P2PE

Point to point encryption is a form of security developed primarily for financial transactions where a purchaser’s details are used digitally to effect a transaction. The problem of credit and debit card fraud has existed for as long as the cards themselves and the Payment Card Industry (PCI), which was established as a self-regulating industry body in 2006, keeps its compliance regime under constant review in an attempt to stay one step ahead of cyber criminals. Card holder data remains vulnerable to hacking and failures in data security, with 1.5 billion breaches recorded during one month in 2020. P2PE solutions are regularly updated to combat this assault and although not all P2PE measures are accredited by the PCI, the organisation does recognise the validity of the most effective ones.

P2PE is a process whereby a cardholder’s details are encrypted as soon as the card is used in a transaction at the merchant’s payment terminal. It remains encrypted for the duration of its journey to the company that processes the payment. This makes it inaccessible to hackers while transmission takes place, a time when it would ordinarily be vulnerable to interception. Even if a hacker were to capture the information, encryption would render it useless. Specialist providers of P2PE solutions ensure that all software and hardware involved in digital transactions satisfy the criteria of P2PE compliance. To achieve PCI validation, every solution must undergo the rigorous assessment of a P2PE Qualified Security Assessor.

The requirements of this regime may sound onerous but in practice, compliance can be much easier than it appears. If your company has adopted a system of point-to-point encryption that has already been authorised and validated by the PCI then you do not need to take any further measures. The responsibility for compliance passes to the provider of the P2PE mechanism, thus freeing you from many of the developmental challenges and relieving you of liability for breaches, which could otherwise attract fines, compensation costs and the suspension or termination of your capacity to take card payments at all.

Gradeon has a long list of satisfied clients whom we have advised and assisted in identifying the P2PE solution that best meets their needs, resources and business practices. We will explain to you why end-to-end encryption is insufficient – not least because it does not meet the requirements of the PCI – and recommend a strategy for getting your company ready for P2PE compliance, either by suggesting effective ways of incorporating P2PE into your own systems or by partnering you with a service provider who can assume all the regulatory responsibilities on your behalf. P2PE compliance is extremely important. Let Gradeon also make it easy.