We are running Genesys Cloud version 9.6.0 and facing an issue during our SOC2 compliance review. We identified that credit card numbers (PAN) appear in conversation transcripts exported via the Conversation Search API. This violates PCI-DSS requirements for long term storage. The piiMasking flag does not seem to affect the response payload when querying via JSON body. We need to ensure PAN data is masked before export.
Example query used:
{
"query": {
"filters": [{"operator": "eq", "field": "agentName", "value": "agent01"}],
"includeMaskedText": true
}
}
The pii object in the response still contains raw numbers. Has anyone seen this behavior on AWS US-East-1? We need a solution that guarantees masking at the API level for audit logs.
Have you verified the Speech Analytics PII detection policy first? Sometimes this requires enabling the feature in the organization settings before the API respects the query parameters. Training agents to avoid reading numbers helps too but that is a process change. You should check if the piiDetection toggle is active for your conversation management policy.
The masking depends on the piiDetection configuration within the Conversation Management policy. In v9.4+, you must set includeMaskedText to true in the search query payload. Example:
{
"pii": {
"maskingEnabled": true
}
}
This ensures the response body contains redacted text instead of raw values. Also verify the Speech Analytics plan supports PCI-DSS masking rules for your region.
Correction: The parameter is actually includeMaskedText at the organization level, not in the query payload for search. You need to update the Speech Analytics settings in Admin panel. The API call just retrieves what is stored. If the policy does not have masking enabled globally, the API cannot force it on export.
Check the /api/v2/analytics/conversations endpoint configuration for piiDetectionPolicyId. Make sure the correct ID maps to a rule that redacts PANs.
Tried enabling setting in Admin panel. Still seeing null values in JSON fields for payment data. Is there a specific retention policy I need to adjust for PCI-DSS compliance regarding the duration of these masked logs? We are exporting to S3 via Data Action.
Check the Data Action export configuration. You must map the maskedText field specifically. Standard exports often pull raw text unless you configure a transformation rule in the Data Action setup.
Try this payload for the transformation:
{
"transformations": [
{
"sourceField": "transcript",
"targetField": "maskedTranscript",
"operation": "maskPII"
}
]
}
If the field is null, the policy might be scoped to a specific queue that does not include your agents.