Your Customers Are Giving You Their Credit Cards and Their Phone Numbers. Here Is What Happens With Both.
Security and compliance are not a checklist item — they are the reason a restaurant can trust the platform with the transactions that keep it running. Here is what DineCall AI actually does.
When a restaurant deploys an AI that answers the phone, it is handing that system two things: the customer's credit card, and the customer's voice. Both require different kinds of trust — and the reasons DineCall AI can be trusted with each are specific, not assumed.
Payments — what PCI-DSS compliance actually means
PCI-DSS stands for Payment Card Industry Data Security Standard. It is the set of requirements that any company handling credit card information must meet.
DineCall AI is PCI-DSS compliant; payments are processed through Stripe. The credit card data never touches DineCall's servers in a readable form. Stripe handles the transaction, the authentication, and the storage.
When the card data is never on DineCall's servers, that is a meaningful structural separation, not just a policy.
Call recordings — what AES-256 and TLS 1.3 actually mean
DineCall AI records calls. Call recordings are encrypted at rest and in transit using AES-256 and TLS 1.3.
AES-256 is the Advanced Encryption Standard at 256-bit key length — the same specification used by governments and financial institutions for data that cannot be exposed. "At rest" means the recordings stored on disk are encrypted; even if someone accessed the storage layer, the files would be unreadable without the decryption key. TLS 1.3 is the current version of the Transport Layer Security protocol — the encryption that protects data as it moves across a network. TLS 1.3 is faster and more secure than its predecessors.
DineCall also supports local call consent guidelines through optional voice disclosures. One-party consent states allow a single party to a conversation to record it; two-party consent states require all parties to agree. The optional disclosure feature lets restaurants configure the AI's behavior to match their state's requirements.
API security — what vulnerability scanning means in practice
DineCall runs frequent automated vulnerability scans against its core API layer. This is a continuous process, not a one-time audit — new vulnerabilities are discovered regularly in all software, and automated scanning is the tool that catches them before they become incidents.
The API is the layer that connects DineCall's platform to the restaurant's POS, the kitchen board, and any custom integrations. Protecting it matters because that is where order data, customer phone numbers, and reservation details move through.
Customer data — who owns it
The customer data — every phone number, every order history, every profile — belongs to the restaurant. This is structurally different from a third-party delivery platform, where the customer relationship lives inside the platform and the restaurant has limited access to it.
For a restaurant building a direct relationship with its regulars — through caller recognition, repeat order history, and reservation follow-up — the data being owned by the restaurant is the prerequisite that makes all of it possible.
What the restaurant needs to do
Not much. DineCall is deployed as a hosted service across North America — United States and Canada. The restaurant does not install anything on-premise. API documentation and integration guides are available through the Owner Dashboard.
The restaurant's responsibility is limited to keeping their DineCall dashboard credentials secure and configuring voice consent disclosures to match their state's requirements if they operate in a two-party consent state.
Questions go to hello@dinecall.ai.
FAQ
Q: Who processes the payments? A: Stripe, which is PCI-DSS compliant. DineCall does not store raw credit card data.
Q: Are call recordings encrypted? A: Yes. Call recordings are encrypted at rest using AES-256 and in transit using TLS 1.3.
Q: Does DineCall record calls in two-party consent states? A: DineCall supports optional voice disclosures. Restaurants are responsible for configuring the disclosure to match their state's requirements and for obtaining any consent required by applicable law.
Q: Who owns the customer data? A: The restaurant. All customer profiles, order history, and phone numbers belong to the restaurant.
Q: What security auditing does DineCall do? A: Frequent automated vulnerability scans are run against the core API layer. API documentation is available in the Owner Dashboard.
Q: Is there a cost difference based on compliance requirements? A: No. PCI-DSS compliance, call encryption, and API security are part of the platform, included in the flat monthly fee.