Why redaction is important for your contact center and how is it done?

‍

That challenge has only grown as more of the contact center moves beyond human agents. Contact center compliance monitoring software now has to redact sensitive data everywhere a conversation happens, including interactions handled by VoiceAI Agents and ChatAI Agents, not just calls recorded by human agents. Purpose-built AI Agents introduce new conversation surfaces, and every one of them needs the same redaction rigor.

According to the Post Pandemic Contact Center report, 76% of contact center leaders believe that compliance is the biggest challenge of remote work in 2021.

Contact centers deal with a deluge of customer information on a daily basis. These interactions are recorded, transcribed and stored. A substantial part of the recorded information is sensitive such as a client’s credit card details, address, social security number, and others. As a result, putting in proper compliance workflows to mask this information before storing it in your internal repository is absolutely essential.

What is Redaction?

Redaction is  the process of censoring sensitive information from audio recordings and transcripts to prevent fraud.

The main objective of redaction is to prevent unauthorised access and minimise any chances of a data security breach leading to fraudulent transactions or misuse of information.

Why is redaction important?

The most common use cases of contact centers for using sensitive information such as name, address, social security numbers, birthdays, assets and property, is for either customer verification or financial transactions. 

This information, if accessed by unauthorised people, could be susceptible to misuse. Being unable to effectively protect client information is a compliance breach and almost always leads to financial lawsuits, imposing of penalties, and loss of brand reputation.

These legislations and penalties for data protection vary from country to country and so do the penalties. In a world driven by data, there is very little room for compromise when it comes to data security. Compliance, data security, and fraud prevention, are therefore the top-most concerns for contact centers, making redaction absolutely essential to workflows.

Compliance

In 2004, the world’s then largest credit card companies collaborated to create a set of security regulations to protect personal information of customers during a transaction. These regulations, called PCI DSS (Payment Card Industry Data Security Standard) compliance, are necessary for any contact centers handling financial transactions.

Other compliance standards to protect data privacy are GDPR (General Data Protection Regulation) (General Conditions for imposing administrative fines) in the European Union and Freedom of Information Act (FOIA) in the US of A. Besides, more local legislations such as California Consumer Protection Act (CCPA) also have important clauses emphasising data protection via  redaction.

To put things in perspective, non-adherence with GDPR is a punishable offence with a fine of up to  $25M. Similarly, violation of CCPA can lead to a  fine of up to $750 per consumer depending on the scale of damage.

Redaction must therefore be in line with both local as well as global compliance standards.

Data Security and Fraud Prevention

$161 is the average per-record cost of a data breach, including PCI/PII or sensitive data (source).

Contact centers dealing with sensitive data everyday automatically increases their vulnerability to data fraud. In case of unauthorized access, one data breach can branch off into banking and financial fraud, hacking and denial of access attacks, etc.

Complete censorship of critical information is the only way to prevent such serious attacks and safeguard the wealth of client information.

Information to be redacted: PII and PCI

So, what is the exact information that needs to be protected and how do we identify it? 

Personal Identifiable Information (PII) and Payment Card Information (PCI) are two categories of information that must be handled carefully and censored effectively.

• PII: Information used for identity verification such as name, age, date of birth, driver’s license number, Social Security Number (SSN), biometric records, email ID, and birthday, fall under PII.
• PCI DSS:  A cardholder’s information like  primary account number, expiry date, and CVV code. Merchants, vendors, or contact centers that handle credit or debit card information have to be PCI DSS compliant.

How does redaction work?

A number of tools and techniques suited for contact centers are used for redaction, each with its own features, benefits and shortcomings.

• Agent-initiated recording pause‍
• Desktop-based Redaction
• Keyword-based Redaction
• Numeric redaction
• Contact Center AI

Let’s try to understand each of these in detail.‍

1. Agent-initiated recording pause‍

This is the most rudimentary technique of redaction, not entirely approved by PCI DSS. Here, the agent manually pauses the recording when the customer is sharing PII or PCI data. During transcription, this information does not exist, thus precluding any chance of data breach or fraud.

But the manual nature of the stop and resume method is prone to human errors—. An agent may forget to  pause the recording or the customer may provide details before the agent pauses. Agents can also misuse the manual pause feature to censor undesirable parts of the calls like escalations and prevent quality assurance (QA) teams from reporting the same.

Another disadvantage of agent-initiated recording pause is that redaction issues are caught after they’ve occurred. By the time QA, compliance, fraud teams manually identify it, the breach would have already escalated.‍

2. Desktop- based Redaction‍

A slightly more advanced method of redaction, desktop analytics packages monitor cursor fields and automatically pause recordings when the cursor falls into a regulated field. But this practice is  dependent on the timely reaction of the agent and their typing speed— the call may record the PCI or PII details, even before the agent has moved the cursor to the regulated field.

3. Keyword-based Redaction

To make this redaction work, you maintain a list of keywords in speech analytics software. The algorithm identifies those words and phrases from call and redacts them from transcripts and recordings. However, it requires additional bandwidth to update the keyword list regularly as per changing organization or market needs. Due to its human dependency, it is unscalable and error-prone.  

4. Numeric Redaction

The redaction software automatically removes all kinds of numeric data from the calls and transcripts, like time mentions, price, CVV, etc. This algorithm identifies the data using criteria such as two or more numbers found in a sequence or numbers found around a specified keyword.

5. Selective Redaction‍

Selective Redaction leverage entity detection and attention-based deep neural networks to accurately identify sensitive named and numerical entity from customer conversations. Once the entities are detected, AI starts redacting only sensitive entities of your choice while the remaining portions of the conversation are still transcribed and visible.

This solves the issue of over-redaction or under-redaction and is independent of human errors while also allowing contact centers to protect sensitive customer data with high accuracy without losing any contextual information required for intelligent business decisions. 

Once the entities are detected, AI takes the redaction a step further with selective redaction— here parts of an entity are redacted, while remaining portions are still transcribed and visible.

This solves the issue of over-redaction or under-redaction, speed, and is independent of agent errors while also allowing contact centers to customise automated redaction to their unique needs. 

Redaction Must Cover VoiceAI Agents and ChatAI Agents, Not Just Human-Handled Calls

As more of the contact center shifts to autonomous conversations, redaction can no longer be scoped to human agent calls alone. VoiceAI Agents now resolve entire voice interactions end-to-end, and ChatAI Agents handle full conversations across chat and messaging channels — both routinely collect the same PII and PCI data that human agents do, from account verification details to payment information. Any contact center compliance monitoring software that only redacts human-handled recordings leaves a significant compliance gap.

Closing that gap means building redaction into every conversation surface the contact center operates, rather than bolting it on after the fact. Real-time and post-interaction redaction should apply consistently whether a customer is speaking with a live agent, a Companion Agent-assisted representative, a VoiceAI Agent, or a ChatAI Agent, so sensitive data is masked the same way regardless of who, or what, handled the conversation.

• VoiceAI Agent conversations: Automatically redact PII and PCI from voice interactions handled entirely by AI, including recordings and generated transcripts.
• ChatAI Agent conversations: Apply the same redaction standards to chat and digital transcripts, where customers often type sensitive data directly into the conversation.
• Companion Agent-assisted calls: Extend real-time redaction to the guidance and summaries surfaced to human agents, so sensitive data stays masked even in the tools supporting live conversations.

Conclusion‍

With remote work and a massive volume of sensitive client information, it is becoming increasingly difficult to protect sensitive information and prevent fraud using traditional, manual-oriented methods. Being proactive with measures against data breach and security threats, contact centers should explore and invest in technology like AI and automated redaction to help them save tens of millions of hefty fines, protect brand reputation, and help withstand the changing economy.