Voiceflow is a no-code AI agent builder used by product teams, agencies, and enterprise developers to design and deploy voice and chat agents without writing a full application from scratch. It supports Twilio-backed voice deployments and web chat, and its visual canvas lets teams ship complex conversational flows quickly. Thousands of teams use it to build customer support bots, sales agents, and automated service experiences.
When those agents reach a payment moment, they hit a wall. Voiceflow has no native payment product. Its Stripe connector is a user-configured API block that can generate a Stripe payment link and send it by email or chat, but that is not in-flow card capture. There is no PCI-compliant DTMF capture, no gateway connection, and no card processing inside the agent conversation itself. Voiceflow holds SOC 2, ISO 27001, and HIPAA certifications, but it is not a PCI DSS certified payment environment. Any attempt to collect raw card data through the agent flow creates PCI scope across your entire stack.
This guide is for teams building Voiceflow agents that need to collect card payments as part of the conversation, whether on voice calls or web chat, without putting their platform or their customers' data at risk.
The Payment Challenge for Voiceflow Agents
Voiceflow's payment gap is not a design flaw; it reflects a deliberate choice to stay focused on agent orchestration. But that gap has real consequences for builders who need payment capability.
The Stripe connector sends a link, it does not capture a card. Voiceflow's Stripe API block allows you to call Stripe's API and generate a payment link that is delivered by email or chat message. The customer then completes payment on a Stripe-hosted page, off-platform. That works for some chat use cases, but it breaks the in-call experience entirely on voice, and it introduces a drop-off point that costs conversions.
Keypad input is not the same as PCI-compliant DTMF capture. Voiceflow supports a generic keypad input block for collecting numeric input from callers. But collecting card digits through a standard keypad block does not isolate those digits from the agent pipeline. DTMF tones that carry cardholder data must be captured, masked, and processed in a certified PCI DSS environment. A generic keypad input block provides none of that infrastructure, and routing those digits through Voiceflow's transcription or logging layer puts your application directly into PCI scope.
Building the compliance layer yourself is not feasible for most teams. PCI DSS Level 1 certification requires a Qualified Security Assessor, quarterly vulnerability scans, annual penetration testing, and an ongoing programme of controls. The upfront cost alone is substantial. For a team using Voiceflow to ship agents quickly, that commitment defeats the purpose.
What you need is a payment layer that sits between Voiceflow and your gateway, captures card data in an isolated certified environment, and returns a clean result to your agent so the conversation can continue.
How Shuttle Works with Voiceflow Today
Shuttle has no native integration with Voiceflow. The handoff is API-driven: your application code triggers the Shuttle payment handoff from your backend, slotting in at the payment moment without requiring changes to how your agent is structured. On voice, the card is captured through Twilio Pay and passed to Shuttle's PCI DSS Level 1 environment, never by Voiceflow. To use the secure voice capture, you must be a Twilio customer, because today the capture runs over Twilio Pay.
Shuttle provides ready-made interfaces for payment links plus the capture/IVR and the APIs. Your team builds the agent-side wiring that triggers the handoff. You can build and validate the flow against Shuttle's sandbox gateway and demo app before going live. The flow works in five steps.
The agent runs the conversation. Voiceflow handles intent recognition, dialogue management, and everything up to the moment payment is due. Your agent confirms the amount and tells the customer what happens next.
The agent triggers Shuttle at the payment moment. Your backend receives the signal from Voiceflow (via a webhook, API step, or tool call) and creates a Shuttle payment session with the amount, currency, and gateway configuration. On voice, the call is handed to a secure capture via Twilio Pay. On chat, Shuttle generates a hosted payment link.
Shuttle captures card data in isolation. For voice calls, at the point of payment the call is handed to a secure PCI DSS Level 1 capture via Twilio Pay. The customer enters their card on the keypad, and Twilio Pay captures the digits and passes them to Shuttle's PCI DSS Level 1 environment, so neither Voiceflow's infrastructure nor your application ever sees the raw digits. For chat, the customer clicks the hosted link and completes payment on Shuttle's PCI-certified checkout page.
Shuttle processes the payment and routes to your gateway. Shuttle tokenises the card with your configured payment gateway and sends the payment there. Your Voiceflow agent, your application, and Voiceflow's platform never touch cardholder data.
Shuttle returns a clean result to your agent. A webhook delivers the outcome, a transaction reference, and a masked card number to your backend. Your Voiceflow agent picks up the result and confirms the payment in the conversation.
One honest caveat to set expectations on up front: the secure capture at the point of payment is live now via Twilio Pay. Shuttle handles the payment segment of the call, not the whole conversation. Returning the caller to the same Voiceflow agent after payment works today: you program the return route in your Twilio flow and pass a conversation ID, so the agent picks the call back up with full context. Shuttle works with Twilio today, and any carrier coming soon.
Multi-PSP Support
Most Voiceflow deployments serve clients across different industries and markets, each with their own gateway preferences or contractual requirements. Shuttle connects to 30+ payment gateways including Stripe, Adyen, Worldpay, and Checkout.com, all through a single integration.
Per-tenant gateway routing: each client account can use their own PSP without you maintaining separate integrations
One integration, many processors: switching gateways is configuration, not re-integration, though saved cards stay with the gateway that stored them
Routing rules: each payment method can go to its own gateway, for example cards through one gateway and ACH through another
Redundancy: if a gateway is down, you can move the affected payment types to another connected gateway. There is no automatic failover, and saved cards stay with the gateway that stored them, so repeat payments on stored cards will not run through the second one
Gateway caveat: a few gateways (Braintree, for example) do not work for voice capture, because they will not allow raw card data to be passed, but they do work for payment links
For Voiceflow agencies and platform teams, this means you can offer payment capability to every client on a compatible gateway, from the same Shuttle integration.
PCI Compliance
Shuttle is a PCI DSS Level 1 certified Service Provider, the highest tier of PCI DSS certification. That certification covers the entire card capture and processing environment: secure capture, tokenisation and gateway communication.
What stays in Voiceflow and your application: conversation logic, intent recognition, session management, amount confirmation, and handling of non-sensitive webhook results. None of this constitutes cardholder data, so card data stays out of Voiceflow's platform and your application, which limits your PCI scope.
What stays outside Voiceflow: all card data, from the moment a digit is entered during the secure capture or on a hosted checkout form, through to authorisation and tokenisation with your gateway. Because the card is entered during the secure PCI capture, the card details are never part of the audio Voiceflow processes or records, so your call recordings and logs contain no actual card digits.
This separation has a direct effect on your compliance obligations. When Shuttle handles all card data, the card data never enters your systems, which is what keeps your PCI scope limited. Merchants complete SAQ-A and platforms complete SAQ-D; your acquirer confirms which applies. That is different from the obligations that apply to environments that touch card data themselves.
Voiceflow's SOC 2, ISO 27001, and HIPAA certifications cover information security and operational controls, but they do not constitute PCI DSS certification and do not make Voiceflow's infrastructure a compliant card data environment. The two certifications operate in different regulatory frameworks and address different risks.
Beyond Voice: Payment Links
Payment links are the turnkey path. From the same Shuttle integration, your Voiceflow agent can send a payment link by SMS or email mid-conversation. The customer clicks through to a Shuttle-hosted checkout page, completes the payment, and the result returns to your application in real time.
Payment links work well for higher-value transactions where customers prefer to review details on screen, for web chat agents where keypad entry is not available, and for post-conversation payment follow-up. They also work even with gateways that do not support voice capture, such as Braintree. Both the secure in-call capture and payment links use the same Shuttle infrastructure, so you choose the method based on the channel and context, not the integration. See pricing for details.
Use Cases
Outbound Sales
Voiceflow agents making outbound sales calls need to close at the moment of agreement. If the agent cannot take payment on the call, the sale is deferred and often lost. Shuttle captures the card in-call so there is no callback, no separate payment step, and no drop-off between agreement and charge.
Bill-Pay and Collections
Customer service and collections agents built on Voiceflow handle account queries where payment is a natural outcome. Rather than transferring the customer to a separate IVR or payment line, Shuttle lets the agent take the payment within the same conversation, cutting handling time and improving collection rates.
Bookings and Deposits
Voiceflow agents used for appointment scheduling, hotel reservations, or service bookings can capture a deposit or full payment to secure the booking before the call or chat ends. Taking payment at the point of commitment reduces no-shows and cancellations.
Customer Support Payments
Support agents that handle billing disputes, plan changes, or account top-ups often reach a point where a payment is needed to resolve the issue. Shuttle lets the agent complete that transaction without the customer needing to visit a separate portal or call a different number.
FAQ
Does Voiceflow process payments natively? No. Voiceflow does not have a native payment product. Its Stripe connector is a user-configured API block that generates a Stripe payment link sent by email or chat. There is no in-flow card capture, no PCI-compliant DTMF processing, and no gateway connection inside the Voiceflow platform.
Does Shuttle have a native Voiceflow integration? No. Shuttle has no native integration with Voiceflow. The handoff is API-driven: your application code triggers Shuttle's Twilio-based payment setup, and on voice, at the point of payment the call is handed to a secure PCI DSS Level 1 capture via Twilio Pay.
Does this require Twilio? Yes, for the secure in-call voice capture. The capture runs over Twilio Pay today, so you must be a Twilio customer. The chat payment-link path does not require Twilio. Shuttle works with Twilio today, and any carrier coming soon.
How do I take PCI-compliant payments on Voiceflow? Connect Shuttle to your Voiceflow agent via your backend. At the payment moment, your application triggers a Shuttle payment session. On voice, the call is handed to a secure capture via Twilio Pay; on chat, Shuttle sends a payment link. Twilio Pay captures the card on voice, Shuttle tokenises it with your gateway and routes the payment, then returns a result. Your Voiceflow agent and application never see card data.
Which payment gateways does Shuttle support? Shuttle connects to 30+ gateways including Stripe, Adyen, Worldpay, and Checkout.com. Switching gateways is configuration, not re-integration, though saved cards stay with the gateway that stored them. A few gateways (Braintree, for example) do not work for voice capture but do work for payment links.
Can I build PCI-compliant payment capture into my Voiceflow agents myself? You can build a payment integration, but achieving PCI DSS Level 1 certification yourself requires a Qualified Security Assessor, quarterly scans, annual penetration testing, and an ongoing security programme with significant annual cost. Shuttle provides the same certified infrastructure for $49 per live instance per month, plus from $0.20 per transaction, falling with volume, billed through your Twilio account.
Does this work for outbound calls? Yes. Shuttle works for both inbound and outbound voice calls. Outbound sales agents built on Voiceflow can capture payment at the point of verbal agreement, with the call handed to the secure capture during card entry and the result returned to your application. To return the caller to the same agent afterwards, program the return route in your Twilio flow and pass a conversation ID so the conversation resumes with context.
Related Reading
The Payment Layer for AI Agents: why AI agents need a dedicated payment layer and what that layer does
AI Voice Agent PCI Payments: the technical architecture for PCI-compliant card capture during AI voice calls
Voice Payments: IVR, agent-assisted, and AI voice payment models compared
Vapi Payments: PCI-compliant payment capture for Vapi AI voice agents
Retell AI Payments: secure payment capture for Retell AI voice agents
Add Payments to Your Voiceflow Agents
Shuttle gives Voiceflow agents PCI Level 1 card capture across 30+ gateways for $49 per live instance per month, plus from $0.20 per transaction, falling with volume, billed through your Twilio account, with no per-seat licensing (see pricing). Links Checkout is priced separately. For technical detail, see the Shuttle docs: Twilio setup, payment links, and security and PCI.
See Voice Checkout | Book a discovery call