Indian lenders and insurers now let software place EMI reminders and policy renewal calls. Before dialling, the AI calling consent rules in India (TRAI) decide whom you may call and when. AI voice agent security covers what happens next, once a caller's voice, words and numbers reach your systems.
This guide works backward from one moment, 14 months after a call. A regulator, auditor or upset borrower asks to hear it. What you can hand over, and what you should already have erased under DPDP, is your real posture.
That moment is getting closer. MeitY notified the DPDP Rules in November 2025 and gave businesses an 18-month runway. That runway ends on 13 May 2027, when duties on notice, consent and security safeguards begin.
Start From the Audit Request: What AI Voice Agent Security Has to Prove
Strong AI voice agent security lets you answer five questions about any disputed EMI call within one working day. So design work starts with those questions, and a disputed EMI is the test case.
To make this concrete, picture an illustrative lender we will call Kaveri Finserv. It is a mid-size NBFC in Pune whose AI agent places about 12,000 EMI reminder calls a week. Some borrowers also make part-payments during those calls.
Now imagine one borrower disputes a part-payment 14 months later. Kaveri's three-person compliance cell then needs fast answers on these points:
Whether the borrower heard, within seconds, that an AI was speaking and the call was recorded.
Which disclosure script played, and whether the borrower agreed, objected or asked for staff.
Who opened the recording or transcript after the call ended, and the reason they gave.
Where the card digits the borrower read aloud exist today, if they exist anywhere.
Which prompt version and model version were running on the agent that afternoon.
If any answer needs a Kaveri developer to dig through raw server logs, the architecture has a gap. Another policy PDF for Kaveri's board will not close it.
Every later section maps to one of those five answers about Kaveri's call. That mapping is how a lender should scope AI voice agent security during procurement.
Six Copies of One Call: How a Voice Agent Moves Caller Data
A single 3-minute EMI reminder can leave six separate artefacts behind. Each of those 6 artefacts needs its own lock, retention clock and access list.
Here is the path a Kaveri call takes, in the order the data appears:
Live audio: borrower speech crosses the carrier's SIP trunk as media packets, which SRTP can encrypt.
Speech-to-text: a transcription engine converts each spoken turn into text, the second copy of the call.
Language model: that transcript becomes part of a prompt, so the model provider may log or cache it.
Tool calls: the agent reads Kaveri's loan record and posts payment details into its lending system or gateway.
Voice reply: the agent's answer becomes synthetic speech in Hindi or English, often via a separate vendor.
Storage: the full recording, transcript, analytics summary and system logs land in long-term storage.
Count the vendors behind those six copies as well. In many deployments, the speech, language and voice engines come from three different sub-processors. Each of them sees a borrower's PAN unless redaction happens upstream.
The copies teams forget most often are debug logs and any datasets a vendor keeps for tuning speech-to-text models. Because of that, Kaveri's AI voice agent security review should open with a data-flow diagram, not a demo.
Encryption and Role Access for Every Copy of a Voice Agent Call
Encrypt every hop and every store a Kaveri call touches. Then keep the list of people who can hear raw audio short enough to name. Both halves matter for AI voice agent security, because encryption does nothing against an insider with a valid login.
Locking SRTP streams and stored recordings for a voice agent
In transit, ask for TLS 1.2 or later on signalling and API traffic, plus SRTP on the media stream. At rest, AES-256 is the common baseline for recordings and transcripts.
The harder question is who holds the keys. With customer-managed keys, where offered, Kaveri could revoke access to old recordings without waiting on a vendor ticket.
Deciding who can press play
At Kaveri, access should follow the job, not seniority. For Kaveri, a sensible split might look like this:
Collections staff see a masked transcript and the call outcome, never the raw recording.
QA reviewers play audio only for a sampled 2% of calls, and each playback writes a log entry.
Engineers debug with synthetic or redacted test calls, so real borrower audio never reaches ticketing tools.
Break-glass access for a dispute needs a second approver and expires after a fixed window.
For AI voice agent security at a lender Kaveri's size, here is a practical test. If more than a handful of named people can play any recording on demand, access is too broad.
PII Redaction Calls Your Team Has to Make Before Go-Live
Redaction is a set of decisions, not one switch. In AI voice agent security, those decisions cover what to detect, where to strip it, and what replaces it. Kaveri's team would need to settle four before launch:
What counts as sensitive: PAN and Aadhaar first, then card numbers, CVV, bank details, home address and birth date.
Where to strip it: live transcripts before the prompt, stored audio, Kaveri's analytics exports and application logs.
When to strip it: in real time for anything the model reads, and within 24 hours for archives.
What replaces it: typed labels such as [PAN_1] keep transcripts readable for QA without exposing values.
Sometimes the agent genuinely needs a value, for example to match a PAN against the loan file. A token vault handles this case well. The model sees only a token, while a separate service holds the real value and runs the check.
Card data raises the stakes further. If Kaveri keeps audio of a borrower reading out a CVV after authorisation, it breaks PCI DSS Requirement 3.3.1. The PCI Security Standards Council's FAQ 1210 adds that encrypting that audio does not fix the problem.
So the cleaner design keeps card digits off the recording from the start. Keypad entry with masked DTMF tones, or a payment link sent by SMS, both achieve this.
Where code-mixed Indian calls trip up a voice agent's redaction
Pattern matching works well on a neatly formatted ten-character PAN. However, real borrowers rarely speak that neatly. Test for these edge cases on Kaveri's own recordings before go-live:
Digits split across turns, when a borrower reads four numbers, pauses, then reads the rest.
Code-mixed numbers, where a caller switches between Hindi and English words in one sequence.
Self-corrections, where the borrower gets a digit wrong and then restates the whole number.
Transcription slips that turn part of a 16-digit card number into words the detector ignores.
Ask each vendor for detection results on Indian, code-mixed test calls. A score from a clean English benchmark tells you little about Kaveri's real callers.
Consent and Recording Disclosure in the First Ten Seconds of AI Calls
Within the first 10 seconds, tell the borrower three things. An AI is on the line, you are recording the call, and here is why. Then offer a quick route to a person.
The DPDP Act already expects a clear notice naming the personal data collected and the purpose. A generic recording line copied from an old IVR rarely names the purpose clearly enough for a lender.
For Kaveri, the opening could say that this is the lender's automated assistant calling about an EMI. It would add that the call is recorded to document payments, and that pressing 0 reaches staff.
Store each consent event as structured data, not just as audio. A useful record holds these three fields:
The disclosure script version and language, such as v3 in Marathi, that played on this call.
The borrower's response, including silence, an objection, or pressing 0 to reach staff.
A timestamp drawn from the same clock that the recording and the audit log use.
Also decide in advance what happens when a borrower objects halfway through. One defensible option is to stop recording, keep a short text summary, and book a human callback.
Sector rules add their own layer to call recording compliance. In November 2025, TRAI told regulated lenders to shift service and transactional calls to the 1600 number series. Commercial banks had until 1 January 2026, while the remaining NBFCs had until 1 March 2026.
An AI agent placing Kaveri's reminder calls would need to dial from that series too. This explainer on AI call center software and TRAI compliance covers how dialling platforms fit these rules. Consent evidence is where AI voice agent security and legal compliance overlap most.
Audit Trails That Survive a 14-Month-Old Complaint
A useful audit trail ties together the call, everyone who touched it, and the configuration running that day. Logs that miss any one of these leave Kaveri guessing.
Several Indian rules set the clocks for those logs. This table maps each one to Kaveri's situation:
Situation at Kaveri | What the rule asks for | Where the rule comes from |
Ordinary call-processing records for every borrower | Keep personal data, traffic data and processing logs for at least one year | DPDP Rules 2025, Rule 8(3) |
Platform, SIP and network logs from Kaveri's voice stack | Retain system logs on a rolling 180-day basis, stored within India | CERT-In directions issued in April 2022 |
A suspected leak of Kaveri's stored call recordings | Report the cyber incident to CERT-In within 6 hours of noticing it | CERT-In directions issued in April 2022 |
A confirmed breach exposing Kaveri borrowers' PAN or account data | File a detailed report with the Data Protection Board within 72 hours | DPDP Rules 2025 |
Within Kaveri's logs, capture these events at minimum:
Every playback, download or export of a recording, with the user, reason and time.
Each redaction event, including the entity type detected and the confidence score.
Prompt and model changes, such as v14 replacing v13, with approver and go-live time.
Consent outcomes and every handoff from the AI agent to a human staff member.
Write these entries to append-only storage, so nobody at Kaveri or the vendor can quietly edit history. Hash-chained logs also make any deletion visible to the compliance cell. Without such entries, claims about AI voice agent security rest on trust rather than evidence.
Keeping one year of logs without keeping the call
Note one tension here. DPDP expects erasure once a purpose ends, yet it also expects processing logs for a year. Keeping logs and call content in separate stores lets Kaveri delete one without losing the other.
Logs answer who did what on one disputed EMI call. Trends across 12,000 weekly calls need a different view, ideally built on redacted text only. When you evaluate Call analytics, check that dashboards draw on redacted transcripts rather than raw ones.
Where Voice Agent Safeguards Still Fall Short
Even Kaveri's carefully built stack would leave gaps, and buyers should plan for them openly. Good voice AI security planning assumes some controls will fail, then names who at Kaveri catches each failure.
These are the weak spots worth naming in Kaveri's risk register:
Redaction recall is rarely perfect, so stray PAN or account digits may reach transcripts.
A cloned voice can sound like the borrower, so voice alone is weak proof of identity.
Spoken prompt injection, where a caller's crafted phrasing pushes the agent to disclose another borrower's EMI details.
A speech-to-text sub-processor you never signed with may keep Kaveri's caller audio under its own terms.
A vendor's ISO 27001 or SOC 2 Type II report covers the vendor, not your configuration.
For a lender, a leaked recording archive is an expensive failure of AI voice agent security. IBM's 2026 breach study put the average Indian breach at Rs 25.5 crore, up 15.9% on 2025.
One more honest point. Some EMI calls are mostly about reading out card details. For that step, an automated voice may be the wrong channel, and DTMF keypad entry often carries less risk.
A Vendor Checklist for AI Voice Agent Security Reviews
Ask for evidence, not adjectives: diagrams, reports, contract clauses and a live redaction demo on your own test calls. The stakes justify the effort. Failing to keep reasonable security safeguards can draw a DPDP penalty of up to Rs 250 crore.
That duty sits with the data fiduciary, which here means Kaveri rather than its vendor. Use the three groups below as a written request list.
Architecture and data location
A data-flow diagram naming every sub-processor that touches audio, transcripts or prompts.
Whether Kaveri's recordings, transcripts, logs and backups stay in India, and in which cloud region.
Written confirmation that caller data trains no shared model without Kaveri's explicit opt-in.
Redaction and recording controls
Redaction results on 50 of Kaveri's own code-mixed test calls, with every miss listed.
Separate retention settings, so Kaveri's audio can expire after 60 days while logs last a full year.
Support for keypad or link-based payments that keep card digits out of every recording.
Proof and contract terms
A current ISO 27001 certificate and SOC 2 Type II report, including the scope page.
A data processing agreement with breach notice fast enough to protect your 72-hour window.
Tamper-evident audit logs that your team can export without raising a support ticket.
For a lender Kaveri's size, these items usually sit in an enterprise contract rather than a self-serve plan. If you are comparing options, run the same 9-item list against OnDial for Enterprise and every other shortlisted platform.
Then score each vendor on one sheet, with the 50-call redaction test weighted highest. Treat those scores as Kaveri's record of how AI voice agent security compared across the shortlist.
Bring Your Messiest Calls to the Shortlist
A 2-week pilot exposes more about AI voice agent security than any questionnaire. Pick ten of your hardest real call types, including a disputed part-payment and a mid-call objection. Then Contact sales with that list and ask for the redacted transcript, consent record and audit trail per call.
