrating with.

Second, we provision the Paytia masking layer for your account. This is a server-side configuration, not something your agents install. We configure the audio routing, the payment processor integration (Paytia works with most major gateways and acquirers), and the agent interface. You don't need to change how your agents work — the payment trigger sits in their existing interface.

Third, we run a parallel test. For a day or two, we route test calls through the new masking layer alongside your existing setup. Your QA team can listen to the recordings, check the call quality is unchanged, and confirm the masking is working as expected. Once you're happy, we flip traffic over. The flip itself takes seconds.

Fourth — and this is the bit most customers forget until they're on their first audit — we provide the attestation documentation. You'll need a signed Attestation of Compliance (AoC) from Paytia confirming that we're PCI DSS Level 1 certified and that your card data is being handled by our certified infrastructure. We issue this automatically and keep it up to date. It's what lets you drop from SAQ D to SAQ A on your own self-assessment.

What you need to have ready

Not much, honestly. A working contact centre with voice calling. A payment gateway account (Paytia integrates with most — Stripe, Worldpay, Adyen, NatWest Tyl, Ryft, and others). A nominated technical contact for the integration call. That's it. We don't need access to your customer data. We don't need your CRM credentials. We don't need to install anything on your agents' machines.

What DTMF masking does NOT cover

Here's where I'm going to be more honest than most of the blog posts you'll read on this topic. DTMF masking is a specific control that solves a specific problem. It does not solve every problem in your contact centre's PCI scope. Here's what it doesn't do:

Screen recording. If you run any kind of screen-recording software for agent monitoring, training, or dispute resolution, that software sees whatever the agent sees. DTMF masking doesn't touch that layer. If an agent can see card numbers on screen — even for a second, even if they don't enter them — that's a separate compliance issue. You either need to stop agents seeing card data on screen at all (which, with Paytia, they won't), or you need separate screen-recording controls.

Social engineering. An agent could, in theory, ask a customer to read their card number aloud and type it in themselves, bypassing the masking. We've seen it happen when an agent gets frustrated or decides they're "being helpful". DTMF masking removes the technical ability to reconstruct a card number from the audio, but it doesn't remove the human ability to ask for one. Regular agent training matters, and so does a culture that rewards agents for protecting customer data rather than for call speed alone.

Physical security. If an agent types a card number from a physical document sitting on their desk, or writes one down on a notepad, that's a physical control issue. DTMF masking protects the audio channel. It doesn't protect your desk drawers. Clean desk policies still matter.

Other channels. DTMF masking handles phone calls. It doesn't handle email, chat, SMS, web forms, mail-order cards, or walk-in payments. If your contact centre takes payments across multiple channels, each channel needs its own appropriate control. We offer solutions for web (checkout), SMS (payment links), and chat (web chat payments) — but they're separate products solving separate problems, not variations on DTMF masking.

Being honest about all of this is how we end up on the shortlist for serious contact centre buyers. If someone promises you that a single product eliminates your entire PCI DSS scope forever, be suspicious. Good compliance is a stack of controls, not a single silver bullet.

Common questions we get asked

Does DTMF masking work with my existing phone system?

Almost certainly yes. We work with most major PBX platforms, softphones, and cloud contact centre suites. If you're on 3CX, Aircall, ContactOne, Avaya, Cisco, Genesys, Talkdesk, Amazon Connect, or anything SIP-based, integration is typically straightforward. If you've got something unusual, we'll check on the discovery call and tell you honestly whether it's going to be easy or hard.

Does the customer need to download anything?

No. The customer uses their regular phone — mobile or landline, doesn't matter — and enters their details on the keypad they've always used. There's nothing to install, no app to open, no website to visit.

How does it compare on cost to pause-and-resume?

It depends on your volume, but for most contact centres handling more than a few hundred phone payments per month, DTMF masking ends up cheaper once you factor in the hidden costs of pause-and-resume. Those hidden costs include: agent training time, the audit overhead of proving pause discipline, the failed-pause incidents that need remediation, and — increasingly — the penetration testing costs of keeping a larger in-scope estate.

What happens if Paytia's system has an outage?

Our platform is built with redundant infrastructure across multiple regions (lhr1 in London, iad1 in Washington), and we monitor availability 24/7. If we do have an incident, the fallback is that the payment flow fails cleanly — the customer is told payment didn't go through and can try again later. What doesn't happen is your call dropping, or the customer's card details leaking into the audio by accident. We'd rather fail a payment than fail a compliance boundary.

Is DTMF masking suitable for MOTO payments?

Yes. MOTO (Mail Order / Telephone Order) is where DTMF masking earns its keep, because it's specifically for phone-based card-not-present transactions. Any MOTO payment setup that currently relies on the agent hearing and typing card details is a candidate for DTMF masking or channel separation.

What about recurring or tokenised payments?

DTMF masking captures the card the first time. Paytia's platform then tokenises the card on capture, returning a token to your system that you can use for future charges without ever seeing the card again. Recurring billing, account-on-file, automatic retries — all handled by the token. You never need to re-capture the card unless it expires.

Can I try it before signing a contract?

Yes. We offer a product tour and a trial setup. Most customers want to see it working on their own telephony before committing, and that's fine — we run a controlled trial with real test transactions, no commitment, and if it doesn't fit your setup, you walk away with no obligation. Book a demo through our product tour, or — if you're weighing browser-based flows as an alternative — read up on the hosted payment page pattern.

Does it affect call quality?

No, and this is one of the things QA teams test first. The masking tone is designed to sit within normal voice codec parameters — it doesn't trigger noise-suppression algorithms, doesn't confuse call recording software, and doesn't degrade the voice channel for either party. Customers don't notice anything different from a regular call. Neither do your agents, other than the flat replacement tone during card entry.

What about GDPR?

DTMF masking indirectly helps with UK GDPR compliance because card data qualifies as personal data under the regulation. Not capturing card numbers at all means you're not processing that personal data in the first place, which simplifies your data protection impact assessment and your retention policies. You still need to handle other personal data (names, addresses, contact details) correctly — DTMF masking doesn't make your whole GDPR problem disappear, but it takes a significant chunk of it off the table.

Getting started

If you're a contact centre manager reading this and thinking "we're probably out of compliance and I've been putting this off", you're not alone. Most contact centres we start working with have been quietly worrying about this for months — sometimes years — before they pick up the phone to us. The compliance question doesn't tend to go away on its own, and every month that passes is another month of quietly accumulating audit exposure.

The fix isn't complicated. Book a discovery call, we'll look at your setup, we'll tell you honestly whether DTMF masking, channel separation, or a combination of both is the right approach for you. Implementation takes days to weeks, not months. And once it's running, the compliance work gets dramatically smaller — usually around 75% smaller, based on the numbers our customers report. Healthcare teams tend to ask us about the overlap with HIPAA — we cover that specifically in HIPAA vs PCI DSS.

We don't do hard sales pitches and we won't chase you. If it's a fit, we'll say so. If it isn't, we'll tell you what else to consider. Book a product tour or get in touch whenever you're ready.