Salesforce Decode
Salesforcedecode
Back to questions
AgentforceExpertpcipaymentscompliance

Review agent collecting payment card data in chat against PCI scope

Real World Scenario

Pilot agent asks users to type credit card number in chat to process payment; security flags PCI scope expansion.

Expected Answer

• Never collect PAN in agent chat or logs — use payment link or tokenized iframe • If payment action exists integrate PCI-compliant payment provider redirect • Redact payment patterns from logs automatically • Agent script redirects to secure payment channel on payment intent • PCI SAQ scope assessment before any payment feature • Train content team prohibited utterances collecting sensitive auth data • Regular scan of conversation samples for PCI data leakage

Follow-Up Questions & Answers

Click to expand — each follow-up includes a direct, interview-ready answer

Direct answer: Never collect PAN in agent chat or logs — use payment link or tokenized iframe Also consider: If payment action exists integrate PCI-compliant payment provider redirect In practice: Redact payment patterns from logs automatically Validate against production-scale constraints and long-term platform evolution.

Architect Perspective

Chat is not PCI channel — architect payment as handoff to compliant capture always.