There is an awkward moment in a perfectly ordinary customer-service call. The problem is sorted. The booking is ready. Now someone needs your card number. PCI Pal has built its business around making that moment less revealing: the customer pays, the agent helps, and the sensitive digits stay out of the contact center.
The mechanism is wonderfully unglamorous. Press the numbers on a telephone keypad. PCI Pal captures the payment information and masks the tones that would otherwise disclose it. The agent can follow progress without acquiring the secret. In software, a screen full of asterisks can be a feature worth buying.
This is a specific corner of financial technology: securing payments made during business communications. Retailers, travel companies, insurers, utilities and public bodies all have reasons to collect money while talking to someone. PCI Pal supplies the protective software between that conversation and the payment provider.
The conversation stays. The card number leaves.
Its core Agent Assist product lets the representative remain on the call while the customer enters card details. The interface shows masked input and progress. Once the agent submits the transaction, the connected payment provider processes it. PCI Pal’s job is to keep the sensitive information away from the systems and people that do not need it.
That distinction explains both the product and the purchase. A business still needs a payment-provider relationship. PCI Pal supplies secure capture and integration around it. For a contact-center manager, the attraction is a payment step that preserves assistance. For a security team, the attraction is a smaller environment exposed to card data.
There are other entrances to the same system. PCI Pal Digital, launched in February 2020, generates secure payment links for channels including webchat, email, SMS, social media and WhatsApp. The customer enters details on a secure page; the agent can track progress. It turns a conversation already under way into somewhere a purchase can finish.
IVR Payments handles automated telephone journeys, including payments outside staffed hours. Speech recognition offers an alternative to keypad entry. The practical question is which route fits the caller and the task: pressing, speaking or opening a link. A payment flow needs to accommodate the person using it, as well as the software receiving it.
The coach operator that had already gone cloud
National Express makes the problem concrete. According to 8x8’s customer account, the coach operator had already moved its contact center to another cloud vendor. That service did not directly support its payment-data privacy and compliance requirements. Sending employees home during the pandemic made the gap harder to ignore.
What changed the buying decision was a demonstration of 8x8’s secure payment capabilities. National Express adopted 8x8 Contact Center for its 100-person customer-service team in early 2021, adding Secure Pay powered by PCI Pal. The wider deployment, including training, took two months. Salesforce integration helped connect communications with customer records.
“Agents just need a laptop and headset, and they can securely connect to 8x8 from anywhere.”Lawrie Neal / National Express, via 8x8
The account reported that 80 percent of employees were working remotely, compared with a largely office-based workforce before the pandemic. That is evidence about this customer’s deployment, rather than a universal promise about rollout speed. Its useful lesson is more precise: moving communications to the cloud had not, by itself, settled how payments should work.
GoSee offers a second illustration. The travel-booking business selected Agent Assist as part of an 8x8 telephony upgrade, seeking to preserve personal service while improving payment safeguards. In both cases, security was tied to an existing operational change. The payment product entered through the same door as the communications platform.
How to grow inside somebody else’s sale
That door is central to PCI Pal’s strategy. It builds relationships with the companies that already supply contact-center and communications software. A reseller can bring the payment capability into a larger contract. The end customer gets an integrated workflow; PCI Pal gets access to a buyer through a supplier with an established relationship.
In November 2023, PCI Pal announced a strategic reseller agreement with Zoom, covering its agent-assisted and digital products. The structure matters: a specialist does not have to persuade every buyer to begin an entirely separate technology search. It can become a useful answer when the buyer asks a larger vendor how payments will work.
On July 30, 2026, PCI Pal announced Strategic DEVone Partner status within NiCE’s CXexchange. It said integrated solutions were available through the marketplace and customers’ existing NiCE contracts. Voice, digital channels and AI interactions all featured in the announcement. Integration is part of the product; procurement convenience is part of the pitch.
Competitors can make similar arguments. Eckoh’s CallGuard also masks sensitive information while an agent remains in contact, and its portfolio includes digital links and payment IVR. Sycurio is another specialist alternative. PCI Pal’s case therefore rests on the suitability of its cloud platform, integrations and partner relationships, rather than exclusive ownership of the idea of secure telephone payments.
A business built by narrowing its job
The corporate roots reach back to 1999, but the current business took shape much later. In 2016, the group sold its Ansaback and CallScripter operations for £6.7 million and adopted the PCI-PAL name. A company with contact-center experience concentrated on a particular problem those centers faced.
James Barham helped develop the PCI Pal business and establish its North American operation before becoming Group CEO in October 2018. Geoff Forsyth contributed to the technology’s development and held CTO and CISO roles. The history helps explain the focus: this was a payment-security business emerging from communications work.
Its internal practices also reflect a company trying to make specialist knowledge repeatable. A 2019 results statement described development reviews, more training and a dedicated People and Development Manager. Employee objectives and key results followed. Those are management’s documented practices, a more useful glimpse of culture than assuming everyone shares the mood of a corporate photograph.
The subscription, the expansion and the legal bill
PCI Pal earns revenue from software subscriptions and related services, with charges shaped by the deployment and contract. One unusually concrete disclosure came in December 2019: a three-year US agreement with annual contract value of $566,000 for an organization with more than 5,000 contact-center agents. It covered Agent Assist and IVR, with licence and professional-services invoicing described in the announcement.
That historical enterprise deal is a sense of scale, not a menu price or a reliable per-seat calculation. Buyers need to specify channels, payment gateways, integration work and service requirements before comparing offers. The cheapest-looking software figure can say little about the cost of making the whole payment journey work.
Expansion needed capital too. An April 2021 equity fundraising brought in £5.5 million gross to support moves into Canada, Australia and mainland Europe. A March 2024 placing raised £3.5 million gross. These were public-market fundraisings for an AIM-listed company, rather than venture rounds with a startup valuation attached.
Then there was the patent dispute. PCI Pal’s 2024 reporting put legal fees and associated costs at more than £4.3 million gross, or £3.3 million net of a High Court award. The company prevailed in the UK proceedings and on appeal; a confidential June 2024 settlement resolved the remaining UK and US litigation with Sycurio. The cash cost was substantial even with that outcome.
By FY2025, the platform served more than 700 customers and reported £22.48 million in revenue; recurring contracts accounted for 91 percent. The July 2026 update estimated FY2026 revenue at £24.6 million and ARR at £24.4 million. ARR describes an annualized recurring base, not the revenue booked during that year.
The same update expected adjusted EBITDA of about £1.1 million, down from approximately £2.3 million, reflecting continued investment. Growth was being purchased with spending on distribution, marketing and product development. That tradeoff is more informative than treating a rising revenue chart as proof that every financial measure must rise with it.
The next caller may be software
In March 2026, PCI Pal announced plans to embed secure payments in Zoom Virtual Agent. The stated aim was to let customers complete transactions during automated interactions while keeping sensitive data out of the organization’s environment. The announcement described a planned integration, so it should be read as product direction rather than evidence of a completed rollout.
June brought another move: passkey customer authentication. The announced capability verifies identity during calls and digital sessions before sensitive actions proceed. It extends PCI Pal’s attention to the person making the request. Protecting card details and establishing who is asking are separate jobs, even when they happen in the same conversation.
There is a practical limit to the promise. PCI Pal’s own integration guidance says a partner listing does not mean every product variation and deployment works out of the box. Customer environments and processes need review. A mismatched gateway, inaccessible payment journey or poorly configured call flow still needs engineering attention.
What readers can borrow is a method: isolate the sensitive step, preserve the useful human interaction, and fit the protection into systems people already use. For a software founder, there is a distribution lesson alongside it. Become useful to the vendor already in the room. PCI Pal has made a business of helping that vendor answer a small, consequential question: how will the customer pay?