What does PCI standand for?
It is actually PCI-DSS (Payment Card Industry Data Security Standards)

Does software have to be accredited as PCI (PCI-DSS)?
NO!

PCI is ANY individual business declaration of having standards and procedures in place to handle credit card data that it stores or processes.

What accreditation does software need to show it meets PCI Standards?
PA-DSS (Payment Application Data Security Standard)

Can any company simply state that their software for sale meets PCI standards?
No - A company which sells software must state that the software is PA-DSS and it must be independently tested, verified and certified by by a QSA (Qualified Security Assessor) that is accredited by the PCI council. In order to be judge compliant, the application should be listed on the PCI website. The software company should then place their latest accreditation documentation on their own website. If they cannot supply the documentation from the council and are not listed on the councils website, the software may not be compliant.

So what does it mean if the software is not PA-DSS?
It means any company which purchases that software and tells it’s bank that it has PCI compliant software is liable if anything happens because they have not performed their due diligence

Does DigitalRez have PA-DSS certification for its’ software?
DigitalRez has spent over $350,000 and 9 months making sure all of its’ systems are PA-DSS compliant ,independently tested and verified.

Any Software companies individual statement of PCI compliancy has nothing to do with their software products being compliant (Unless they store or process credit card data on behalf of a client)

DigitalRez have made a declaration stating that we do NOT keep or store any users’ credit card information.

A third party system which is fully certified and verified is used for storing the credit card information (www..Jetpay.com – they are the 5th largest credit card processors in the USA and process credit card transactions worldwide for Expedia)

At no time does the credit card information touch any of our servers online… but it is passed to the front desk system at your resort securely directly from Jetpays secure servers.. (we had to create new technology to make this happen)

When this happens it is subject to YOUR PCI declaration. The software is fully PCI compliant capable …. Which means that you have to use it in a compliant way. For instance:

Do you have advanced securities configured (can all staff access payment screens reports etc and take payments?)
Do you have your credit card retention policy set within the program (delete all, after a certain time etc)
Do all users have their own login usernames and passwords

The software stores all CC data compliantly, fully tested and verified (see attached documentation links below)

Now you have the PA-DSS documentation to complete this piece of  YOUR PCI puzzle you need to configure the software to meet your PCI compliancy declaration.

DigitalRez have a policy of NOT storing any credit card numbers in any of our software systems, or hard copies that we use to conduct business, including our online system.

Our consultant has advised us (after verifying the process) that DigitalRez International and its’ subsidiaries are not in scope for PCI because we never store or process any CC information on behalf of any client through any of our systems.

View the latest DigitalRez PA-DSS product Certification by clicking below


ROS2006 (click here)
RVTripsetter (click here)
RezExpert 7.1 (Click here)