Retell AI lets developers build production-grade AI voice agents fast. Its API-first platform handles the hard parts of voice AI, so teams can focus on the conversation rather than the telephony stack. But when one of those agents needs to take a payment, the card details have to be handled somewhere other than the AI pipeline.
This guide covers how to take PCI-compliant payments on Retell AI voice agents using Shuttle, so your agents can collect card payments during a call while keeping card data out of your application and Retell's platform. It is written as "payments done right on Retell, with Shuttle": Retell runs the conversation, Shuttle runs the secure payment.
Developers are building appointment booking agents, outbound sales callers, customer service bots, and lead qualification systems on Retell. Many of those use cases end with a payment. A customer confirms a booking and needs to pay. A caller agrees to settle an outstanding bill. A lead converts and wants to purchase.
Retell deliberately focuses on the conversation, not card handling, and that is the right design. The AI model must never see, hear, or process cardholder data. Keeping card data out of the AI pipeline is how you keep that pipeline out of PCI scope. The secure pattern, which Retell itself recommends, is to hand the call off to a dedicated payment layer before any card details are entered, so the card number never reaches Retell or the LLM.
Shuttle is that payment layer. When it is time to pay, the card is captured in a secure, PCI DSS Level 1 call at the point of capture (today, via Twilio Pay), and the result comes back to your application. The card digits never touch your application or Retell's platform.
The Payment Challenge for Retell AI
Retell AI is a developer platform. That means the teams building on it are making their own architectural decisions, and when they hit the payment question, they face the same compliance reality that every voice AI platform faces.
Card data cannot enter the AI pipeline. If a customer presses their card digits during a Retell call, those DTMF tones are cardholder data under PCI DSS. Retell is not PCI DSS Level 1 certified, and its PII redaction runs after the language model has already processed the input, so capturing card details inside the Retell call would still pull your stack into PCI scope. That includes Retell's speech infrastructure, your LLM, your call recordings, your database, and every network path connecting them. The card entry has to happen off Retell entirely.
Building your own payment capture is not viable. Full PCI DSS scope (SAQ-D, or a Report on Compliance at Level 1 volumes) is expensive to achieve and expensive every year after. It requires quarterly vulnerability scans, annual penetration testing, strict controls on every system that handles card data, and a Qualified Security Assessor at Level 1 volumes. For a startup or small team building on Retell, that is not a realistic investment.
Redirecting to a separate system breaks the experience. If your Retell agent has to tell the customer "Please hang up and call our payment line," the AI experience breaks down. The customer waits, gets confused, or drops off entirely. The goal is to keep the customer on the line and hand the call to a secure payment environment, rather than send them away.
The solution is a payment layer the agent can hand the call to, that captures card data in an isolated PCI-compliant environment and returns the result, without the card ever passing through Retell.
How Shuttle Works with Retell AI
Shuttle provides the payment infrastructure that Retell AI agents need. There is no native Retell integration. The handoff is API-driven, which fits Retell's developer-first model: your application code orchestrates the payment flow, and the card itself is captured through Twilio Pay and passed to Shuttle's PCI DSS Level 1 environment, never by Retell. Shuttle ships the secure PCI capture, payment links, and the payment APIs; what you build is the small glue on your side: pass the payment amount to Shuttle through its API (the minimum data we need), trigger the handoff from your agent, and handle the result. There is no out-of-the-box screen or input UX wired for your specific app.
Here's the architecture:
Your Retell agent manages the conversation: Intent recognition, customer interaction, amount confirmation, all handled by your agent's LLM and Retell's voice infrastructure.
A secure PCI capture is triggered for payment: When payment is needed, the card capture runs as a secure, PCI DSS Level 1 call at the point of capture. Today this runs over Twilio Pay, with Shuttle as the certified gateway connector.
Shuttle captures the card: The customer enters their card details on their keypad during that secure PCI call. The digits are captured through Twilio Pay and passed to Shuttle's PCI DSS Level 1 environment, so they never reach Retell or the LLM.
Payment is processed: Shuttle passes the card to your payment gateway, which issues the token. Your payment gateway authorises the payment.
Result returned to your application: Shuttle sends a webhook with the transaction outcome (success or failure, a transaction reference, and a masked card number), which your application uses to confirm the payment.
Retell handles the voice. Shuttle handles the card. Your application ties them together. One honest caveat worth setting expectations on up front: the secure PCI capture at the point of payment is available now, and returning the caller to the same Retell agent afterwards is wiring your application owns: you program the return route in your Twilio flow and pass a conversation ID. See Call control: what's live today.
How It Works: Step by Step
Here's what happens during a live call with a Retell AI agent that hands off to Shuttle:
Step 1: Payment intent recognised. Your Retell agent detects that the customer wants to pay. This could be explicit ("I'd like to pay for my appointment") or triggered by your application logic (a booking is confirmed and payment is due).
Step 2: Amount confirmed. The agent says: "The total for your appointment is $85.00. I'll connect you to our secure payment line to take your card details."
Step 3: Secure capture triggered. At the point of payment, a secure PCI DSS Level 1 call takes over the card capture (today, via Twilio Pay, with Shuttle as the certified connector). This is the key step: the card is captured inside that secure PCI call, so it never touches Retell or the LLM.
Step 4: Card details entered securely. During the secure PCI call, the customer is prompted to enter their card number, expiry, and CVV on their phone keypad. Twilio Pay captures the digits and passes them to Shuttle's PCI DSS Level 1 environment.
Step 5: Payment processed. Shuttle passes the card data to your payment gateway for authorisation, and the gateway issues the token.
Step 6: Result returned. Shuttle sends the outcome to your application via webhook: success or failure, a transaction reference, and a masked card number. Your application records the result and confirms the payment to the customer.
The customer stays on the line throughout. There is no "hang up and call another number." The card never passes through Retell.
Call control: what's live today
This is the part most guides gloss over, so we'll be straight about it.
Available now (Twilio Pay product): the card capture runs as a secure, PCI DSS Level 1 call at the point of capture. When it is time to pay, the secure capture takes the card, the customer pays, and your application receives the result. The card never passes through Retell.
How far the capture reaches: Shuttle handles the point of capture, not the whole conversation. Shuttle works with Twilio today, and any carrier coming soon.
The practical consequence: returning the caller to the same Retell agent and call after payment works today, but it is wiring your application owns: you program the return route in your Twilio flow and pass a conversation ID so the agent resumes with context. Shuttle does not ride the full call, and the return-leg orchestration is not shipped out of the box.
If your flow needs the agent to pick the conversation back up after payment, talk to us about where this work is, and we will give you the honest current state rather than overpromise.
Multi-PSP Support
If you're building on Retell AI, you might be a startup using Stripe. Or you might be building for an enterprise customer that requires Adyen. Or you might be building a multi-tenant application where each of your customers uses a different gateway.
Shuttle connects to 30+ payment gateways including Stripe, Adyen, Worldpay, Checkout.com, and others. Your Shuttle configuration determines which gateway processes each transaction.
For developers building multi-tenant applications on Retell, this is particularly valuable:
Per-tenant gateway configuration: Each of your customers can use their own PSP
Single integration: You integrate with Shuttle once. Gateway routing is configuration, not code.
Multi-PSP routing: Each payment method can go to its own gateway, for example cards through one gateway and ACH through another
Manual failover: If a gateway is down, you can move the affected payment types to another connected gateway. There is no automatic failover, and saved cards stay with the gateway that stored them, so repeat payments on stored cards will not run through the second one
This means you can offer payment capability to all your customers without building and maintaining separate gateway integrations for each one.
PCI Compliance
For developers building on Retell AI, PCI compliance is the single biggest reason to use a payment layer rather than building card capture yourself.
What stays in your application / Retell:
Conversation management and agent logic
Payment amount calculation and confirmation
Initiating the handoff to Shuttle
Transaction result handling (webhook with non-sensitive data)
None of this is cardholder data.
What stays in Shuttle:
Secure card capture after the handoff, through Twilio Pay
Tokenisation with your gateway
Communication with your gateway, which authorises the payment
Secure prompt playback
None of it touches your application or the AI platform.
Call recordings: because the card is entered during the secure PCI capture, the card details are never part of the audio Retell processes or records. Any call recordings you store on Retell do not contain cardholder data. There are no card digits in your recordings, your logs, or your database.
Your PCI scope: your PCI scope stays limited. Merchants complete SAQ-A and platforms complete SAQ-D; your acquirer confirms which form applies to you. You are not storing, processing, or transmitting cardholder data.
Shuttle is a PCI DSS Level 1 certified Service Provider. That limits your PCI scope.
Beyond Voice: Payment Links
The secure PCI capture at the point of payment is the primary method during voice calls, but Shuttle also supports payment links, and for some Retell use cases, they are the better option.
During a Retell call, your agent can tell the customer: "I've just sent a secure payment link to your mobile." Shuttle generates a hosted checkout page and delivers it via SMS. The customer taps the link, enters their card details on the secure page, and completes the payment. The result is returned to your application.
Payment links are useful for:
Higher-value transactions: Customers may prefer to see the amount and merchant details on screen before entering their card
Mobile-first customers: If the caller is on a mobile phone, switching to a browser is straightforward
Accessibility: Customers who find keypad entry difficult can use the visual checkout instead
Post-call payments: Your agent can send a payment link at the end of a call for the customer to complete later
Both methods use the same Shuttle infrastructure and PCI-compliant environment. Your application logic decides which method to use based on context.
Use Cases
Retell agents tend to cluster around a few high-value workflows, and most of them end in a payment. Here is where Shuttle fits.
Appointment Booking (Clinics, Salons, Services)
Booking agents for clinics, dental practices, salons, and service businesses confirm an appointment and then need a deposit or full payment to secure it. The Retell agent confirms the slot, states the amount, and triggers the secure card capture, all before the customer hangs up. Taking payment at the point of booking is a common way to reduce no-shows.
Outbound Sales and Collections
Outbound Retell agents that close sales or chase outstanding balances need to capture payment at the moment of agreement. The agent triggers the secure card capture the instant the customer commits, so there is no callback and no link that goes unclicked.
Lead Qualification to Purchase
When an inbound agent qualifies a lead and the conversation turns into a sale, the payment has to happen in the same call or momentum is lost. Shuttle lets the agent move straight from "you're a fit" to taking payment, by handing the call to the secure payment line, rather than routing to a human.
Customer Service Bill-Pay
Support agents handling account queries frequently get asked "can I just pay my bill now?" With Shuttle, the Retell agent hands the call to the secure payment environment in the same conversation, rather than transferring the customer to a separate payment line.
Developer Integration
Retell AI is a developer platform, so the Shuttle handoff is designed to fit into a typical development workflow:
API-driven. Initiate the payment handoff, configure gateways, and receive webhooks via REST API.
Built on Twilio Pay today. The secure card capture currently runs over Twilio Pay, where Shuttle is Twilio's chosen provider to enable Twilio Pay for many payment gateways. Shuttle works with Twilio today, and any carrier coming soon.
Webhook-based results. Transaction outcomes are delivered via webhook to your application server. Parse the payload, update your database, and confirm the payment to the customer.
Test mode available. Test the full payment flow with test card numbers before going live. Same API, same flow, no real charges.
Voice costs $49 per live instance per month, plus from $0.20 per transaction, falling with volume, billed through your Twilio account, with no per-seat licensing.
FAQ
Can I capture card payments directly inside a Retell call? No. Retell is not PCI DSS Level 1 certified, and its PII redaction runs after the language model has already processed the input, so capturing card digits inside the Retell call would keep your stack in PCI scope. The secure pattern, which Retell itself recommends, is to hand the call off to a dedicated payment layer before any card details are entered. Shuttle is that handoff.
Is Retell PCI compliant? Retell is not a PCI DSS Level 1 certified payment processor, and it is not designed to be one. It runs the conversation. Payments are handled off-platform by Shuttle, which is PCI DSS Level 1 certified, so card data stays out of Retell and your application.
After payment, does the call return to my Retell agent automatically? The secure PCI card capture is available now on the Twilio Pay product. Returning the caller to the same Retell agent and call after payment works today when you program the return route in your Twilio flow and pass a conversation ID; Shuttle does not ship that orchestration out of the box, and Shuttle does not ride the full call. Shuttle handles the point of capture, not the whole conversation. Works with Twilio today, and any carrier coming soon.
What payment gateways does Shuttle support? 30+ gateways including Stripe, Adyen, Worldpay, Checkout.com, and others. You configure your gateway in Shuttle and it handles the routing.
Can I build PCI-compliant payment capture myself on Retell? Technically, but the cost is prohibitive. Full PCI DSS scope (SAQ-D, or a Report on Compliance at Level 1 volumes) means a large upfront cost and ongoing annual compliance costs. Shuttle provides the same capability for $49 per live instance per month, plus from $0.20 per transaction, falling with volume, billed through your Twilio account.
Can I use this for outbound calls? Yes. If your Retell agent makes outbound calls and needs to collect payment during the call, the same secure Shuttle capture works. The capture is triggered identically to inbound calls.
Related Reading
How AI Voice Agents Take PCI-Compliant Payments: The technical architecture for secure payment capture during AI voice calls
What Are Voice Payments? The Complete Guide: IVR, agent-assisted, and AI voice payment models compared
Vapi Payments: PCI-compliant payment capture for voice agents built on Vapi
Bland AI Payments: secure payment capture for Bland AI phone agents
Dialpad Payments: Secure voice payments for Dialpad Ai Contact Center
RingCentral Payments: PCI-compliant payment capture for RingCX and RingEX
The Payment Layer for AI Agents: Why AI agents need a dedicated payment layer
Contact Centre Payments: PCI-compliant payment capture for contact centres
Phonely Payments: PCI-compliant payment capture for Phonely AI phone agents
Add Payments to Your Retell AI Agents
Shuttle is a PCI DSS Level 1 certified Service Provider. If you're building voice agents on Retell AI and need PCI-compliant payment capture:
See Voice Checkout | Book a discovery call