Encrypted card devices and recurring payments

Typo…first sentence should say

when you add a credit card to a customer’s account, you are “storing credit card data” in PCI terms

I had inserted the word “not” but you actually are storing when you enter the card in manually. Unless you then tokenize them with the utility.

FYI…when you add a credit card to a customer’s account, you are not “storing credit card data” in PCI terms. That affects your scope. But the biggest thing that affects the scope is the method of sale. The PCI questionnaires are determined by HOW you process credit cards. There are questionnaires for online only, phone and mail only, but not one that is for both. That means you have to do Questionnaire D which is the longest one. However, if you are using tokens AND not storing any credit card data, then you can skip a lot of those questions.

From: Tessitura Technical Forum [mailto:forums-technical@tessituranetwork.com] On Behalf Of Brian Parker
Sent: Thursday, February 09, 2017 1:55 PM
To: Gloria Ormsby <gormsby@flynncenter.org>
Subject: Re: [Tessitura Technical Forum] Encrypted card devices and recurring payments

Lou,

We are also a RAMP client and when we manually enter a credit card for a gift or payment, the credit card information is stored on the constituent's record.

We are able to create payment schedules which use the credit card on the constituent's record to process payments against a pledge on any kind of schedule.

This is PCI compliant because six digits of the credit card number are anonymized in the Transactions tab -> Credit Cards radio button in Tessitura; plus, only authorized users accessing the database through a RAMP login, the RAMP token, and Tessitura login can get in.

Let me know if I can better explain anything here.

Thank you,

Brian

Typo…first sentence should say

when you add a credit card to a customer’s account, you are “storing credit card data” in PCI terms

I had inserted the word “not” but you actually are storing when you enter the card in manually. Unless you then tokenize them with the utility.

FYI…when you add a credit card to a customer’s account, you are not “storing credit card data” in PCI terms. That affects your scope. But the biggest thing that affects the scope is the method of sale. The PCI questionnaires are determined by HOW you process credit cards. There are questionnaires for online only, phone and mail only, but not one that is for both. That means you have to do Questionnaire D which is the longest one. However, if you are using tokens AND not storing any credit card data, then you can skip a lot of those questions.

From: Tessitura Technical Forum [mailto:forums-technical@tessituranetwork.com] On Behalf Of Brian Parker
Sent: Thursday, February 09, 2017 1:55 PM
To: Gloria Ormsby <gormsby@flynncenter.org>
Subject: Re: [Tessitura Technical Forum] Encrypted card devices and recurring payments

Lou,

We are also a RAMP client and when we manually enter a credit card for a gift or payment, the credit card information is stored on the constituent's record.

We are able to create payment schedules which use the credit card on the constituent's record to process payments against a pledge on any kind of schedule.

This is PCI compliant because six digits of the credit card number are anonymized in the Transactions tab -> Credit Cards radio button in Tessitura; plus, only authorized users accessing the database through a RAMP login, the RAMP token, and Tessitura login can get in.

Let me know if I can better explain anything here.

Thank you,

Brian