Redacting call audio

Redact before any recording, transcript or sample leaves your systems. Transcribe with timestamps, find card numbers and personal details in the text, silence the matching spans in the audio, scrub the metadata, then check a random sample by ear.

What are the steps, in order?

Scope the archive
Drop years and lines without a lawful recording notice, client-owned calls, and callers in states your lawyer flags. Redaction is wasted on calls that cannot be licensed.
Transcribe with word timestamps
Every later step depends on knowing when each word was spoken. Keep agent and caller channels apart if your platform recorded them separately.
Find what must go
Card numbers, expiry dates and security codes; bank and account numbers; Social Security numbers; dates of birth; names, addresses, emails and phone numbers; answers to security questions; anything about a caller's health.
Silence it in the audio
Replace each span with silence or a flat tone, with a margin either side. Replace the same words in the transcript with a typed token such as CARD_NUMBER or CALLER_NAME.
Scrub the metadata
Remove caller phone numbers, account IDs and agent names from file names and fields, or swap them for random tokens that you keep the key to.
Check a sample by ear
Listen to a random sample from every queue and year. Set a failure rule in advance: if the sample finds a miss, fix the method and run that slice again.

Why card numbers come first

Recordings that capture spoken card data fall under the payment card industry's security standard. PCI DSS does not allow sensitive authentication data, such as the three- or four-digit security code, to be stored after authorization, even encrypted, and the PCI Security Standards Council publishes guidance specific to telephone payments. A call archive with card numbers in it should be cleaned whether or not it is ever licensed.

Buyers run their own clean-up too. Scale AI removes identities before data leaves the seller; Labelbox Prism scrubs personal data after it arrives. Treat both as extra layers on top of yours, never instead of it.

Where these facts come from (3)

PCI Security Standards Council library, home of PCI DSS and its telephone payments supplement (seen Nov. 7, 2026)
Scale AI, data partnership program (seen Nov. 7, 2026)
Prism, the licensing site run by Labelbox (seen Nov. 7, 2026)

What should the redaction log record?

Field	Example	Why a buyer or lawyer asks
Scope	Queues, years and caller states included	Shows excluded calls stayed out.
Method	Transcription tool, detection rules, audio treatment	Lets the work be repeated and audited.
Categories removed	Card data, account numbers, names, health details	Matches the license's definition of personal data.
Sample check	Number of calls listened to, misses found, fixes made	Evidence the process worked.
Sign-off	Who approved release, and the date	One accountable owner for the release.

Questions about redaction

Is a buyer’s own de-identification enough?

Treat it as a second pass, not the first. Buyers describe their own processes, but redacting before anything leaves your systems keeps card numbers and personal details out of their hands entirely.

Should card numbers be beeped or silenced?

Either works if the digits are gone. Silence or a flat tone over the whole span is safer than bleeping single digits, which can leave fragments audible.

Can automatic redaction be trusted?

It misses things: digits spoken in groups, numbers corrected mid-sentence, details spelled out letter by letter. Pair it with a human review of a random sample and a rule for what to do when the sample fails.

What about calls where the recording was paused for payment?

Pause-and-resume reduces the risk but does not remove it. Agents forget to pause, and callers read card numbers aloud before being asked. Scan those calls too.

Do we need to remove the caller’s voice itself?

If a buyer only needs the words, a redacted transcript avoids the voiceprint question altogether. If it needs audio, ask about speaker anonymization and read the biometric laws first.