Is it PCI compliant to have Voksha take credit card numbers over the phone for takeout orders?

This is worth getting right because PCI DSS, the Payment Card Industry Data Security Standard, applies any time your restaurant handles cardholder data, whether a human or an AI is on the phone. The safest and most common setup with Voksha is to not have it collect full card numbers verbally at all. Instead, Voksha takes the order and total, confirms it back to the customer, and has payment collected at pickup or delivery, card on file with your POS, tap-to-pay, or cash, keeping card data out of the phone call entirely. Taking payment on the call, or texting the caller a secure payment link through your payment processor, is available on the Enterprise plan only.

If your restaurant currently has staff key in card numbers read over the phone, that's already a PCI exposure point regardless of who's answering, phone-based card capture is one of the higher-risk patterns under PCI DSS because the number gets spoken aloud and often written down before entry. Moving to a pay-at-pickup model, which works on every Voksha plan, actually reduces your restaurant's PCI scope compared to a human taking card numbers verbally and typing them into a terminal later.

Voksha is SOC 2 compliant and ISO 27001 compliant on every plan, and HIPAA (with a BAA), GDPR and CCPA compliance are available on the Enterprise plan for businesses that need them, but for most restaurants the practical security question isn't about those frameworks, it's about never having raw card numbers spoken into a phone call in the first place. That's the setup we recommend for every restaurant taking phone orders.