Compliance Impact: ✅ Satisfies PCI-DSS requirement 1.3 (network segmentation)
2. Private Service Connect (Private API Access)¶
Purpose: Access GCP APIs over private RFC 1918 IPs instead of public internet.
Before (Public API Access):
User/WxCC → api.google.com (Public IP: 142.250.x.x) → GCP Service
Security: TLS 1.3, but DNS/routing over public internet
After (Private Service Connect):
User/WxCC → api.p.googleapis.com (Private IP: 10.200.100.10) → GCP Service
Security: Traffic never leaves Google backbone, private routing
Implementation:
# Create Private Service Connect endpoint
resource "google_compute_global_address" "private_service_connect" {
name = "psc-vertex-ai"
address_type = "INTERNAL"
purpose = "PRIVATE_SERVICE_CONNECT"
network = google_compute_network.wxcc_vpc.id
address = "10.200.100.10"
}
resource "google_compute_global_forwarding_rule" "psc_forwarding_rule" {
name = "psc-vertex-ai-rule"
target = "vpc-sc"
load_balancing_scheme = ""
ip_address = google_compute_global_address.private_service_connect.id
## Map all GCP AI APIs to this private IP
service_attachment = "projects/cloud-aiplatform/regions/us-east4/serviceAttachments/all"
}
DNS Configuration (Cloud DNS Private Zone):
## Private DNS zone for Google APIs
api.googleapis.com → 10.200.100.10 (Private)
aiplatform.googleapis.com → 10.200.100.10 (Private)
speech.googleapis.com → 10.200.100.10 (Private)
language.googleapis.com → 10.200.100.10 (Private)
## Public APIs remain unchanged
www.google.com → 142.250.x.x (Public)
Benefit: - ✅ API traffic never traverses public internet - ✅ Reduced latency (~5ms improvement) - ✅ No exposure to DDoS attacks on public Google IPs
3. Cloud Data Loss Prevention (DLP) - PII Redaction¶
Purpose: Automatically detect and redact PII from call transcripts before storing in BigQuery or exporting to Splunk.
PII Types Detected:
| PII Type | Example | Redaction Method |
|---|---|---|
| Credit Card | "4111-1111-1111-1111" | [CREDIT_CARD] or Last 4 digits only |
| SSN | "123-45-6789" | [US_SOCIAL_SECURITY_NUMBER] |
| Phone Number | "+91-98765-43210" | [PHONE_NUMBER] |
| "customer@example.com" | [EMAIL_ADDRESS] |
|
| Person Name | "John Smith" | [PERSON_NAME] or First name only |
| Address | "123 Main St, Mumbai" | [STREET_ADDRESS] |
| Date of Birth | "1985-03-15" | [DATE_OF_BIRTH] |
Implementation Flow:
┌─────────────────────────────────────────────────────────────────────────────┐
│ CLOUD DLP REDACTION PIPELINE │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ① Call Recording → Vertex AI Speech-to-Text │
│ Output: Raw transcript │
│ "Hi, my name is John Smith and my credit card is 4111-1111-1111-1111" │
│ │
│ ▼ │
│ │
│ ② Cloud DLP API Inspection │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ DLP Inspection Config: │ │
│ │ • PERSON_NAME: Confidence > 80% │ │
│ │ • CREDIT_CARD_NUMBER: Luhn algorithm validation │ │
│ │ • Custom regex: Abhavtech customer ID format (ABV-\d{6}) │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
│ ▼ │
│ │
│ ③ De-identification Transformation │
│ Method: REPLACE_WITH_INFO_TYPE (replace PII with placeholder) │
│ Output: "Hi, my name is [PERSON_NAME] and my credit card is │
│ [CREDIT_CARD_NUMBER]" │
│ │
│ ▼ │
│ │
│ ④ Store Redacted Transcript │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ BigQuery Table: wxcc_analytics.call_transcripts │ │
│ │ ────────────────────────────────────────────────────── │ │
│ │ call_id | transcript_redacted | pii_found │ │
│ │ ─────────────────────────────────────────────────────────│ │
│ │ CALL-12345 | "Hi, my name is [PERSON_NAME]"| TRUE │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
│ ⑤ Original Audio + Metadata Stored Separately (Secure Bucket) │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Cloud Storage: gs://wxcc-recordings-pii-restricted/ │ │
│ │ ────────────────────────────────────────────────────── │ │
│ │ • Access: Only QA team + compliance officers │ │
│ │ • Encryption: CMEK (customer-managed keys) │ │
│ │ • Audit: Every access logged to Cloud Audit Logs │ │
│ │ • Retention: 90 days, then auto-delete │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Code Example (Python - Cloud Function):
from google.cloud import dlp_v2
from google.cloud import bigquery
def redact_and_store_transcript(call_id, raw_transcript):
"""
Redact PII from call transcript before storing in BigQuery.
"""
dlp = dlp_v2.DlpServiceClient()
project_id = "abhavtech-wxcc-prod"
## Define PII types to detect
inspect_config = {