Airlock: PCI-safe card and eCheck payments for ElevenLabs Agents

In late August 2026, ElevenLabs Agents added caller keypad input. A caller can now press digits during a phone call, which is exactly what a payment needs. The catch is where those digits go: keypad digits are delivered to the agent's language model as an ordinary user message. A card number typed on the keypad becomes text in the model's context window.

ElevenLabs offers a setting for this, redact_input. Its documentation is precise about what it covers: it replaces keypad entries in stored transcripts, logs and analysis, and it says plainly that it

The obvious workaround is to isolate payment in a dedicated sub-agent and hand the call to it. We tested that against real agents.

There is no native secure-capture feature in the ElevenLabs changelog through 2026-09-28. The Stripe integration sends the caller a payment link, which means leaving the conversation to pay. If you want a caller to pay inside the call, the card has to pass through something — and today that something is the model.

Airlock changes what the model receives. Every model request from ElevenLabs goes first to a certified vault, which swaps keypad entries for short-lived tokens before anything else sees them. Below is the whole system, running live.

An ElevenLabs agent has a language model as its brain. With Custom LLM, ElevenAgents hands that thinking to an endpoint you choose, while voice, turn-taking and keypad input stay in ElevenAgents. The model behind it is the merchant's own — any OpenAI-compatible model — not an extra AI added by Airlock. Airlock sets the Custom LLM URL to a vault's inbound proxy. The vault inspects the request before it is forwarded, turns keypad entries into tokens, and passes the rest to Airlock, an open-source service that holds only tokens. Airlock either passes the turn to the agent's model — never with card data — or, during a payment, runs a deterministic capture script itself. To charge, Airlock calls the vault's outbound proxy with token references; the vault fills in the real values and posts to the gateway.

Here is one card payment, step by step.

Payment desk (recommended). The main agent, Scarlett, runs on ElevenLabs' own hosted language model — no Custom LLM, no merchant model. When the caller is ready to pay, she uses ElevenLabs' native transfer_to_agent to hand the call to a payment-desk agent. The desk agent's Custom LLM goes through the vault to Airlock with the header X-Airlock-Mode: desk. On the desk no language model is called at all: Airlock scripts every word — “You're on the secure payment line. Say ready when you have your card or bank details.”, then the total and the keypad prompts (for an eCheck, the name on the account first) — charges through the vault, says “Thanks for calling. Goodbye.” and ends the call with the end_call system tool.

Why the desk ends the call. ElevenLabs re-sends the entire conversation, typed digits included, to whichever agent speaks next; we proved this live for transfers between Custom-LLM agents. The main agent's hosted model is not behind the vault, so the desk must never hand back to it. It ends the call, or could transfer to a person. transfer_to_agent has no option to drop history today.

Full conversation (Custom LLM). Every turn goes through the vault to Airlock, the merchant's own model handles the conversation, and the conversation continues after the payment. That is the design the step-by-step above walks through.

Tokens expire after 10 minutes and are deleted after each attempt. Saved cards and accounts never become long-lived vault tokens: they go to the gateway's own vault, so the only durable copy of a card lives where it would live anyway.

A vault transform can rewrite a request. It can't run a payment. Airlock exists for five jobs:

The alternative is to point the inbound proxy straight at the model and run the whole capture inside the transform. We didn't choose it. All business logic would become card-environment code; state would have to be rebuilt from the re-sent history on every turn; transforms have a 10–30 second limit; and every conversational turn would be buffered.

When ElevenLabs ships native secure capture, jobs 1–4 move into the platform and Airlock disappears.

• Airlock's key can only delete tokens. Detokenization lives on a separate vault application attached only to the fixed-destination outbound proxies, so even a key leaked from the Airlock host cannot send card data to another URL (tested: HTTP 403).
• Card numbers are detected however they are written — separated by spaces, dashes, commas or slashes, typed in other digit scripts, or spoken as words.
• A charge always settles. If the call drops mid-charge, the outcome is still recorded.
• One order cannot be charged twice in a call.
• Unclear gateway outcomes are never reported as “no charge”.
• Confirming a payment requires keypad 1 or a clear yes.

Recorded end-to-end runs against the sandboxes. Open a step to see what the caller typed (redacted here), what Airlock actually received, and what the agent said. Open a charge to see the exact request Airlock sent the vault — token expressions only — and the reduced gateway reply.

The 648 ms median is the full round trip from our test driver through Basis Theory to Airlock on DigitalOcean and back. Almost all of it is the vault hop.

The vault proxy buffers streamed replies. Time-to-first-byte equalled total time in every sample, so a “one moment” sentence streamed by the model cannot be heard early — the caller would hear it together with the result.

So the agent uses ElevenLabs' native soft-timeout fillers instead: “One moment.” at 2.0 seconds, then “Still working on that, thanks for waiting.”, then “Almost there.” They are static text on purpose. The alternative, model-generated fillers, would hand recent conversation context — which may contain keypad turns — to another model.

Cold starts are real. A cold vault runtime added about 10.8 seconds to the first request. Airlock keeps the vault runtimes warm with a ping answered inside the vault, and pre-warms the outbound proxy as soon as the caller reaches the confirm step.

Timeouts need room. ElevenLabs' default cascade_timeout_seconds is 4 seconds (range 2–15). A charge can take longer than that, so the demo agent is set to 15 seconds, and Airlock's capture guard prevents a double charge if ElevenLabs retries the turn.

Airlock itself is free, Apache-2.0 and self-hosted. The vault is the cost.

A payment uses about three tokens, so the Basis Theory base plan covers roughly 6,600 payments a month. Spread over volume:

SAQ A (r1, January 2025) can cover mail- and telephone-order merchants whose account-data handling is fully outsourced to PCI DSS compliant providers. In Airlock's design, card data exists only at ElevenLabs, the vault and the gateway. But Airlock directs the payment flow, so an assessor will likely treat it as security-impacting: expect a reduced set of controls, not zero.

Software isn't PCI compliant; deployments are assessed. This is engineering guidance, not legal advice.

Airlock is Apache-2.0 at github.com/LiftedHoldings/airlock. The provisioning scripts create the vault keys, transforms and proxies, and the ElevenLabs agent.

Everything above exists to stop one thing: keypad digits becoming a model turn. The platform could do that directly.

• A payment tool arms secure capture.
• While armed, keypad entries are held as secret values and never become a model turn. The platform speaks the configured prompts.
• When the fields are complete, it calls the tool's webhook with the secret values substituted server-side — as secret__ dynamic variables already are in tool headers.
• The model receives only approved or declined, the brand and the last four.
• The values are dropped when the webhook returns, and never reach transcripts, logs or analysis.

The webhook can post straight to NMI or Authorize.net, so the gateway's own vault becomes the only token store. No proxy, no $995 a month, no middleware.

Native secure capture also lets the agent keep ElevenLabs' hosted model: no Custom LLM, no vault, no extra model box.

Let transfer_to_agent hand off without keypad turns (or with them redacted in the live context). That alone would let a payment desk hand back to the main agent.