We have an architect flow to support 3 languages. Arabic, English and Russian. We had conducted all the UAT on TTS and now right before going live we have found out that the moment you enable 'Individual Digits' verification, collect input block throws an error saying this setting is not supported. please refer to attached snapshot.
Verification requires architect to have logic for all the flow's language (like what system prompts to use, how to order them). Since architect doesn't currently have that for ar-AE & ru-RU, you need to manually confirm the digits. This does require you to unsecure the variable to play it back to the caller. It's now your responsibility as the flow owner to not use it unsecurely, i.e. don't set it in a Set Participant action, etc. Name the variable something like Task.unsecureCreditNumber and only use it for the verification & nowhere else.
By making the variable unsecure , the entire payment ivr flow becomes unsecure ?
Depends on what you do with it. There are valid reasons for allowing you to unsecure a variable, like this or wanting to check the length of a credit card number before sending it off through the Call Secure Data action. You become responsible for not using it in a Set Participant action, Call Data action, Data Table Lookup action, etc.
By making the variable unsecure will anyone having access to the organization be able to retrieve the credit card details ?
No. If you do something like using the Set Participant Action with the unsecure variable, then the value will be written onto the conversation object. This would allow anyone with the appropriate permissions to see that value.
By making the variable unsecure will the solution still be PCI DSS & GDPR compliant ?
PCI depends on you & what you do with the unsecure variable. GDPR covers user identity-type info (name, email, phone number, address etc.) not credit card numbers. I suppose you could insert the credit card number into an address field for example (Architect does not have an action for that but you could probably write a data action to do it). If you were to do something weird like that, GDPR would be able to search & delete the credit card number.
By when shall we expect support for "Arabic" and "Russian" language ?