Secure Data Capture¶
Status: In progress | Last reviewed: 2026-08-30
Secure Data Capture lets a voice agent collect a sensitive value — a Social Security number, date of birth, medical record, policy or account number — without the AI ever hearing it. When the agent decides it is time to collect the value, it steps aside: the AI is paused, the caller types the digits on their phone keypad, and the agent comes back knowing only a masked result such as ****1935. The digits never reach the AI, the transcript, or the recording.
It is the same secure keypad flow Taking payments uses, generalized to any digit-typeable field. It is voice-only: there is no on-screen form fallback yet, so a chat agent is never offered the capability.
Turn it on¶
In the pipeline editor, open the conversational stage's inspector, press Add capability in the Capabilities section, and pick Secure Data Capture. The configuration card appears with the switch on.
Secure Data Capture also works on a speech-to-speech node. During secure entry, TrueServe temporarily mutes the realtime model: it receives silence while a fixed, non-AI voice script asks for keypad input. The same session resumes with only the masked result.
Configure it¶
Fields the agent may collect — add one row per value this agent may ask for. Five built-in types come pre-configured with a spoken label and digit rules:
| Field type | Rules |
|---|---|
| Social Security number | Exactly 9 digits. The last four may be read back. |
| Date of birth | Typed as MMDDYYYY (8 digits) and masked completely — nothing is read back, because the tail of a birth date is the year. |
| Medical record number | 4–20 digits. |
| Policy number | 4–20 digits. |
| Account number | 4–17 digits. |
| Custom field | Your own field. Give it a snake_case identifier and a spoken label — a custom field without a label is skipped at runtime, and the form warns you. |
Each row also has:
- Session variable — where the masked value is stored. Leave blank to use the field's own key. To hand the real value to a tool (a CRM lookup, an eligibility check), bind this variable in that tool's settings — that explicit binding is the only place the raw value ever comes back out.
- Advanced — override the digit-length rules, and how many trailing digits the confirmation and the masked variable may show (0–4; 0 masks completely).
Keypad capture — shared across all fields: how long to wait for digits (5–120 seconds), retries per field (0–5), which key returns the caller to the conversation if they start speaking during secure entry, and whether to confirm the (masked) value with a keypress before storing it. Hash ends an entry, star clears it, and star twice cancels.
If no usable field is configured, publishing warns and the secure-capture tool is simply not offered to the agent at runtime.
Tell the agent when to use it¶
Reference {{TOOL:collect_secure_field}} in the stage's prompt to say when to collect each field — for example, "Before discussing the claim, collect the caller's member ID using {{TOOL:collect_secure_field}}." The model only ever chooses which configured field to collect; everything else — the pause, the keypad, the validation, the masking — is the platform's.
What the agent (and everyone else) sees¶
- The AI, the transcript, and the call recording get silence while the caller types.
- The stored session variable shows only the mask (for example
****6789); prompts, rules, logs, and telemetry all see the mask too. - A tool receives the raw value only through the explicit variable binding you configure on that tool.
See also: Taking payments for the PCI variant of the same flow, and Customer Authentication for verifying who the caller is rather than collecting a value.