White paper

The shopping carts won the page.
The conversation is still up for grabs.

Web commerce was won by whoever owned the checkout page. The next channel is being won right now, in the conversation.

Executive summary

Web commerce is settled, and the shopping carts won the checkout page years ago.

Buying has moved off the page and into the conversation: people call a number and an AI voice agent answers, or open a chat and an agent runs the thread to the sale. A new channel is never won by the last channel’s stack. It is won by whoever solves the hardest part of it, and in the conversation the hardest part is the payment.

In production with

The page is won. Let it go.

Part 1: The problem

A shopping cart platform sells one thing underneath all the features: the place a merchant runs their storefront and takes a payment on the web. The strongest ones built their own payment product into the checkout, because owning the payment is how a platform stops being a tool and becomes infrastructure.

That worked. It is also finished. The web checkout is mature, the incumbents hold it, and a merchant will not migrate their storefront to capture a few points of payment economics. If the plan is to be a better checkout page than the one a merchant already uses, that is a war that ended before you arrived.

70.22%

Average documented cart abandonment, across 50 studies from 2006 to 2025. The web checkout, the thing the incumbents perfected, still loses roughly seven of every ten carts.

Baymard Institute, 2025

Buying moved into the conversation

The shift

Voice

A customer phones to place an order, change a booking, settle an invoice, or renew a policy. A few years ago a person answered. Today an AI voice agent does, and it holds the whole conversation: the questions, the options, the upsell, the confirmation.

Chat

A customer opens a chat, messages on WhatsApp, or replies to a marketing thread. An AI chat agent answers, recommends, handles the objection, and brings them to the point of sale, all inside the thread, without a tab ever opening.

These are not support tickets. They are sales, often the higher-intent ones a customer wanted to talk through before committing. The constraint that kept these channels small, a trained human on every interaction, is the constraint that just lifted. The agent handled all of it, right up to the moment money changes hands.

A sales channel with no checkout

The wall

The agent that just closed the sale cannot take the payment. So one of three things happens, and all three leak. Every one is a sale that was won and then degraded at the last step.

Leak 1

Transfer to a human

Throws away most of the economics that made the agent worth deploying.

Leak 2

Read the card aloud

Drops card data into a recording or transcript and creates a compliance problem the business may not know it has.

Leak 3

Push back to a web page

The exact friction the conversation removed. Against a 70% abandonment rate, a measurable share never complete.

This is the shape of problem the web solved years ago. A storefront that could show the product but not take the money was not a store. The conversation is at that exact stage now: it can do everything except finish. The missing piece is the close.

The numbers, from published sources

Part 2: The evidence

Shoppers who use AI chat convert at a higher rate
3.1% Shoppers who do not use AI chat
12.3% Shoppers who engage with AI chat
Rep AI, an AI chat vendor, 2025 · returning shoppers who use AI chat also spend 25% more
70%

of customer service journeys will begin, and be resolved, in conversational, third-party assistants built into their mobile devices by 2028.

Gartner, 2024
80%

of common service issues resolved autonomously by agentic AI by 2029, cutting service cost ~30%.

Gartner, 2025
37%

of phone leads convert during the call, across 60M+ analysed calls.

Invoca, 2025
$186B

voice commerce market by 2030, up from $42.75B in 2023 (24.6% CAGR).

Grand View Research, 2024
$14.9B

conversational (chat) commerce market in 2024, growing ~15.6% a year.

Market.us, 2025
10–20%

improvement in new-agent success and sales conversion rates, reported for insurers that rebuilt whole business domains with AI.

McKinsey, 2025

Taco Bell has rolled out voice AI ordering at more than 500 drive-throughs, and Wendy’s announced plans to take FreshAI to 500 to 600 locations. A Harvard Business Review study of 46,000 shoppers found that 73% used more than one channel during their shopping journey (HBR, 2017). Every channel is another surface where a sale can close, and another that needs a way to take the money.

Part 3: The hypothesis

A new channel is not won by whoever shows up with the old channel’s tools.

It is won by whoever solves the part everyone else finds too hard. Agents are on their way to being a commodity, so competing on the agent is competing on a feature everyone will soon have. The hard part is the payment, and few have solved it across providers.

Why the payment is the hard part

Three reasons that do not exist on a page

01

The card cannot be exposed

On a voice call the number cannot land in the recording or the model’s context. On chat it cannot touch the transcript. This is PCI with teeth, in exactly the channels that are opening up, and it is unforgiving.

02

It has to settle on the merchant’s own rail

The merchant already has a provider, a negotiated rate, a settlement account, sometimes one their compliance team mandated. The voice and chat sale must land where the web sale lands. A channel that forces a new provider is a migration, and merchants do not buy migrations.

03

It has to work across every surface

Voice, chat, and SMS each capture payment differently. A merchant should not need a different payment setup for each one.

Why the obvious answers fail

Each for a specific reason

Use the cart platform’s payments

Lives on the page, and is the platform’s own provider by design. It fails the merchant’s-own-rail test before the channel question even arises.

Build it yourself

One channel on one provider is a project in itself. Then the second provider, the second PCI surface, the Level 1 obligation, the audits, and a payments team nobody set out to hire.

Standardise on one provider

The shortcut that loses the enterprise accounts, because their provider is not negotiable.

Bolt on a generic payment link

Closes one sale in one channel, and leaves transaction data split across tools. A patch, not a position.

Where payments actually sit

Part 4: The solution

Category What it does Channels Provider
Gateway One merchant, one integration Page-bound Single provider
Orchestrator Routes between providers, merchant-side Page-bound Multi, merchant-side
PayFac You become the payment provider Page-bound You are the provider
Payment LayerThe category that fits Sits between software and the providers Voice, chat, links, embedded Bring your own (40+, 30+ for voice)

A payment layer sits between software and the payment providers: thin where a PayFac is heavy, provider-neutral where a gateway is single-provider, channel-native where an orchestrator is page-bound. It exposes the merchant’s existing payment relationship to wherever the agent operates, and limits the platform’s PCI scope.

It is additive

The conversation is a separate channel, so the payment in it runs alongside whatever the merchant already uses on the web, and touches none of it. It asks the web checkout to change nothing, which means it needs no incumbent platform to agree to anything. That is the difference between a strategy that waits on a roadmap and one that doesn’t have to wait.

Shuttle is the Payment Layer

The solution

It sits above the merchant’s existing provider, and nothing underneath changes. You integrate once. Merchants on any compatible gateway get payment capture across voice and links, including links sent in chat, and keep their own provider. More than forty providers are supported (30+ for voice).

That last part is the structural difference a competitor cannot answer with a feature: most ways of adding payments make the merchant adopt your chosen provider. The Payment Layer is the inverse.

VoiceChatLinksEmbedded
↓
Shuttle · the Payment Layer
↓
The merchant’s own provider (40+, 30+ for voice)

Talk to us

If the payment layer sounds like the architecture you need, we can walk you through how it fits your platform.

Why compliance matters

The data behind the solution

$4.99M

Global average cost of a data breach, up 12% on the previous year and a record high.

IBM, 2026
43.4%

of organisations maintained full PCI DSS compliance.

Verizon, 2022 report (2020 data)
4 of 16

headless and composable platforms hold a public PCI DSS Level 1 attestation.

Shuttle research, 2026

The Payment Layer limits the platform’s PCI scope. PCI DSS Level 1, ISO 27001, and SOC 2 sit at the layer, and the card never enters the recording, the transcript, or the model’s context, because capture happens inside infrastructure built for it. Shuttle connects Twilio voice flows, and payment links in chat, to compatible gateways, and runs the voice payment pattern in production for AI voice platforms like PolyAI, and payments for operational commerce platforms like Brightpearl.

The project you never sign up for

~12 months

of payment development one platform never spent

~$225k / yr

average annual PCI DSS Level 1 assessment fee for a Tier 1 merchant, before technology, operating and staff costs

$360k / yr

saved in a year by the same platform, versus building and maintaining its own payment infrastructure

PCI DSS Level 1 ISO 27001 SOC 2

What it looks like in the channel

In practice

Voice

A card captured on a live call

An inbound call reaches the agent. The conversation runs as normal until it reaches payment, and the card is captured through a secure prompt. The number never enters the recording. The transaction settles on the merchant’s own provider, and the confirmation comes back into the same call, with no transfer.

Chat

A link sent in the thread

The agent runs the thread to the point of sale and sends a payment link in the conversation. The customer pays in place. The card never touches the transcript, and the sale lands on the merchant’s rail, inside the channel that closed it.

What to look for

Four criteria separate a position from a patch

✓

Bring-your-own-provider

Can each merchant keep the provider they already use?

✓

PCI DSS Level 1 at the layer

Does it hold PCI DSS Level 1 itself and keep card data out of recordings, transcripts, and model context?

✓

One integration, every channel

Does a single integration cover voice and links, including links sent in chat?

✓

Additive, not a migration

Can it run alongside the existing web checkout without changing it?

A solution that meets all four is a payment layer. Anything that meets some of them is one of the partial answers above, and the gaps surface later, usually in the deal you most wanted to win.

Who this is for

Platforms that do not own the checkout page, and do not need to

  • Vertical software running a merchant’s operations, now closing sales in the conversation
  • Contact and customer-experience platforms turning calls into transactions
  • ERP and finance platforms collecting payments inside workflows
  • AI voice and chat agent vendors who win the customer and need to finish the sale
  • Merchants who want a channel their cart platform will not give them

The page is taken. The conversation is up for grabs. The platforms and the agents that move on it now will own the next channel the way the carts own the last one.

Put the payment in the conversation

The page is taken. The conversation is up for grabs, and it is additive, so it does not wait on anyone’s roadmap. Talk to us about adding capture across voice and links, including links sent in chat, on any compatible provider your merchants use.

Sources

Research cited above

  1. Baymard Institute (2025). Cart Abandonment Rate Statistics: 70.22% average across 50 studies, 2006–2025.
  2. Gartner (2024). 70% of customer service journeys will begin, and be resolved, in conversational, third-party assistants built into their mobile devices by 2028.
  3. Gartner (2025). Agentic AI autonomously resolves 80% of common service issues by 2029.
  4. Rep AI (2025). Ecommerce Shopper Behavior Report: shoppers who engage with AI chat convert at 12.3% vs 3.1%; returning shoppers who use AI chat spend 25% more.
  5. Grand View Research (2024). Voice Commerce Market: $42.75B (2023) to $186.28B by 2030, 24.6% CAGR.
  6. Market.us (2025). Conversational Commerce Market: ~$14.9B (2024), ~15.6% CAGR; chatbots ~66%; financial services ~41%.
  7. Invoca (2025). Call Conversion Benchmarks: 37% of phone leads convert during the call (60M+ calls).
  8. Wall Street Journal, via TechCrunch (30 August 2025). Taco Bell voice AI ordering at more than 500 drive-throughs.
  9. PYMNTS / Restaurant Business (2024–2025). Wendy’s FreshAI voice ordering rollout.
  10. McKinsey (2025). The future of AI for the insurance industry: 10–20% improvement in new-agent success and sales conversion rates from rebuilding whole domains with AI.
  11. IBM (2026). Cost of a Data Breach Report: $4.99M global average, up 12% YoY and a record high.
  12. Verizon (2022). Payment Security Report: 43.4% of organisations maintained full PCI DSS compliance (2020 data).
  13. Ponemon Institute / Thales (2010). PCI DSS Trends 2010, QSA Insights: average annual QSA assessment cost for Tier 1 merchants ~$225k, excluding technology, operating and staff costs; 10% paid $500k or more.
  14. Shuttle (2026). Headless/composable platform PCI research: 4 of 16 hold public PCI DSS Level 1 attestation.
  15. Harvard Business Review (2017). A Study of 46,000 Shoppers Shows That Omnichannel Retailing Works: 73% used more than one channel during their shopping journey.