Phonely is an AI phone answering platform for businesses. It answers inbound calls, books appointments, qualifies leads, and runs custom call flows, so service businesses can handle every call without staffing a front desk. You configure the conversation, routing logic, booking steps, and payment workflows around how your business actually works.
But when a Phonely agent needs to take a payment, card data cannot be allowed to enter the AI pipeline.
This guide covers how to take PCI-compliant payments on Phonely AI voice agents using Shuttle, so your agents can collect card payments mid-call while keeping card data out of your business's systems and the Phonely call flow.
Phonely advertises PCI-compliant infrastructure and lets you build a payment step into a call flow. But a payment workflow step is not the same as processing the payment. Phonely does not capture the card in an isolated environment, does not connect to a payment gateway, and does not charge the card. You still need a payment layer that captures the card away from the agent flow, keeps it out of your call logs, and actually processes it. If card digits enter the audio stream unprotected, your whole stack falls into PCI scope.
Shuttle provides the payment layer that closes that gap. There is no native Phonely integration: instead, your application invokes Shuttle's Twilio-based secure capture, the card is captured in an isolated PCI-certified environment, and the result comes back to your application. This does require you to be a Twilio customer today.
The Payment Challenge for Phonely
Phonely is built for businesses, not developers, which means the goal is a working call flow rather than a custom payment stack. That goal still runs into the same compliance wall every voice AI platform hits.
Card data cannot enter the AI pipeline. If a customer reads or keys in card digits during a Phonely call, that is cardholder data under PCI DSS. If it flows through the audio path, your transcription, call recordings, and any connected systems are all in PCI scope.
A configured payment step is not payment processing. Phonely lets you add a payment workflow to a call flow, and it runs on PCI-compliant infrastructure. But that step still needs something to capture the card in isolation and route it to a gateway. The platform handling the conversation is not the same as the layer that charges the card.
Building card capture yourself is not realistic. Full PCI DSS scope (SAQ-D, or a Report on Compliance at Level 1 volumes) is expensive upfront and every year, plus quarterly scans, annual penetration testing, and a Qualified Security Assessor at Level 1 volumes. For a business that just wants its AI receptionist to take a deposit, that is a non-starter.
Bolting on a separate payment line breaks the experience. Telling the caller to hang up and dial a payment number, or transferring them to a separate IVR, breaks the agent experience and loses payments at exactly the wrong moment.
The answer is a secure payment handoff that captures the card in an isolated environment and returns a clean result to your application.
How Shuttle Works with Phonely Today
There is no native Phonely integration. The handoff is API-driven and built on Shuttle's Twilio-based capture: you must be a Twilio customer, and your application code triggers the handoff at the point of payment. The card is captured through Twilio Pay and passed to Shuttle's PCI DSS Level 1 environment, while Phonely runs the conversation.
Your Phonely agent runs the conversation: greeting, qualification, booking, and amount confirmation are handled by your Phonely call flow.
The payment is triggered: when payment is due, a webhook or tool step from your application calls Shuttle to create a payment session with the amount, currency, and gateway configuration.
A secure PCI capture takes the card: at the point of payment, the card is captured in a secure PCI DSS Level 1 capture (today, via Twilio Pay, with Shuttle as the certified connector). The card digits pass from Twilio Pay to Shuttle's PCI DSS Level 1 environment, so they never reach Phonely or the AI model.
Payment is processed: Shuttle passes the card to your configured gateway, which issues the token. Your payment gateway authorises the payment.
Result returned to your application: Shuttle sends a webhook with the outcome, a transaction reference, and a masked card number. Your Phonely agent confirms the payment in the conversation.
One honest caveat to set expectations: the secure capture at the point of payment is live now. Shuttle handles the payment segment of the call, not the whole conversation. Returning the caller to the same Phonely agent after payment works today: you program the return route in your Twilio flow and pass a conversation ID, so the agent picks the call back up with full context. Shuttle works with Twilio today, and any carrier coming soon. You also need some technical resource: Shuttle provides ready-made interfaces for payment links plus the capture and APIs, and you build the agent-side wiring against Shuttle's sandbox gateway for the proof of concept.
How It Works: Step by Step
Step 1: Payment intent recognised. Your Phonely agent reaches the point in the call flow where a payment or deposit is due.
Step 2: Amount confirmed. The agent says the total and tells the customer they'll enter their card on the keypad.
Step 3: Payment session created. A webhook from your application calls Shuttle's API with the amount, currency, and gateway config. Shuttle returns a session token.
Step 4: Secure capture takes over. At the point of payment, a secure PCI DSS Level 1 capture takes over the card collection (today, via Twilio Pay, with Shuttle as the certified connector). This is the key step: the card is captured inside that secure PCI capture, so it never touches Phonely or the AI model.
Step 5: Card details entered. Shuttle plays a secure prompt and the customer enters card number, expiry, and CVV via the keypad.
Step 6: Card captured in isolation. Twilio Pay captures the digits and passes them to Shuttle's PCI DSS Level 1 environment. The card never reaches Phonely, so recordings never contain card data.
Step 7: Payment processed. Shuttle passes the card to your gateway for authorisation, and the gateway issues the token.
Step 8: Webhook received. Shuttle sends the result back: outcome, transaction reference, masked card number.
Step 9: Agent confirms. Your Phonely agent confirms the payment and continues the conversation.
The customer stays on the line throughout the capture, with no transfer to a separate line. Returning the caller to the same Phonely agent and call after payment works today: your Twilio flow routes the call back and passes a conversation ID, so the agent resumes with context. Shuttle provides the secure capture and the result webhook; the return leg is wiring your team owns.
Multi-PSP Support
Whether you process on Stripe today, your enterprise client mandates Adyen, or you run multiple locations that each bring their own gateway, Shuttle connects to 30+ payment gateways including Stripe, Adyen, Worldpay, and Checkout.com. Switching gateway is configuration, not re-integration, though saved cards stay with the gateway that stored them. A few gateways (Braintree, for example) work for payment links but not for voice capture, because they will not allow raw card data to be passed.
Per-client gateway configuration: each business or location can use its own PSP
Single integration: integrate with Shuttle once; gateway routing is configuration, not code
Multi-PSP routing: each payment method can go to its own gateway, for example cards through one gateway and ACH through another
Manual failover: if a gateway is down, you can move the affected payment types to another connected gateway. There is no automatic failover, and saved cards stay with the gateway that stored them, so repeat payments on stored cards will not run through the second one
For agencies and operators running Phonely agents across multiple businesses, this means offering payment capability to everyone without maintaining a separate gateway integration per client.
PCI Compliance
Shuttle is a PCI DSS Level 1 certified Service Provider, the highest level of payment security certification.
What stays in your business / Phonely: conversation logic, booking, amount calculation, and handling of non-sensitive webhook results. None of this is cardholder data.
What stays with Shuttle and Twilio Pay: secure card capture after the handoff, tokenisation with your gateway, gateway communication, and secure prompt playback, all inside the certified environment.
Call recordings: because the card is entered during the secure PCI capture, the digits are never part of the audio Phonely processes or records, so there is no cardholder data in your recordings, logs, or systems.
Merchants complete SAQ-A, the lightest PCI self-assessment, rather than the SAQ-D obligations that taking card data yourself would trigger; an agency or answering service taking payments for its clients completes SAQ-D. Your acquirer confirms which form applies to you.
Beyond Voice: Payment Links
Payment links are the turnkey path. Mid-call, your application can send a secure link by SMS or email; the customer opens a hosted checkout page, pays, and the result returns to your application in real time. Links work even with gateways that do not support voice capture.
Payment links suit higher-value transactions, mobile-first callers, customers who find keypad entry difficult, and post-call payments. Both methods use the same Shuttle infrastructure, and your application chooses which to use.
Use Cases
AI Receptionists and Appointment Booking
Phonely agents for clinics, salons, dental practices, and service businesses can take a deposit or full payment to secure a booking before the call ends, cutting no-shows.
Home and Field Services
Plumbers, electricians, HVAC, and other trades using Phonely to answer calls can collect a call-out deposit or balance during the booking conversation rather than chasing payment afterwards.
Inbound Bill-Pay and Account Payments
Businesses fielding account and billing calls can take a payment in the same conversation rather than directing the caller to a website or a separate line.
Lead Qualification to Purchase
Agents that qualify inbound interest can close and collect payment in one call, capturing the card at the moment the customer commits.
Integration
Webhook-driven. Trigger a Shuttle payment session from your application and resume the conversation when the result webhook arrives. You build the agent-side orchestration; Shuttle provides the capture, payment links, and APIs.
Built on Twilio Pay today. The secure capture currently runs over Twilio Pay, where Shuttle is Twilio's chosen provider to enable Twilio Pay for many payment gateways, so you must be a Twilio customer. Shuttle works with Twilio today, and any carrier coming soon.
Sandbox available. Build your proof of concept against Shuttle's sandbox gateway and demo app, then run the full payment flow with test card numbers before going live.
Voice costs $49 per live instance per month, plus from $0.20 per transaction, falling with volume, billed through your Twilio account, with no per-seat licensing. See pricing.
FAQ
Does Shuttle have a native Phonely integration? No. There is no native Phonely integration today. The handoff is API-driven: your application invokes Shuttle's Twilio-based secure capture at the point of payment.
Does this require Twilio? Yes, today. The secure capture currently runs over Twilio Pay, so you must be a Twilio customer. Shuttle works with Twilio today, and any carrier coming soon.
Does Phonely process payments on its own? Phonely runs PCI-compliant infrastructure and lets you add a payment step to a call flow, but it does not capture the card in isolation, connect to a payment gateway, or charge the card. Shuttle provides that secure capture and gateway connection.
Can I build PCI-compliant payment capture myself on Phonely? Technically, but full PCI DSS scope (SAQ-D, or a Report on Compliance at Level 1 volumes) is expensive upfront and every year. Shuttle provides the same capability for $49 per live instance per month, plus from $0.20 per transaction, falling with volume, billed through your Twilio account.
What payment gateways does Shuttle support? 30+ gateways including Stripe, Adyen, Worldpay, and Checkout.com. You configure your gateway in Shuttle and it handles routing. Switching gateway is configuration, not re-integration, though saved cards stay with the gateway that stored them. A few gateways (Braintree, for example) work for payment links but not for voice capture.
Can I use this for outbound calls? Yes. The same secure handoff works for outbound agents that need to collect payment during a call.
Does the customer hear the agent during card entry? During the secure capture, Shuttle plays secure prompts. Once entry is complete, the agent resumes the conversation. To return the caller to the same agent afterwards, program the return route in your Twilio flow and pass a conversation ID so the conversation resumes with context.
Related Reading
Retell AI Payments: PCI-compliant payment capture for Retell AI voice agents
Vapi Payments: secure payment capture for Vapi voice agents
Bland AI Payments: secure payment capture for Bland AI phone agents
How AI Voice Agents Take PCI-Compliant Payments: the technical architecture for secure payment capture during AI voice calls
What Are Voice Payments? The Complete Guide: IVR, agent-assisted, and AI voice payment models compared
The Payment Layer for AI Agents: why AI agents need a dedicated payment layer
Add Payments to Your Phonely AI Agents
Shuttle is a PCI DSS Level 1 certified Service Provider. If you're using Phonely for AI call answering and need PCI-compliant payment capture:
See Voice Checkout | Book a discovery call