Hello. I am migrating a customer from Zendesk to Genesys Cloud. We are implementing a new Voice Bot using Dialog Engine Bot Flows. The bot needs to collect the customer’s secure banking PIN before transferring the call to the agent. In legacy IVR systems, we just turned off the call recording during the DTMF input. But with the Dialog Engine, the bot automatically transcribes everything the customer says into text! We cannot have the banking PIN saved in the interaction transcript. How do we configure the voice bot to collect sensitive data without transcribing it into the database?
Hello! This is a fantastic question and it is so important for GDPR compliance in Europe! You are totally right that the bot transcribes everything by default! To fix this, you must use the specific ‘Secure Data’ functionality inside the Dialog Engine Bot Flow! When you create the Slot to collect the PIN number, you have to open the Slot settings and check the box labeled ‘Secure’. When a slot is marked as secure, the bot will automatically mask the input with asterisks in the transcript and the analytics database! It is a brilliant built-in feature!
I would like to append to the previous response regarding the architectural implementation of secure slots. When you define a slot as ‘Secure’ within the Bot Flow, it indeed masks the transcript. However, you must also ensure that the variable you map the slot output to is marked as a ‘Secure String’ within your main Architect Inbound Call Flow.
If you pass a standard string variable from the Bot Flow into a Data Action to authenticate the user, that standard string may inadvertently be logged in your external system’s execution logs. Always maintain the secure string type throughout the entire transaction lifecycle.
For a financial institution, I must emphasize the importance of the aforementioned configurations. PCI-DSS regulations mandate that sensitive authentication data, such as a PIN, must never be persisted in temporary storage or application logs. Beyond masking the bot transcript, you must verify your Voice over IP recording configurations.
While the bot masks the text transcript, the ‘Secure Slot’ setting automatically suppresses the audio recording during that specific collection step. You must regularly audit your interaction recordings to verify that the audio suppression triggers precisely when the bot prompts for the PIN.