Protect sensitive content
Sensitive-content protection masks card numbers, security codes, bank details and other confidential values in transcripts before anything else reads them: keyword matching, AI analysis, custom questions, exports and every user who can open the call. It protects recorded calls, live transcript output and translations.
The masked text replaces the stored transcript. No unmasked copy is kept and there is no "reveal" option at any permission level. A category switched on by mistake cannot be undone by switching it off again; only future calls change.
Turning it on
Protection is set up in two steps:
- Speechlytics enables Protect Sensitive Content (PCI DSS) for the account.
- The account chooses which categories to mask, in the Speechlytics web app.
All categories start switched on, so an account that changes nothing gets the broadest protection.
What can be masked
| Category | What it catches |
|---|---|
| Card Numbers | A run of 13–19 digits, however it is spoken or punctuated. |
| Security Codes (CVV) | 3–4 digits introduced by words such as "CVV", "security code" or "card verification". |
| Expiry Dates | A date introduced by "expiry", "expires", "valid until" and similar. |
| SSN / National Insurance | Social security and national insurance number shapes. |
| IBAN / Account Numbers | An IBAN introduced by the word "IBAN". |
| Phone Numbers | Properly formatted phone numbers. Bare digit runs are left alone, because order and reference numbers look the same. |
| Bare Numbers After A Card | Once a card has been mentioned in the call, a segment that is nothing but a short number (such as a CVV read on its own). |
Card matching
| Mode | Behavior | Use when |
|---|---|---|
| Broad (default) | Masks any digit run of card length. | You want maximum protection; a masked order number is an acceptable cost. |
| Card Prefix | Masks only runs that start with a real card-issuer prefix. | Your calls routinely contain long reference or account numbers. |
Turning every category off is allowed and simply masks nothing.
How masking works
Speechlytics uses two complementary passes:
- Patterns. A deterministic matcher masks anything written as digits, on every segment, immediately.
- Context. An AI pass reviews the transcript for sensitive values that only make sense in context, such as numbers spoken as words or split across segments.
While masking runs, the call stays In Progress and its history shows RedactionStarted and then RedactionEnded. Keyword matching and analytics start only afterwards, so they never see the original values. If the contextual pass is unavailable, processing continues with the pattern-masked transcript.
Live conversations
For live calls, finalized segments are pattern-masked before they are broadcast or stored. When the live call ends, the stored transcript goes through the full masking process like any other call. Interim recognition text should be treated as provisional.
Result behavior
Final results contain the protected transcript. The original value is not exposed through any call-result endpoint, export or webhook. Transcript polishing never changes masked text, and reverting a polish cannot reveal it.
Guidance
- Transcript masking does not alter the audio. Apply appropriate retention and access policies to recordings as well.
- Test expected examples before relying on a category for compliance decisions.
- Transcription accuracy affects detection accuracy.
- Avoid sending sensitive values in filenames or call metadata, which are outside transcript masking.
- If Speechlytics later withdraws the feature from the account, the category choices are cleared. Review them if it is enabled again.