855.634.4299
[email protected]
110 State Street East
Oldsmar, FL 34677
Facebook.com/pointandpay
Linkedin.com/ point-and-pay
February 18, 2026
VIA PlanetBids
City of Commerce
Alvaro Castellon, Director of Finance & Treasurer
2535 Commerce Way
Commerce, CA 90040
Dear Mr. Castellon:
Point & Pay appreciates the opportunity to respond to the City of Commerce’s RFP No. 26-1001 for Merchant Services. As a leading nationwide provider of progressive payment solutions for governments, courts, utilities, and other agencies, we are confident our combination of best-in-class products, integration capabilities, and high-quality service meet and/or exceed the City’s requirements. We provide key points from our proposal below.
➢ DELIVERING AN EXCEPTIONAL CUSTOMER EXPERIENCE
Point & Pay’s solution drives new levels of customer engagement that offers a convenient way to make in-person and phone payments.
➢ ENABLING EFFICIENT ADMINISTRATIVE OPERATIONS
Our payment solution will allow the County to streamline revenue collection, increase the receipt of payments, and lower costs to customers.
➢ PROVIDING A SECURE, INTEGRATED, AND HOSTED SOLUTION
We are proud to partner with software partners nationwide and have integrated our solutions for numerous California clients statewide. Additionally, all of our payment solutions are PCI-DSS and SOC compliant.
Point & Pay serves numerous governments throughout California, and Julie White at Plumas County applauded us by stating: “The Point & Pay team ensured a successful integration, and we are so happy with how the notes auto-generate into the system. Their reports are amazing, not to mention the customer service - another awesome. I highly recommend their solution for a seamless integration experience!” We now welcome the opportunity to partner with the City of Commerce to provide an innovative payment solution that increases efficiencies, enhances customer services, and delivers better electronic payment capabilities.
Mark Ruis, Director of Sales - Western Region, is authorized to represent Point & Pay in this procurement and is available by phone at 503.236.7069 and by email at [email protected].
Best regards,
Kevin Connell
Chief Executive Officer
CITY OF COMMERCE, CALIFORNIA
PURCHASING DEPARTMENT
RFP 26-1001
MERCHANT SERVICES
FEBRUARY 19, 2026 | 4:00 PM PST
855.634.4299
110 State St. East
Oldsmar, FL 34677
[email protected]
City of Commerce, CA i RFP No. 26-1001
TABLE OF CONTENTS
EXECUTIVE SUMMARY...............................................................................................1 1 BUSINESS INFORMATION......................................................................................3 2 EXPERIENCE/QUALIFICATIONS INFORMATION............................................................4 3 PROJECT APPROACH/METHODOLOGY...................................................................13 4 ADDITIONAL INFORMATION REQUESTED ................................................................19 5 REFERENCES ...................................................................................................57 6 PRICING PROPOSAL ..........................................................................................59 7 SIGNATURE ....................................................................................................59 City of Commerce, CA 1 RFP No. 26-1001
EXECUTIVE SUMMARY
Point & Pay understands the City of Commerce, California seeks to establish a contract with a qualified merchant service provider that can fulfill the Scope of Services identified in Attachment I. We understand the City currently has one merchant location that accepts in-person payments for a variety of services, but customers also pay online and over the phone.
Point & Pay is proud to serve our clients as a solution builder, payment expert, and consulting resource by learning their unique needs and customizing a solution that satisfies all specifications. Our suite of products and services, coupled with our team of highly experienced, highly capable industry veterans, delivers on those needs. As a premier payments partner with several government agencies throughout California, Point & Pay offers a seamless and comprehensive implementation experience. Our dedicated project team demonstrates an in-depth knowledge of software requirements and how to effectively interface our solutions with the City’s system. Below, we highlight the benefits of a partnership. 1 NEXT GENERATION COLLECTIONS PRODUCT
Point & Pay’s mobile-dynamic Collect solution drives new levels of customer engagement with a modern interface and intuitive features.
2 EFFICIENT ADMINISTRATIVE & FINANCIAL OPERATIONS
Our payment solution will allow the City to streamline revenue collection, maintain accurate accounting records, increase the receipt of payments, and lower costs to customers. 3 EXTENSIVE INTEGRATION EXPERTISE
Point & Pay has integrated numerous solutions seamlessly and has lengthy partnerships with software providers nationwide. We identify the most favorable data exchange strategies for an effective interface with clients’ financial systems.
4 COMPREHENSIVE & CUSTOMIZABLE REPORTING SYSTEM
Point & Pay’s suite of robust reporting tools enables real time, ad hoc, and file-based reporting with 24/7 access using our secure and password-protected website. 5 TRAINING TO SUPPORT THE SOLUTION EFFECTIVELY
Point & Pay will use direct training for all system functionality, including web conference sessions, hands-on, practical learning in the demo environment, and recorded training via URL. 6 PCI-DSS LEVEL 1 AND SOC 2 COMPLIANT
We undergo annual audits for both PCI and SOC compliance and utilize several secure methods to encrypt sensitive customer data.
7 EXCEPTIONAL CLIENT SUCCESS AND TECHNICAL SUPPORT
Point & Pay makes it a priority to provide exceptional customer and technical service support to our clients and their customers to ensure complete satisfaction.
We welcome future discussions with the City to learn how our payment products provide simplicity and ease of adaptation for new services, improve communications with staff and customers, and drive significant cost savings for the City.
City of Commerce, CA 2 RFP No. 26-1001
PROMINENT PRESENCE THROUGHOUT CALIFORNIA
Point & Pay is proud to serve multiple counties and cities throughout the state, and for some, we process payments for several departments.
“The Point & Pay team ensured a
successful integration with our
systems and we are so happy with
how the notes auto-generate.
Their reports are amazing, not to
mention the customer service -
another awesome. I highly
recommend their solution for a
seamless integration experience!”
Julie White, Treasurer-Tax Collector
Plumas County, CA
City of Commerce, CA 3 RFP No. 26-1001
1 BUSINESS INFORMATION
Point & Pay provides the requested company information below. 1 Point and Pay, LLC d/b/a Point & Pay
1 110 State Street East | Oldsmar, Florida 34677
2 855.634.4299 (main phone)
3 25 years – originally founded in June 1999 and later acquired by North American Bancard (n/k/a ‘North’) in March 2010
4 Limited Liability Company (LLC)
5 Kevin Connell, CEO of Point and Pay, LLC
6 Marc Gardner, CEO of North, LLC (parent corporation)
7 Please refer to the following individuals, titles, and contact information ◼ RFP COMMUNICATIONS: Jacquie Kuntz | Director, Proposal & Sales Operations Address same as 2 above | 813.727.2026 (p) | 863.248.1891 (f) | [email protected] ◼ CONTRACT NEGOTIATIONS: Mark Ruis | Senior Sales Director - West Coast Walla Walla, WA | 503.236.7069 (p) | 863.248.1891 (f) | [email protected] ◼ SIGNING AUTHORITY: Kevin Connell, CEO
Address same as 2 above | 855.634.4299 | 863.248.1891 (f) | [email protected]
STRONG FINANCIAL STABILITY
Point & Pay is a privately held company who operates as a wholly owned subsidiary of North AB, LLC, therefore, we do not publish our own financial statements. As the nation’s 6th largest acquirer, North possesses strong revenue growth and cash-positive operations. We are pleased to provide three additional company ratings for North below.
BETTER BUSINESS BUREAU: A+ | MOODY’S: B1; Outlook: Stable | HOOVER’S: Low Risk State the full legal name of your firm, including the state of incorporation if applicable. Include your address, phone number, and email address. State the number of years your firm has been doing business. List the names of principals or officers authorized to bind your firm, including position titles.
City of Commerce, CA 4 RFP No. 26-1001
2 EXPERIENCE/QUALIFICATIONS INFORMATION
Point & Pay is proud to introduce the strengths of our best-in-class team, supported by our acclaimed family of companies to the City of Commerce. Point & Pay serves as a specialized and holistic payment provider for government agencies, delivering fully hosted packages, reporting, reconciliation, merchant services, and gateway services. We pride ourselves on our implacable commitment to and compliance with security standards, ensuring the data of both the City and their customers is safe and protected.
North Enterprise is a well-established payment processor and acquirer, handling over $100 billion in annual transactions, dedicated to serving small merchants and large enterprises. Our focus lies in capitalizing on the rising demand and necessity for secure, unified payment platforms by expanding tokenization, encryption, and real-time fraud detection. By leveraging North’s economies of scale to offer highly competitive rates on both transaction processing and hardware, each component of the payment process – gateway, acquiring and processing – is handled under one roof, directly benefiting our clients and their constituents.
Together, we collectively represent over half a century of experience in secure and efficient payment processing, offering a unique opportunity for the City to contract for a menu of industry-leading solutions tailored specifically towards the unique needs of local and state government agencies.
Provide information concerning your firm’s experience and qualifications directly related to the services set forth herein. Additionally, this section shall define the experience of the Project Manager, other key personnel and sub-consultants assigned to the project. Include resumes for all managers, supervisors, and other key individuals including sub-consultants who will comprise the team. Demonstrate the relevant expertise and experience of each team member. The designated Project Manager shall be the primary contact with the City during the project period. The respondent must perform a majority of the services. Respondent shall disclose in the project proposal any and all proposed sub-consultant(s), including details regarding which tasks they would perform.
City of Commerce, CA 5 RFP No. 26-1001
With a combined 1,200+ employees, Point & Pay and the North family of companies offer secure, end-toend encrypted payment solutions for agencies at all levels. We understand the unique challenges faced by governments, and our innovative solutions to said challenges are equally unique and consistently effective. If a new client has an existing processing solution in place, we seamlessly integrate these solutions with ours, avoiding disruption to customers. We are proud to offer a flexible approach to delivering a best-in-class payments solution that continuously provides customers with convenient and secure payment experiences, and clients with efficient, optimized operations.
In recent years, North has been honored with multiple awards, with recognition ranging from exceptional efforts at sustainability to the talent of the company’s executives. We include a graphic demonstration of recent awards won by North. These awards provide insight into the robustness and dedication to quality of North’s portfolio of web and mobile technologies, including their Payanywhere brand.
City of Commerce, CA 6 RFP No. 26-1001
2.1 EXTENSIVE GOVERNMENT EXPERTISE
Serving large, multi-department governments has been our specialty from the beginning. We are the chosen payment provider for governments nationwide, including the State of New Mexico; State of Idaho, Supreme Court; Franklin County, Ohio (Columbus metro); Hamilton County, Ohio (Cincinnati metro), etc.
SANTA CRUZ COUNTY, CALIFORNIA
PROJECT
SUMMARY
Point & Pay acquired Santa Cruz County through a
formal solicitation process and began providing
payment services in July 2018. Not only do we
provide online, in-person/POS, and IVR/phone
capabilities for the Auditor-Controller-TreasurerTax Collector Office, but we also provide these same payment capabilities for other departments
countywide, such as the District Attorney, Sherriff’s
Office and Environmental Health District.
RIVERSIDE COUNTY, CALIFORNIA
PROJECT
SUMMARY
Point & Pay has served Riverside County for two
years now, providing the Treasurer Tax Collector
and the Sherriff’s Office with our mobile-optimized
and language-accessible payment processing portal.
This portal allows both English-speaking and
Spanish-speaking residents to easily make
online/mobile payments, as well as set up a
recurring schedule to prevent ever missing a
payment. During implementation, we were able to
efficiently integrate our payment platform with the
County’s existing Aumentum software system. We
also provide our in-person and IVR payment
solutions for taxpayers. Further, the County chose
to utilize our partner PayGo’s ‘Checkout’ option,
allowing residents to make their payments in cash at
local retailers throughout Riverside County.
City of Commerce, CA 7 RFP No. 26-1001
PINAL COUNTY, ARIZONA
PROJECT
SUMMARY
We have served Pinal County since 2012 and are
proud of our long-standing partnership that spans
over 13 years. The County sought to provide
customers with a new, user-friendly payment portal
and a bilingual IVR payment solution. Point & Pay
implemented a reliable and friendly web page that
allowed speedy and secure data transmissions. We
also implemented a robust, bilingual IVR that allows
customers to use voice or touch and enter
alphanumeric characters in a convenient way.
STATE OF NEW MEXICO
PROJECT
SUMMARY
Point & Pay was awarded the contract to provide
electronic bill presentment and payment services for
multiple departments within the state’s hierarchy,
including Human Services Child Support, Higher
Education, Public Employee Retirement Association,
and the Educational Retirement Board. To enable
online capabilities, we implemented our BillPay
solution and also provide the ability to pay via the IVR solution.
PIERCE COUNTY, WASHINGTON (TACOMA METRO)
PROJECT
SUMMARY
Point & Pay acquired Pierce County, the 2nd largest
county in Washington, as a client in 2014 through
competitive solicitation. They sought to provide
integrated electronic payment processing services to
enable a streamlined solution for their customers.
We currently provide them with web/online, IVR, and
POS/Counter payment solutions. Point & Pay
provides these services to the County’s Tax Office,
Law Library, District Court, and Fire District.
“Point & Pay is one of the best vendors; they plan ahead for the peaks of our tax payment cycle and anticipate our needs. If a technical glitch happens, they solve the problem quickly.” City of Commerce, CA 8 RFP No. 26-1001
STATE OF IDAHO, SUPREME COURT
PROJECT
SUMMARY
Point & Pay acquired the Idaho State Supreme Court
system in early 2023 and implemented the new
payment system sooner than planned. We deployed
300 terminals at locations across the state and
activated all devices successfully within a remote
environment. Those terminals run the SecureConnect
solution that provides real-time payment processing
for citizens paying various fines, fees, and citations.
FRANKLIN COUNTY, OHIO (COLUMBUS METRO)
PROJECT
SUMMARY
In 2016, Point & Pay acquired the most populous
county in Ohio through competitive solicitation.
They chose our mobile-dynamic payment solution
via an API integration, which provides taxpayers
with electronic billing and extended payment
options, such as mobile capabilities. Registered
users have access to a wide array of account
functionality, such as selecting the option to have
paperless bills emailed, set up recurring payments,
future-dated payments, etc. We also provide our
IVR and POS payment solutions for other options.
HAMILTON COUNTY, OHIO (CINCINNATI METRO)
PROJECT
SUMMARY
In 2011, Point & Pay acquired Hamilton County, the 3rd
most populous county in Ohio, and implemented our
web/online, IVR, and POS/Counter payment solutions.
The project took approximately 48 days to implement all of the solutions. We serve the County’s Tax Office,
Public Health, Juvenile Court, Law Library, Child Support, Criminal Court, Common Pleas Court, Probate Court, Soil & Water Conservation District, Building & Development,
Adult Probation, Civil Court, and Clerk of Court.
“We’ve had Point & Pay as our payment provider for several years. During that time, they have improved their products and services which have allowed us to better serve Hamilton taxpayers.” City of Commerce, CA 9 RFP No. 26-1001
2.2 KEY PROJECT PERSONNEL
Point & Pay’s key personnel and project team possess over 30 years’ experience in delivering, implementing, and managing projects for clients nationwide. Our Operations and Client Success divisions are comprised of multiple functional teams supporting each client’s implementation. We have found using telepresence platforms to manage projects prove successful and efficient. ⚫ Mark Ruis, CPP | Project/Relationship Manager
⚫ Diana Andino, CSM | Bilingual Client Success Manager
⚫ Margie Liriano, CSPO | Director, Implementations
⚫ Chris Geisel, CSPO, CPP | Product Management Team Lead ⚫ Jeff Qualls | Director of Application Development
⚫ Alys Winters | Manager of Quality Assurance/Testing
⚫ Vilmarie Spiridis, MBA, CSPO | Manager, Client Services City of Commerce, CA 10 RFP No. 26-1001
MARK RUIS, CPP | PROJECT/RELATIONSHIP MANAGER
Point & Pay designates Mark Ruis as the City’s primary account/relationship manager responsible for maintaining ongoing communications with key stakeholders. He will facilitate the contracting process, guide the City through Point & Pay’s product offerings, and perform regular meetings to update staff with new developments. Mr. Ruis will coordinate any questions or concerns immediately with Matt Buchbinder, the designated Client Success Manager. We recognize that a positive client success experience involves being responsive and timely in resolving any inquiries since they are vital to efficient daily operations for the City.
As Point & Pay’s Director of Sales, Mark Ruis has developed and maintained key relations with clients in California. Mr. Ruis also serves in a consulting capacity to design and optimize payment solutions by staying abreast of the applicable rules and regulations for electronic payment processing. As a senior level account manager, he acts as a resource to top-tier counties and cities across the region for the last 14 years and is a Certified Payments Professional (CPP).
DIANA ANDINO, CSM | BILINGUAL CLIENT SUCCESS MANAGER
Diana Andino will serve as the Client Success Manager to provide hands-on management to ensure we provide ongoing support and a positive client success experience for the City. In this role, she is responsible for maintaining the associated communications and expectations between staff, clients and their customers. Ms. Andino will also provide regular service performance reporting to the City. Ms.
Andino’s key responsibility is to monitor the City’s support queue within our CRM platform to maintain visibility with all business/project issues that may arise. She will serve as an advocate by building trust and maintaining fast time-to-value results. Diana Andino demonstrates superior leadership skills in managing communications for complex program deliveries with a focus on exceeding client expectations.
With over a decade of experience in onboarding, implementations, and product management, Ms.
Andino approaches client communication with a deft hand, providing timely and accessible assistance, feedback, instruction, and reporting according to address the City’s specific needs. Her position as a Certified Scrum Master guarantees she is equipped to manage implementations on this scale, and her previous awards, including Top Sales Manager at the Tampa Tribune, demonstrates her commitment and desire to exceed expectations. Diana Andino earned an AA Business Degree from the American College of Puerto Rico.
MARGIE LIRIANO, CSPO, DIRECTOR OF IMPLEMENTATIONS
Margie Liriano is responsible for oversight of the lifecycle of client implementations to ensure they are completed on time and on budget. She coordinates post Go Live requests between multiple departments by instituting innovative processes that result in an efficient workflow. Ms. Liriano also develops weekly status reports, implementation schedules, and maintains the associated communications and expectations between staff, clients and software providers. She further serves as a product manager by meeting regularly with the development team to train staff on new product design.
City of Commerce, CA 11 RFP No. 26-1001
Margie Liriano has a decade of experience in managing implementations and client project requests with differing technical and business requirements. In addition to being a Certified Scrum Product Owner (CSPO), Ms. Liriano’s technical skills include SQL Jira, Salesforce, MS Office, Google Suite, and connecting VPN tunnels and FTP sites for delivery of sensitive material.
CHRIS GEISEL, A-CSPO, CPP | PRODUCT MANAGER
Chris Geisel will work alongside Margie Liriano during the implementation to determine the best products for the City to ensure that each set of Scope of Work requirements align with the Point & Pay product offering. Mr. Geisel is an experienced, technically trained business leader and product owner, adept at using technology to improve business processes.
In this pivotal role, he manages client product specifications for government clients nationwide with use of the applicable project management skills. Chris Geisel is adept at coordinating information across multi-functional teams – development, quality assurance, and client services – to meet common goals and translate client needs to ensure optimal outcomes. His background includes more than a decade of project management, operations management, client services, and business/product development. Mr.
Geisel is both an Advanced Certified Scrum Product Owner (A-CSPO) and a Certified Payments Professional (CPP) demonstrating the knowledge and expertise required in the payments industry.
JEFF QUALLS | DIRECTOR OF APPLICATION DEVELOPMENT
Jeff Qualls manages the successful delivery of software development projects by planning, architecting, coordinating, and leading activities across the full delivery lifecycle. He also works closely with the Project Managers, Business Analysts, Architects and Developers, as well as liaising with key project stakeholders.
Mr. Qualls possesses nearly 20 years’ experience in senior-level technical roles by providing leadership skills that foster collaboration in the design and implementation of software applications. He is skilled at gathering and understanding business requirements and designing an appropriate solution to include data modeling and object-oriented analysis and design. Mr. Qualls also has a proven record of accomplishment designing robust and maintainable systems that perform well with a focus on solving business needs, rather than specific tools or technologies. He is a highly skilled Java programmer accustomed to writing both server and client side applications and is extremely skilled at both data modeling and writing SQL for a variety of databases. As web technology has evolved over the years, Jeff Qualls has also written web-based systems using a variety of languages and techniques. He earned his B.S. in Computer Science/Artificial Intelligence from Taylor University in Upland, Indiana.
ALYS WINTERS | MANAGER OF QUALITY ASSURANCE AND TESTING Alys Winters manages regression testing and other testing methods to ensure new components of clients’ payment products that we deliver match their unique requirements and do not affect existing functionality. In this pivotal role, she also manages the release management process, which involves effective planning, designing, scheduling, testing, deploying, and controlling software releases. One of her main priorities is confirming release teams efficiently deliver the applications and upgrades required City of Commerce, CA 12 RFP No. 26-1001
by each client, while maintaining the integrity of the existing production environment. Mrs. Winters further ensures payment solutions adhere to all SDLC policies, coding standards, and PCI standards.
Employed with Point & Pay for 12 years, Alys Winters is also an integral member of the escalation team to prioritize and communicate timely to the client service team for prompt issue resolution. She is also responsible for daily account management, alongside Point & Pay’s executive leadership, to ensure we meet and/or exceed service expectations. She holds a B.S. in Information Technology and serves as a backup technical resource since she has over 15 years’ experience in Testing and Quality Assurance.
VILMARIE SPIRIDIS, MBA, CSPO | MANAGER, CLIENT SERVICES Vilmarie Spiridis will collaborate with Mark Ruis and others within the relationship management team to address all needs and customer inquiries efficiently and effectively. Ms. Spiridis will also coordinate with the Client/Customer Service Lead assigned to the City to ensure all customer questions and/or issues are handled expediently. She is responsible for managing and overseeing the day-to-day operations of the customer and client service teams to preserve the company’s commitment to providing high-quality customer service 24/7. Ms. Spiridis is also an integral member of the escalation team, prioritizing any questions and concerns, as well as providing timely communications to the customer service representatives for prompt issue resolution. She is also responsible for daily account management, alongside Point & Pay’s executive leadership, to ensure we meet and/or exceed service expectations.
Vilmarie holds an MBA and CSPO certification.
City of Commerce, CA 13 RFP No. 26-1001
3 PROJECT APPROACH/METHODOLOGY
Point & Pay understands and approaches client relationships as a partnership. As a company who bases success on usage of payment systems, we work diligently to make sure that our discussions are engaging, provide value, and result in satisfied customers. For each new partnership, as part of our kickoff meeting, one of the artifacts developed from the discussion is a project plan. We also position ourselves as the payments company that helps its clients achieve their long-term goals to enhance customer experience and increase electronic engagement. Our plans are structured around the lifecycle of the contract, or longer, and include a multi-phased approach.
Point & Pay possesses 25 years’ experience in delivering, implementing, and managing large-scale projects for governments nationwide, including some considered the most populous within their State.
As part of our mission, we make it a priority to meet the timelines and milestones for all of our projects, regardless of size. We are proud of our history in completing our client projects 100% on budget.
Explain in detail how your firm would perform the services required as set forth herein. Demonstrate how the requirements and provisions of the scope of this project will be implemented. Demonstrate knowledge of the scope objectives and existing conditions/assumptions; identify potential issues/challenges; and describe your firm’s approach to minimize disruptions to performance. Present a comprehensive plan for completing the specified work in accordance with the Scope of Services. The response should demonstrate an efficient use of work force, material resources, equipment, and technology to complete the project within the constraints outlined in the Scope of Services. Provide any additional information that communicates how your team intends to achieve the required outcomes and fulfill the responsibilities of the anticipated contract.
City of Commerce, CA 14 RFP No. 26-1001
Point & Pay understands the importance of a managed implementation plan with tangible deliverables by agreed upon timelines. Our project team will work closely with the City to customize the methodology for implementation and migration, while maintaining core best practices and high quality of service. We consider the configuration/build and testing phases the most critical for the City’s new payment solution.
During the testing phase, the implementation team will promote the code to production. The team will conduct more testing of the code in production. The team expects to encounter minimal production fixes, and the schedule should allow for fixing the defects found in production. After the testing for defects, the team manages change control. Near the end of the implementation, we hold another turnover meeting with the project team in preparation for the final release. Next, the Implementation Project Manager will sign off on the readiness of the final application and then conduct a training webinar for the client.
After training, our team will turn on the permissions and release the product/deliverable to the City – they will be available during key steps in this process. Our finance group will also participate in each department’s first reconciliation with the deliverable of completing that reconciliation successfully and documenting each step for ongoing use. Our team will schedule daily meetings for the following two weeks to troubleshoot any questions and concerns, and document the results of the transition process.
Point & Pay’s implementation approach involves the five phases outlined below. 1 Planning: During this phase, we define the program and project scope. We work closely with designated City personnel to prioritize the work and build the schedule baseline. 2 Configuration and Build: Point and Pay’s platform architecture is such that our primary setup is configuration however we will provide development resources for customization work when applicable, both of which will occur during this phase. 3 Test: The Point & Pay platform offers a robust production like environment (Demo) for client and partner testing. We typically perform all non-production test activities during this phase; however, by request of the client and partner, we can offer isolated test environments to satisfy specific request for customer development and integrations.
Point & Pay provides a standard set of test scripts and scenarios that exercise the new setups and configurations. If we complete custom development or integrations as part of the project, the client or partner would develop and approve new scripts. 4 Training: We will provide training for Point & Pay tools, as well as any third-party engagement upon client approval of test results. The training is all-inclusive and specifically designed specifically with any client requirements as identified during the planning phase. 5 Go-Live: During the go-live phase the project team will review the implementation plan, confirm no critical open items remain, receive final approval from the project stakeholders, and complete any system cut-overs.
Additionally, Point & Pay recognizes the need to expand or customize the implementation and project management approach. To that end, our diverse team is familiar with the applicable standards and adjusts this approach as necessary to match our clients’ project management governance model.
City of Commerce, CA 15 RFP No. 26-1001
RESPONSIBILITIES MATRIX FOR IMPLEMENTATION TASKS
The following table details the responsibilities of the project team for the tasks associated with implementing the new solution. Please reference the key below for the identification of task roles.
L = Leader A = Action of R = Responsible for I = Input from
TASK ACTIVITY
PROGRAM
MANAGER
PROJECT
MANAGER
BUSINESS
ANALYST
SYSTEM INTEGRATION
SPECIALIST
SOFTWARE ENGINEER QA ENGINEER
TERMINAL
SPECIALIST
AGENCY
STAKEHOLDER
RELATIONSHIP
MANAGERS
PLANNING
Discovery I L R I I I I I I
Agency Scope Document I L R I I I I I I
Client Application I L R I A
Reports I L R I I I
CONFIGURATION/BUILD
System & Financial
Configuration I R A I
Webpage & IVR Configurations I R A I
POS Configuration I A R I
Integration (i.e., API, Postback) I L R A I I I
Reports I R I I
TEST
Integration Testing (i.e. API, etc.) I R I A I
POS Terminal Testing I R I A I
IVR Testing I R I I
Reports Testing I R I A I
TRAINING
Go-Live Planning Call I L I I I I I I I
Client Operations Training I I I
City of Commerce, CA 16 RFP No. 26-1001
COLLABORATIVE PROJECT COMMUNICATIONS
Point & Pay prides itself on effective communication protocols with all stakeholders to facilitate an understanding of how we conduct meetings, reports, and other communications during implementation. ⚫ COMMUNICATIONS WITH FUNCTIONAL MANAGEMENT: We include Functional Managers in all communications and our team will meet with them on a weekly basis. Point & Pay also provides a weekly status report to the Implementation Lead.
⚫ CUSTOMER RELATIONSHIP MANAGEMENT (CRM): Point & Pay will use CRM operational tools through use of the intuitive and highly regarded client engagement tool, GUIDEcx. ⚫ EMAIL: We create an e-mail distribution list of the internal stakeholders and all email communications for the project will use the specific e-mail address we establish specifically for the City’s implementation.
⚫ SCHEDULED MEETINGS: Upon contract award, Point & Pay will review with the City all other required meetings and TBD dates based on the project start date.
UNRIVALED ONBOARDING EXPERIENCE WITH GUIDECX
With our innovative GUIDEcx engagement tool,
Point & Pay provides a simple and speedy process
for onboarding new users, adding agency offices,
and finishing the project timely. Lauded as the
leading onboarding solution, the GUIDEcx
Compass Experience gives a clear, easy-to-read
dashboard that shows essential details of the
project and each party’s responsibilities.
By streamlining the process with GUIDEcx, we
identify key highlights below.
➢ TASKS: View assigned tasks and complete them easily – from a laptop, PC, phone, or other mobile device. No registration needed to complete tasks either. ➢ NOTIFICATIONS: Receive email notifications for tasks and other project-related items. By clicking on the bell icon in the lower left panel of the project dashboard, staff can search for tasks and filter them in several ways.
➢ PROJECT NOTES: Communicate with Point & Pay and your team throughout the onboarding process, with the ability to include attachments, such as meeting recaps. ➢ ADD OTHERS: Add teammates simply by reassigning a project task to them.
City of Commerce, CA 17 RFP No. 26-1001
CHANGE CONTROL
The primary purpose of Point & Pay’s change control process is to review, approve, or make recommendations for an alternative approach to change impacting department requirements and related delivery timeframes. The City’s assigned Implementation Lead handles the change process by:
1 Identifying a potential change
item,
2 Documenting the potential
change and impact to the
project’s scope/schedule,
3 Communicating it to the
Program Manager, who adds
it to the weekly status
meeting, and
4 Presenting the item and
analysis to the change control
board.
The Change Control Management
Board (CCB) will consist of City IT
personnel and Point & Pay project
team members who are responsible
for reviewing and approving all
changes to the implementation
schedule.
The CCB then accounts for these
changes in the change register and
ensures that all levels of change and
accompanied analysis during discovery
are within an appropriate timeframe.
When a board member communicates
the decision to the Implementation
Lead, he/she updates all associated
documentation and communicates the
decision to all appropriate parties.
City of Commerce, CA 18 RFP No. 26-1001
CITY’S ROLE AND RESPONSIBILITIES
To fulfill the proposed contract efficiently, Point & Pay prefers one designated representative from the City as a primary point of contact. We also prefer availability to at least two individuals, one primary and secondary IT staff member from the City’s Information Systems department, to coordinate technical aspects and answer questions that may arise related to programming and testing associated tasks during the integration and implementation process of the new payment solution.
Point & Pay expects that the primary point of contact (POC) should provide ownership of the City’s contributions to the final, mutually agreed Scope of Work (SOW). As such, that individual will also provide final “acceptance” of the provided solutions, certifying they adhere to the requirements and meet the City’s needs. The POC will also be responsible for the Change Request process.
To manage contract performance, the POC will have access to Point & Pay’s performance tracking tools, which include project management resources and documentation during the implementation phase and system performance tools during the solution’s active lifecycle. It is typical for us to include the POC on Point & Pay’s distribution lists for system alerts and critical communications. The POC will collaborate with Mark Ruis, the City’s Account/Relationship Manager, to coordinate the scheduling and agendas of the quarterly performance review meetings.
POINT & PAY’S ROLE AND RESPONSIBILITIES
Point & Pay will provide the City with the necessary project management and technical resources to configure, develop, and maintain the new payment solution prior to implementation, as well as for the life of the contract. We can perform these steps remotely. Point & Pay’s agreements include a mutually drafted Scope of Work (SOW) that includes:
⚫ Provisioning of key project and support staff for the full contract lifecycle ⚫ Technical integration
⚫ Reporting per City’s specifications
⚫ Initial setup of users and permissions, as well as tools for ongoing management ⚫ 24/7 Customer and Technical support services
⚫ Single point of relationship and contract management
⚫ Quarterly meetings to review performance and opportunities for improvement ⚫ Delivery of system scale to support the City’s watermarks for concurrent users ⚫ A technology solution that fully meets the City’s User Acceptance Testing (UAT) requirements Full lifecycle support (on-boarding, training, operation, management, and transition) City of Commerce, CA 19 RFP No. 26-1001
4 ADDITIONAL INFORMATION REQUESTED
Implementations are a core discipline at
Point & Pay. Most of our operational staff
are tied to the various disciplines. We
recognize large and complex
implementations require significant
oversight and communication, and we
approach those differently than smaller,
standard implementations. Point & Pay
will provide the City with a non-standard
approach to meet the program goals while
still aligning with our governance model.
Point & Pay also follows a standard set of
industry-recognized guidelines flexible
enough to support the City’s needs while
maintaining a focused approach to
completing implementation on time.
Point & Pay’s proposed project schedule
includes a 60-day timeline to implement
our standard products and services that do
not require any customization efforts or
third-party integration.
Our project assumptions include mutually
agreed upon changes in scope and
documented in an approved change order
prior to additional work commencing. To
avoid unnecessary delays, City resources
need to be available during the appropriate
phases, with proper advance notice to
minimize adjustments in the project
schedule.
1. Describe in detail the timeline and process to implement credit card and merchant services for the location listed in Scope of Services under “Credit Card Location” (e.g., is the process one location at a time?).
City of Commerce, CA 20 RFP No. 26-1001
4.1 PROCESSING PAYMENTS AT THE CREDIT CARD LOCATION AND WEBSITE Point & Pay’s solutions operate in a secure, fully hosted, private cloud-based, SaaS environment; no specific software is required. As a browser-based application, we work diligently to ensure usability on all common browsers and versions. All of Point & Pay’s proposed solutions run off of the same central SaaS platform using a modern virtualized architecture hosted on a private cloud. We utilize common architecture patterns to ensure the privacy, security, and performance of transaction processing.
We use relational databases to manage our transaction data. Our various service components run on a combination of Windows and Linux server instances. The core of our payment processing functions are written in Java. Our mobile-dynamic BillPay (electronic bill presentment and payment) application is primarily written in Ruby on Rails.
Point & Pay continuously improves every aspect of the system platform according to industry best practices. This includes periodic security patches as well as feature enhancements and bug fixes.
1. Process credit/debit card, including chargebacks and adjustments at one City location and on the City’s website for certain services.
City of Commerce, CA 21 RFP No. 26-1001
4.1.A IN-PERSON PAYMENTS WITH TAP-N-GO TECHNOLOGY
Point & Pay’s proposed approach to Point of Sale (POS) processing for the City of Commerce is to present a menu of available products to enable POS payment acceptance. Regardless of the City’s choice, all hardware devices support real-time transaction posting and account balance updates, along with using devices that handle chip, pin-based, contactless, Apple Pay, Google Pay, Samsung Pay, and others.
Point & Pay offers a full-featured cloud-based interface via our Workbench (virtual terminal) for fast, easy, in-person checkout. Staff can access the application by login/password and it connects to payment peripherals, including PCI-validated P2PE devices.
With the option of Point & Pay’s virtual
interface combined with our semiintegrated terminals, we are able to load the POS software and inject the
encryption keys to enable payment
acceptance with the City’s cashiering
application. Once terminals arrive, we
conduct the physical installation and
connectivity configurations.
We can also expose an API gateway
generated by external software,
terminals, or other checkout applications.
In this way, the City can utilize existing
systems or preferred hardware while still
taking advantage of our processing
capabilities and integration benefits.
Features of in-person services include:
✓ PCI-validated P2PE controls
✓ Unique approach to handling
convenience fee transactions
✓ Direct access to functions like
voids, refunds, etc.
✓ Options for installation and
configuration support
City of Commerce, CA 22 RFP No. 26-1001
4.1.B MOBILE-OPTIMIZED ‘COLLECT’ SOLUTION
For the City of Commerce, we are pleased to offer our online ‘Collect’ solution that is mobile-responsive across all devices available today. Point & Pay enables this online capability by integrating seamlessly with the billing/financial application via our parameter passing methodology that posts the customer payment data in real-time to the City’s system. Each department will be able to customize field settings, business rules and validations. Point & Pay’s proposed solution provides the features below. ✓ Real-time authorization for all payment types
✓ Display of convenience fee for each payment method (2nd step of checkout) ✓ Digital accessibility design to conform with WCAG standards ✓ Shopping cart for managing multiple payments in the same checkout ✓ reCAPTCHA security functionality
City of Commerce, CA 23 RFP No. 26-1001
City of Commerce, CA 24 RFP No. 26-1001
City of Commerce, CA 25 RFP No. 26-1001
4.1.C ACCEPTANCE OF SEVERAL PAYMENT METHODS
Point & Pay accepts credit cards issued by Visa, MasterCard, Discover/Novus, and American Express. We also accept prepaid cards, gift cards, promotional cards, corporate cards, and international credit cards with the logos referenced above. We also accept PIN-based and PIN-less debit cards in real time and fully supports all common networks for both online and offline debit cards and provide transparent switching between authorization routes for a seamless experience, including Accel, Interlink, Maestro, etc.
Regardless of card type, Point & Pay requires the customer to enter their card payment information, along with the associated verification type, such as CVV, CVV2, CVC, and CID. Our system then performs a real-time authorization for the customer’s transaction. With all gateway, terminal, acquiring, and processing functions in-house, we are able to manage AVS and CVV rules per the City’s requirements using our sophisticated hierarchy controls.
Point & Pay also performs real time account validation for electronic check (eCheck) payments with verification of existing account and routing numbers, and is a configurable option for any transaction on our platform. Point & Pay’s validation service for electronic checks includes instant verification of account number formatting and logic, blacklist, double-blind entry verification and real-time Federal Reserve validation to ensure the respective account number entered by the customer exists at the bank, is ACHeligible, is in good standing, and has a positive balance.
Point & Pay fully supports the additional payment methods referenced below. ⚫ Apple Pay and Google Pay
⚫ PayGo’s ‘Checkout’ solution that enables cash payment acceptance at retailers nationwide ⚫ Open Banking ‘Pay with Bank Account’ – single-sign on (SSO) validation for instant ACH transfers from an online account by logging in with existing credentials City of Commerce, CA 26 RFP No. 26-1001
4.1.D SETTLEMENT PROCESS AND TIMELINE
One of Point & Pay’s highly coveted services is our consolidated settlement design for all transaction types, and the vast majority of our clients prefer this batch settlement method for ease of reconciliation.
We consolidate the deposits for all credit/debit card types – Visa, MasterCard, American Express, and Discover, as well as electronic checks – into a single, easy to reconcile batch. This approach offers:
⚫ Easier reconciliation and single point of management for all settlement activities ⚫ Ability to preserve the integrity of the 24 hour day (local time) rather than manipulating batch times to accelerate settlement
⚫ Ability for Point & Pay to fund settlement even if there is an issue with processing, banking, etc.
Point & Pay offers a variety of sophisticated options and processes settlements via ACH and FedWire. All options other than the “Direct” settlement model include consolidated settlement of all payment types.
TIMING OPTIONS
• Next Day – midnight cutoff and FedWire technology to deliver funds the next morning • Expedited – midnight cutoff and ACH settlement for good funds 24 hours after batch cutoff • Standard – midnight cutoff and next-day settlement for good funds 48 hours after batch cutoff
DELIVERY OPTIONS
• Consolidated – consolidates all card types and checks into a single lump deposit • Direct – individual settlements received directly from the card and check processors (required for settlement structures requiring next-day or faster timing)
ROUTING/RECONCILIATION OPTIONS
• Group Settlement – receive settlement for all departments in a single consolidated batch • Individual Settlements – structured by different payment types, departments, physical locations, or the channels in which the platform receives payments (online/IVR/POS, etc.) Using our reporting tool, the City will be able to set up a reporting hierarchy to view the funds as one lump sum, or as individual deposits. Transactions occurring on Saturday and Sunday will post on Monday; and we are able to report on these weekend transactions separately, if desired. We can pull settlement backup data from our reporting component or deliver files in CSV, XML, or tab-delimited formats.
City of Commerce, CA 27 RFP No. 26-1001
With Point & Pay’s consolidated settlement, the system aggregates all payment types processed during the client-defined ‘accounting day’ into one deposit. This process makes reconciliation substantially faster, and we can report on the movement of money for all items at any point. To facilitate the consolidation of payments, we combine deposits from the card association banks, ODFIs, processors, and partners in a holding account and released to the City per the agreed-upon timelines.
Funds Flow in Consolidated Credit Card Settlement (above) and Electronic Check/ACH Settlement (below) City of Commerce, CA 28 RFP No. 26-1001
In a Direct Settlement, the City will receive funds directly from the card association banks, ODFIs, processors, and any other partner components processing transactions independently. Point & Pay will report on these transactions via our centralized repository and report settlement advice; however, we are one-step removed from full control of the process. The advantage of this approach is speed, as settlements do not require any additional steps. We can apply the settlement model of choice at any level in the City’s hierarchy and departments’ can choose the best option to fit their needs.
Funds Flow in Direct Credit Card Settlement (above) and Electronic Check/ACH Settlement (below) City of Commerce, CA 29 RFP No. 26-1001
4.1.E HOSTING, STORAGE, RETRIEVAL, DATA HANDLING, AND SECURITY Point & Pay’s virtual server architecture allows for rapid scaling as needs arise and our robust enterprise performance monitoring tools allow us to maximize system and capacity performance on a proactive basis. Dynatrace, a GovRAMP-compliant application we utilize, is a cloud-based performance analysis tool that offers real-time monitoring, error tracking, and scalability. We have found it to be an extremely beneficial solution that enhances application performance, reduces downtime and aids in efficient resource allocation.
Point & Pay’s platform
accommodates tens of
millions of transactions daily,
and our equipment and data
centers are scalable, thereby
enabling us to add new
equipment as necessary,
along with the support staff.
Our capabilities include bestin-class hosting with real time scalability, fail-over,
and load balanced
processing to minimize
points of failure.
Point & Pay utilizes several automated processes to monitor system activity 24/7/365, including chargebacks and settlement transmissions. If a transmission fails, the system generates an alert that routes to a management queue automatically for follow up. Should our efforts be unable to correct the issue after multiple attempts to troubleshoot the issue, we will notify designated City personnel by both email and phone. Our notification system is event driven for configurable responses. We can add City representatives to the distribution for relevant alerts.
Since Point & Pay’s platform is built for long term scale, and because of our experience in the government payments business, which is all highly due-date driven, we are experienced in maintaining systems where day-to-day throughput and peak use may vary by factors of 100x or more. We designed our systems to accommodate loads of that nature and we can supplement resource pools rapidly for anticipated peaks. Our environment is load tested regularly using tools to ensure the platform can support all requirements and beyond. Additional cloud environments will allow for as needed scaling and elasticity during peak times. In addition to a capacity plan, Point & Pay takes stress tests its enterprise-class deployments, pushing volume many multiples in excess of the anticipated volume.
City of Commerce, CA 30 RFP No. 26-1001
4.1.F PCI-DSS LEVEL 1 AND SOC 2 COMPLIANT
Point & Pay is both PCI-DSS Level 1 and SSAE 18
Type II compliant. We understand the
importance of ensuring the security of our
clients’ financial data and believe a holistic
approach is the best posture to ensure data
security. Our focus is to uphold the highest
level of security to exceed the needs of our
clients.
We are active participants in the PCI Council
and other industry associations where we
discuss common security concerns like NACHA,
the ETA, NACO, and NACTFO. Through
discussion groups, newsletters, and publications
available, we are able to keep ahead of the
published standards.
North American Bancard also employs a
compliance group that tracks all aspects of
transaction processing compliance and sets
corporate policies and procedures to ensure
good standing with the PCI Council, NACHA, and
all card associations.
Point & Pay has further pioneered several
payment acceptance methods that help
merchants dramatically reduce their PCI
compliance burdens. We operate an
independent compliance service through the
brand and we offer robust scanning and SAQ
services. In addition to these compliance tools,
we engineered our solutions to reduce scope.
Wherever possible, Point & Pay suggests to:
⚫ Utilize solutions that hand customers off to Point & Pay for critical processing steps ⚫ Use tokenization strategies instead of storing card information ⚫ Use PCI-encrypted solutions to prevent clear text transmission across the client’s networks ⚫ Use embedded solutions for working within existing cashiering solutions City of Commerce, CA 31 RFP No. 26-1001
ENCRYPTION CONFIGURATIONS
Point & Pay uses FIPS 140-2 Level 3 compliant Host Security Modules (HSMs) as the secure repositories of the keys used in encryption and decryption of cardholder information. HSMs are physically secure, tamper-resistant security servers that provide cryptographic functions to secure financial transactions, including PIN encryption and verification, debit card validation, stored value card issuing and processing, chip card issuing and processing, message authentication and symmetric key management. Procedures are documented and followed regarding the secure receipt, deployment, use, repair, transport and decommissioning of these devices. We have also developed a proprietary method of authenticating and replying to cryptographic requests.
The Team also uses Transport Layer Security (TLS 1.2) to provide authentication, confidentiality, and integrity for its Internet transactions. Authentication is also further determined by the contents of the transaction. The merchant’s system requests an SSL connection to our host via Transmission Control Protocol/Internet Protocol (TCP/IP), and they then negotiate the protocol details and exchange a set of keys to be used only for the life of this particular transaction. Once the SSL connection has been established and both sides know what keys are being used, all traffic that goes through the SSL wrapper is protected by the SSL encryption. There are no DES or 3-DES keys used, and therefore, no need for merchants to manage keys.
SSL protects against replay attacks by using unique IDs per connection. Man-in-the-middle attacks are prevented with SSL by using server certificates and response challenges. SSL defeats a clear text attack by making the amount of custom hardware needed prohibitively large (by using a 128-bit session cipher key length the size of the dictionary required is beyond the ability of anyone to fabricate—it would require more atoms than exist in the entire universe).
When the database stores a cardholder transaction, the card number has already been encrypted with a BRIC (or GUID). The database separates this encrypted number from the transaction record and stores it in the database vault. Users do not have direct access to the vault; a database trigger and stored procedure are invoked to place the encrypted number into the vault. The database vault is isolated on a separately managed Oracle schema with strict access controls. The database vault only allows encrypted account numbers to be inserted by the authorization process, and account numbers may only be extracted by the processes such as settlement. No user accounts have access into the vault, and no account has update rights.
Stored data is encrypted with the AES-256 encryption algorithm, and third parties do not have access to decryption keys or servers. Sensitive cardholder information is separated and stored in a highly secured database vault. External applications do not have data vault access. Reporting databases minimize exposure by housing only the last four digits of card numbers. Data in flight is also encrypted and protected by SSL (TLS 1.2).
City of Commerce, CA 32 RFP No. 26-1001
SECURITY CONTROLS AND SAFEGUARDS IN PLACE
Point & Pay’s systems are designed for the auditing requirements of our clientele. We log all activities that happen in our systems and make large data quantities available to clients directly through our reporting tools, including real-time information about transaction processing status, with coding that indicates the detailed path from authorization to confirmation and settlement. Our system maps all transaction data is mapped to users, thereby enabling managers to achieve outstanding visibility into the individual activities of their staff.
Point & Pay follows PCI and other industry standards to control access to information (key cards, passwords, encryption, need to know rules, etc.) to aid in prohibiting user access to either the system or data. At the client site, we control access to the administrative interface by passwords, which give employees access to only the information needed to perform their jobs. During system configuration, Point & Pay’s account manager configures this hierarchy of security. We will work with client to ensure we designate the appropriate permissions and access rights to employees. In addition, the administration application logs out automatically after 30 minutes. Please refer to the following security controls in place to restrict and monitor our system and our clients’ data.
PHYSICAL CONTROLS
⚫ Card-controlled electronic locks
⚫ Video cameras in use and monitored at external and internal access points ⚫ Physical servers behind multi-layer system of locks
USER ACCESS
⚫ Multi-tier user roles limits access to only what’s necessary ⚫ Multi-factor, multi-layer, VPN-based authentication required for production access ⚫ Strict user account and password requirements, including length, complexity, history, resets, and lockouts and automated deactivation based on defined windows of inactivity
EMPLOYEES
⚫ Thorough background checks performed on all employees ⚫ Access to secure systems limited to as few employees as is necessary (“need-to-know”) ⚫ All employees undergo annual information security training and certification ⚫ All technical employees undergo annual secure coding/testing training and certification
HARDENING
⚫ System builds based on CIS and SANS standards
⚫ Web application firewalls protecting all systems 24/7 ⚫ Enterprise-grade firewalls in use in multi-layered, segmented network topology City of Commerce, CA 33 RFP No. 26-1001
⚫ Information Security Management approach derived from the ISO/IEC 27001 ⚫ Development standards based on OWASP and SANS best practices ⚫ All firewall changes required to undergo formal change control review
VULNERABILITIES
⚫ Monthly internal and quarterly vulnerability scans performed by certified ASV ⚫ Annual internal & external penetration tests performed by certified GPEN/GWAPT ⚫ Release-triggered QA vulnerability scans as required change control step ⚫ Daily alerts and review of changes or additions to global vulnerability databases
MONITORING
⚫ Over 40 automated processes and tools continuously monitoring system activity ⚫ Over 180 manual, human-driven security checkpoints throughout the year ⚫ Verbose logging of all user activity with immediate availability for 90 days ⚫ Annual audits for PCI DSS Level 1 and SSAE 18 compliance performed by certified QSA ⚫ Quarterly information security review by Point & Pay InfoSec Committee ⚫ File integrity monitoring in place on all systems 24/7 ⚫ Intrusion detection/prevention systems monitoring all network entry points
WEB APPLICATION CONFIGURATIONS
We follow OWASP standards for configuration of web applications to present SQL injection attacks and related issues, this includes:
⚫ Use of Prepared Statement(s) with bind variables
⚫ Use of stored procedures to limit database interaction to predefined cases ⚫ Screening of user-supplied data to identify problematic inputs ⚫ Minimized database privileges
⚫ White listed inputs
⚫ Use of Java as the primary programming language to reduce risk of buffer overflows and issues PCI-VALIDATED POINT-TO-POINT ENCRYPTION (P2PE)
⚫ Hardware encryption completely protects card numbers at the merchant location ⚫ Supported in Physical Terminals, Hosted Virtual Terminals, Call Center Encrypting PIN pad for card data entry, Mobile solutions
⚫ Decrypts the transaction itself and does not rely on external processor interfaces to support P2PE ⚫ Secure P2PE encryption key management is provided transparently to merchants City of Commerce, CA 34 RFP No. 26-1001
SECURE PLATFORM INFRASTRUCTURE
Point & Pay’s security system includes state of the art SSL (TLS 1.2) and encryption algorithms, firewall protection, intrusion detection systems, and additional proprietary security technology. We deploy a number of security layers to prevent unauthorized access to our systems and data, including:
⚫ Network Segmentation: Separate zones for DMZ, Processing, Vendor, Encryption, Database, etc. ⚫ Multi-Person Controlled Key Management: A minimum of three (3) people are required for encryption key or HSM access, periodic key rotation, etc. ⚫ Data Vault: Segregated and encrypted card number storage, with strict ACLs ⚫ PAN Masking: External applications lack access to Data Vault and only have last 4 card digits, limiting exposure
⚫ Internal Log Event Monitoring: Daily and real-time event observation and correlation ⚫ Third-Party Log Monitoring: 24/7/365 event observation and correlation by third-party ⚫ Datacenter Physical Access Controls: Secured systems in individually keyed and locked cabinets in an access-control datacenter on an access-controlled floor ⚫ Penetration Tests: Perform external and internal penetration tests at least annually, as well as application-level pen testing
⚫ Security Policy: Internally published guidelines with signed acknowledgments and regular training ⚫ Database Security: We control access at the operating system layer and database connection level.
Access to production databases is restricted to a limited number. Connections are monitored and audited. Production databases do not share a master password database. Application-specific accounts limit functionality to base functionality requirements. Sensitive cardholder information is separated from other transaction information and stored in a highly secured database vault. ⚫ Data Isolation: All merchant data is kept separate from other merchants. Even within a single merchant, logical data separation is used to establish organizational hierarchy levels such that only specified users can access and report on data for each defined organizational level. ⚫ Data Encryption: We employ some of the most powerful encryption products available to safeguard your data and communications.
⚫ Internal Network Security: Inside perimeter firewalls, our systems are protected by network address translation, port redirection, IP masquerading, non- routable IP addressing schemes, and more. Specific details of these features are proprietary. ⚫ Perimeter Defense: Our network perimeter is policed by numerous industry leading firewalls and intrusion detection systems. We monitor and analyze our firewall logs to identify security threats before they happen. In addition, we regularly check our security settings for changes, flaws, and errors. We also conduct ongoing vulnerability threat assessments. ⚫ User Authentication: Only users with a valid username and password combination, which is encrypted while in transmission. Users are blocked from selecting weak or easily identifiable passwords. User accounts can be restricted to just the information needed to complete the job.
City of Commerce, CA 35 RFP No. 26-1001
FRAUD CONTROL PRACTICES & PROGRAMS
To minimize fraudulent transactions, Point & Pay utilizes over 60 fraud control practices for limiting risk and controlling exposure, including automatic Fraud Checks, with a goal of increasing efficiencies for clients. Our policies and procedures concerning responses to fraud are designed to align with the operating rules of the card associations. Please refer to a sample below. ⚫ reCAPTCHA functionality on web pages
⚫ AVS verification/validation
⚫ 3D Secure Enablement via an integrated solution or gateway certification ⚫ Duplicate payment detection and prevention
⚫ Validation against blacklists and client-configured exclusions ⚫ Transaction velocity controls
⚫ Geographic monitoring and the ability to block traffic from high-risk areas or specific addresses Aside from the common methods referenced above, Point & Pay utilizes the following fraud programs. ⚫ Feedzai component to mitigate fraudulent transactions through machine learning ⚫ HAWK:AI screening tools to monitor transactions in real-time with a comprehensive set of rules and behavior analytics, as well as reduce false positives with artificial intelligence ⚫ Crowdstrike’s ‘Falcon’ product for cloud-native cybersecurity to prevent malware attacks, detect malicious activity, and provide whitelisting/blacklisting capabilities
FEEDZAI - FIGHTING FRAUD WITH A POWERFUL RISK MANAGEMENT PLATFORM North American Bancard partnered with Feedzai in early 2019 and launched a comprehensive solution that leverages machine learning for enhanced risk management and fraud protection.
Founded and developed by data scientists and aerospace
engineers, Feedzai’s mission is to make banking and commerce safe with anti-money laundering products to manage risk, while improving the customer experience.
Once implemented, the Feedzai component customized fraud prevention tools for the family of companies that address existing and adapt to new types of fraud, using real-time insights to detect repeated patterns and transaction anomalies. Since then, we have experienced significant enterprise-wide
improvements with both fraud prevention capabilities and merchant onboarding, while reducing friction for our clients. “Facilitating safe, secure and
fast transactions while
eliminating friction in the
underwriting and risk
processes through
technological advancements
is at the core of what we’re
trying to offer to merchants.”
Jay Nadarajah,
Chief Risk Officer
North American Bancard
City of Commerce, CA 36 RFP No. 26-1001
HAWK:AI - ARTIFICIAL INTELLIGENCE FOR ANTI-MONEY LAUNDERING COMPLIANCE In April 2021, North American Bancard partnered with HAWK:AI to strengthen our Anti-MoneyLaundering (AML) compliance through real-time transaction monitoring, applying machine learning in combination with classic rule-based approaches. HAWK:AI is a global leader in real-time transaction screening and monitoring solutions for financial institutions and payment companies.
Since the partnership began nearly a year ago, NAB has tailored and integrated their solution to existing payment systems and data sources for all products within the family of companies, as well as rapidly deployed the solution successfully on its cloudfirst software stack.
The Point & Pay team now experiences improved compliance with regulatory requirements, scheme and bank sponsor rules, and significantly increased process efficiencies by reducing manual investigation workload. Remaining vigilant to the changing demands in anti-money-laundering is paramount to our continued growth, and a key factor for protecting our clients across all industries, including governments.
KEY BENEFITS
✓ Transaction monitoring for red flags using a comprehensive set of rules with Behavioral Analytics ✓ Dramatically reduce false positives with artificial intelligence ✓ Detect unknown crime patterns before they become rampant ✓ Reduce time per case with a centralized interface
✓ Full audit trails and the highest level of data protection “HAWK:AI was able to work
most efficiently with our Data
Science, Software and Cloud
Infrastructure teams,
successfully delivering the
project under time constraints.
Their payment, compliance
and cloud knowledge has
proved invaluable.”
Jim Parkinson,
Chief Experience Officer
North American Bancard
City of Commerce, CA 37 RFP No. 26-1001
‘CROWDSTRIKE’ CYBERSECURITY FOR MALWARE PREVENTION
Point & Pay is proud to share we have never experienced a security incident/breach and we look forward to completing this potential contract with that record intact; however, in the unlikely event of a breach, the bulk of responsibility resides with Point & Pay as the hosted provider, but each scenario is unique. Because the client will never be exposed to card numbers, the opportunities for liability to fall on the client are very limited; however, with some exposure to in-person transactions and login/password access to the administration system, there are cases where fraud could originate from a client's location or employees. The Point & Pay team views its role in this dynamic as a partner to its clients in providing training, documentation, and secure systems to minimize these points of exposure.
Point & Pay also utilizes Crowdstrike’s ‘Falcon’ platform, which leverages cloud-scale artificial intelligence (AI) and offers real-time protection and visibility across the family of companies, preventing attacks on endpoints and workloads on or off the network. Founded in 2011, Crowdstrike is a global cybersecurity leader that redefined security for the cloud era with an endpoint and workload protection platform built from the ground up to stop breaches. Ultimately, our clients’ and their customers benefit from superior protection, better performance, reduced complexity and immediate time-to-value.
City of Commerce, CA 38 RFP No. 26-1001
INCIDENT RESPONSE PLAN
Point & Pay is proud to share we have never experienced an incident/breach and we look forward to completing this potential contract with that record intact. However, should an event occur, it is our philosophy to involve clients in the remediation process from the beginning, with full transparency, as we make decisions that affect our shared customers.
We follow a formal incident response plan upon detection of a breach or other security event. Our Incident Response Plan covers the appropriate steps for managing the incident through the following key steps: communication, identification, severity classification, containment, eradication, recovery, and root cause analysis resulting in improvement of security controls. Our Information Security Department takes the following actions as soon as they identify and classify an incident.
STAGE ONE – DETECTION, CONTAINMENT, AND MONITORING
1 System detection of an incident/breach
2 Generate a high-priority notification through the event communication process to internal and external stakeholders.
3 Establish a conference bridge for real-time communication between stakeholders and decisionmakers, both internal and external. 4 If possible, record the user, IP address, and domain of intruder. 5 Utilize approved technology controls to block the intruder’s access temporarily or permanently. 6 Maintain vigilance for future break-in attempts from this user or IP address.
STAGE TWO – CONTAIN, MONITOR, AND WARN
1 Collect and protect information associated with the intrusion. 2 Utilize approved technology controls to block the intruder’s access temporarily or permanently. 3 Research the origin of the connection.
4 Contact ISP and ask for more information regarding the attempt and intruder. 5 Research potential risks related to intrusion method attempted and re-evaluate for higher classification and incident containment, eradication, and recovery as described for Level 3 incident classifications.
6 Upon identification, inform malicious user of our knowledge of their actions and warn of future recriminations if user attempts to repeat their actions. If an employee is the malicious user, management will work to address the Acceptable Use violation appropriately.
STAGE THREE – CONTAIN, ERADICATE, RECOVER, AND CONDUCT ROOT CAUSE ANALYSIS 1 If the incident involves credit card systems, we will notify the Acquirer and card associations.
City of Commerce, CA 39 RFP No. 26-1001
2 Contain the intrusion and decide the appropriate actions to implement. Consider unplugging the network cables, applying highly restrictive ACLs, deactivating or isolating the switch port, deactivating the user ID, terminating the user’s session/change password, etc. 2 Collect and protect information associated with the intrusion via offline methods. If forensic investigation is required, the Information Security Department will work with legal and management to identify appropriate forensic specialists. 3 Notify management of the situation and maintain notification of progress at each following step.
4 Eliminate the intruder's means of access and any related vulnerabilities. 5 Research the origin of the connection.
6 Contact ISP and ask for more information regarding attempt and intruder, reminding them of their responsibility to assist in this regard.
7 Research potential risks related to, or damage caused by the intrusion method used.
COMPREHENSIVE BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN Point & Pay understands our clients require a technology infrastructure ecosystem that provides the highest economies of scale, risk mitigation, sustainability and investment protection of the financial data shared between their system and our platform. Therefore, we utilize two "Tier 5 Platinum/Tier Elite" data center hosting facilities operated by Switch, a recognized world leader in data center design, development, and mission critical operations. Our primary location is Switch Las Vegas (The Core) and the secondary/backup location is Switch Grand Rapids (The Pyramid).
In early 2022, Switch achieved HITRUST CSF certified status, demonstrating that their design, efficiency, and security has met the highest standards for protecting sensitive data and information by undergoing the most rigorous program
available, consisting of a multitude of automated and manual quality assurance checks. Switch meets complex privacy and compliance requirements that include technical and process elements, including SOC 2, SOC 3, PCI DSS-ROC, NIST 800.53, ISO/IEC , HIPAA, and more.
Switch is also the only company to achieve the highest
Environmental Rating (E-1) and received the highest scores for Social (S-2) and Governance (G-2). In fact, over the past four years, Switch has received repeated national recognition for their ongoing ability to design the most sustainable and efficient multi-tenant data centers leveraging 100%
renewable energy and patented cooling technologies.
City of Commerce, CA 40 RFP No. 26-1001
PRIMARY AND SECONDARY DATACENTER OPERATIONS
Switch Las Vegas requires no shutdowns for equipment replacement and maintenance. A redundant delivery path for power and cooling is added to the redundant critical components of Tier II so that each component needed to support the IT processing environment can be shut down and maintained without impact on the IT operation.
In the event of a power loss, backup power is provided by up to 24 generators. Bulk fuel is stored onsite, and multiple refueling contracts are in place. The facility houses other entities deemed critical by the Department of Homeland Security, ensuring priority access to diesel fuel for any long-term emergencies.
The secondary datacenter, Switch Grand Rapids, has externally redundant telecommunications and dedicated servers for each key processing process in the DMZ, Internal Processing, Encryption, and Database segments. Each node has internally redundant hard drives and power supplies, and the secondary data site is protected by UPS and generators. All transaction data is replicated in real time between the primary and secondary data centers. At our remote back-up location, we house redundant authorization hardware, databases, and Internet connectivity should our main physical facilities become unavailable. Should the need arise; we can recover any missing data from our redundant databases.
All networking components, SSL accelerators, load balancers, Web servers, and application servers are assembled in a redundant network architecture. Our data is maintained on a database server cluster for redundancy. All customer data is cached on carrier-class disk storage using RAID solid-state drives and multiple data paths. All customer data, up to the last committed transaction, is automatically backed up to a storage device on an ongoing nightly basis. Backup storage devices are moved to secure, fireresistant, off-site storage on a regular basis.
Business recovery efforts are automatically invoked in response to a disaster. Key systems are monitored 24/7 with automatic notification for network administrators. In addition, we have comprehensive disaster recovery and incident response plans in place. The recovery plans are reviewed and tested regularly.
City of Commerce, CA 41 RFP No. 26-1001
We perform Disaster Recovery (DR) testing at least once a year. During these tests, depending on the level and areas being tested, UPSs, generators, alternate telecommunication lines, DNS traffic shifting mechanisms, and various functionality of the DR site are exercised. During a typical test, production traffic is shifted automatically to the DR site during pre-established maintenance windows, for 15 to 60 minutes, depending on the specific testing.
4.1.G CLIENT/CUSTOMER SERVICE SUPPORT
Point & Pay will provide client and customer service support for the City via toll-free phone and email.
We are proud to share that our team utilizes the Genesys Cloud CX system, a leader in Cloud Call Center Software and a GovRAMP/FedRAMP compliant platform. We will assign a dedicated client success team that utilizes a ticket management system to monitor and track any issues that may arise. This team will facilitate first-level support for assistance with log in credentials, reports, settlements, deposits, payments, chargebacks, refunds, and voids. Our second level support covers move complex issues such as modifying a configuration, validation, configuring exclusions, adding services, and banking/settlement changes.
Point & Pay has multiple support center locations to provide live assistance around the clock. Our processes have built in redundancy to manage call overflow efficiently, and we provide back-up resources for our support specialists to ensure constant communication with automated email check-ins for system issues and maintenance scheduling and escalation to management when requests age beyond acceptable timeframes. We also have the ability to assign unique customer service lines specific to the City to enable immediate prioritization for incoming calls and monitoring SLA’s individually.
In recent years, we have significantly increased staffing for customer and client service teams, therefore we ensure an extremely short wait time, if any.
⚫ Our current configuration for phone line capacity can support 400 individual calls at any one time and is
scalable within 60 minutes of sustained volume that
exceeds 60% capacity.
⚫ Average wait time during lowest volume – less than 30 seconds, 90+% of the time
⚫ Average wait time during medium volume – less than
30 seconds, 85-90% of the time
⚫ Average wait time during peak volume – less than 30
seconds, 75-80% of the time
(Please note these periods are very few and we have
historical metrics that allow for effective resource planning that maintains high contact rates with low wait times.) “I would like to express our
sincere gratitude for the
excellent customer service I
received when I contacted
Point & Pay regarding our
new implementation.”
Jennifer Dimiceli
Chief Deputy Treasurer
Green Lake County, WI
“After serving the Town of
Westport for 7 years, I am
truly satisfied with Point &
Pay's service and every
experience with their support
staff has been great.”
Christine Allison, CCMC
Tax Collector
Town of Westport, CT
City of Commerce, CA 42 RFP No. 26-1001
Point & Pay is committed to providing superior technical support throughout the life of the contract. We do this by utilizing a Network Operations Center (NOC) charged with monitoring system performance, maintenance, troubleshooting, and responding to calls on a 24/7/365 basis with on-call representatives and after-hours escalation procedures. The NOC also services:
⚫ Remote support for device/terminal security updates
⚫ Integration support and file/format data exchange questions ⚫ Technical maintenance and troubleshooting
⚫ Release management and networking
ESCALATION PLAN
Point & Pay defines “critical” incidents as any event that affects a client’s ability to process transactions.
This includes system downtime, integration issues, hardware issues, and even customers struggling to access our virtual terminal application with username and password challenges. We are generally amicable to SLA’s for responsiveness to issues in the priority breakdown in the following graphic that summarizes our turnaround timeframes for problem resolution.
City of Commerce, CA 43 RFP No. 26-1001
4.1.H TRAINING INITIATIVES
Point & Pay will provide training to City staff that revolves around all system functionality and business flow of electronic payments. We offer a full training package with our staff, including multiple online/web sessions to accommodate work schedules, instructor led training to accommodate personnel prior to implementation, as well as dedicated support prior throughout the roll out process.
Point & Pay’s training initiatives include:
• Administrative Application: User management, views of real time and other reports, search for payments, etc.
• Online Components: Managing bills, batches, various
functions, and customer interactions
• Counter Application: Methods for accepting, voiding, and refunding payments
• Settlement, Reporting, and Reconciliations: Principles of Point & Pay reporting products, identify settlements, and reconcile your payments
Point & Pay developed a Client Training Portal that includes a variety of user guides, documentation resources, as well as video tutorials for additional reference.
Client Training Portal
“I really appreciate the
professionalism and
courtesy of the team, from
training to go-live; they
were there every step of
the way to guide us. I am
very pleased that we
converted to Point & Pay.”
Diane Berube, Treasurer
Greenlee City, Arizona
City of Commerce, CA 44 RFP No. 26-1001
SAMPLE TRAINING SYLLABUS
Google Meet webinar held Wednesday at 2:00 PM EST
RATIONALE
Point & Pay’s conducts Client Training sessions on Wednesday’s via the Google Meet online/web collaboration tool to introduce users to our internal systems and demonstrate how to perform various functions of the online administrative management portal.
COURSE AIMS AND OUTCOMES
The aim of this training course is to provide a complete overview of the online payments portal and how staff can utilize the system’s features and functionality at both the counter and administratively. With this knowledge, office staff and administrators can easily accept electronic payments from their customers and use the various back office functions available in to run reports, view transactions, and perform voids and refunds.
By the end of this course, users will know how to:
✓ Access their specific online payment portal
✓ Add and delete system users
✓ Reset system passwords
✓ Lock and unlock system users
✓ Take a payment
✓ Set up Payment Exclusions that prohibit certain customer accounts from using the portal ✓ Use the various Reporting functions available
✓ Search for prior payments
✓ Complete a refund or void of a past payment
✓ Contact our customer service team when additional support is needed
COURSE REQUIREMENTS
• Operating System: Windows 7 - Windows 10, or Mac OX X 10.9 (Mavericks) – 10.13 (High Sierra) • Internet Connection: 1Mbps or better (broadband recommended) • Hardware: 2GB or more of RAM; Microphone and speakers (USB headset recommended); Webcam is optional
City of Commerce, CA 45 RFP No. 26-1001
4.2 COST SAVING RECOMMENDATIONS
The proposed package of payment solutions includes our gateway solutions for web, in-person, and integrated transactions. Both the gateway/channel solutions, as well as the EPX processing engine, are designed uniquely to meet the needs of government agencies by supporting all forms of convenience fees. We uniquely designed our platform for government clients; therefore, Point & Pay supports virtually every possible use case for convenience fees/service fees. In addition, our POS terminal solutions run our proprietary EPXPay software, which supports convenience fee all-in-one easy interactions with the customer. Our APIs and other integration techniques likewise fully support these options.
Point & Pay currently has over 4,800 convenience fee applications on our platform. Convenience fee structures may be based on percentages, flat dollar amounts, tiered systems, and various hybrids.
Absorbing fees is also 100% supported across the platform. The configurations for fees versus absorbed and the specific structures applied can be made at any tier in our hierarchy, all the way down to specific payment types and channels, which ultimately enables full tailoring for each agency/application.
Point & Pay fully supports the scenario’s below.
⚫ We provide 100% of the transaction to the City, minus the convenience fee.
Two sets of merchant accounts are required to support this model; however, it is conventional for Point & Pay to acquire the MIDs that will be utilized in processing the fees as separate transactions, as per Visa regulations, so in this scenario one set would be acquired for the City and one for Point & Pay’s fee. • We provide 100% of the transaction to the City and provide the settlement of both the fee and transactions to the City.
In most circumstances, we require two sets of merchant accounts, and in this case, both would be acquired in the City’s name and configured to deposit to the City’s account. This structure is again the recommended architecture based on Visa’s regulation that convenience fees be authorized and processed separately from the payment amount. Even though in this case the destination is the same, two sets of MIDs would be recommended.
• The City factors the convenience fee into the total amount of the transaction and provides the customer a receipt showing separate line items – one for the transaction amount and another for the convenience fee (yet only one transaction settles to the City’s bank account).
We only require one set of Merchant IDs for the City’s location.
2. Cost-saving recommendations in regards to interchange fees, implementing convenience fees and other cost-saving measures. Provide options within the system to charge the fees back to the credit card patron to provide additional discounted fees and qualify for lower interchange rates.
City of Commerce, CA 46 RFP No. 26-1001
4.3 PROCESS FOR CHARGEBACKS AND OTHER ADJUSTMENTS
Point & Pay handles exceptions and chargebacks in the same manner year-round, regardless of holidays.
We receive chargebacks in two categories:
• Allocation chargebacks relate to issues with authorization and/or fraud, and we process those immediately, or as soon as we receive notification through our CRM system. • Collaboration chargebacks are processing errors, customer disputes, or similar, and we handle these requests in an overnight process.
As soon as Point & Pay receives notification of a chargeback, the customer has received a temporary credit. Our standard procedure is to notify the merchant the same day we receive the chargeback. Less than 1% of all Point & Pay transactions are chargebacks. The internal process involves handling first-level follow up with the agency by sending a detailed email about the chargeback and within 10 days of that notification, our system will reverse it.
Staff can view the reversal on the payment report and the payment details section displays it specifically as a chargeback. The City can dispute chargebacks in the same manner by providing us with the appropriate documentation, as well as the necessary signatures. Point & Pay will always submit the full set of technical transaction information that we capture for all payments. We submit this supporting documentation on behalf of the City and continue to communicate the outcome to City representatives.
During this time, we hold the reversal until all associated actions are complete. Current card association guidelines indicate a chargeback resolution timeframe of 30 days and our overall process fits well within the 30-day cycle.
There is no difference if a transaction processes on a Monday that is a holiday and the customer disputes it later, the system does not recognize that Monday as a holiday. Transactions that occur over the weekend on Saturday and Sunday will post on Monday; therefore, when we receive notification of the chargeback, our system will display it as processed on the following business day.
3. How chargebacks and other debit adjustments will be reflected: netted from daily proceeds or debited separately? Explain your firm’s rebuttal process.
City of Commerce, CA 47 RFP No. 26-1001
City of Commerce, CA 48 RFP No. 26-1001
4.4 SERVICES AND TECHNOLOGICAL ENHANCEMENTS
Point & Pay welcomes the opportunity to collaborate with the City to provide the most cost-effective and innovative payment solutions. We also provide information on other value-added services and/or features in the following sections.
QUARTERLY BUSINESS REVIEWS (QBR)
Point & Pay’s intention is to actively engage the City in our Quarterly Business Review process. This involves reviewing agreed upon KPIs and Metrics with the goal of identifying trends that engaged parties can act on for mutual benefits. A typical QBR format will present a Global KPI review, factors that impact program growth/decline, payment method preferences, future product roadmap, and discussion on any strategic directions of both parties. The QBR process is customized to the strategic account and is a dynamic process designed to ensure all actions align toward the City’s goals and objectives.
INDUSTRY TRENDS PRESENTATIONS
Point & Pay frequently conducts industry trends presentations to government audiences at all levels with a goal to educate and keep governments abreast of emerging trends in electronic payment processing that may be impactful. Point & Pay identifies these as major drivers of resource investment for our product and service offering. Our clients benefit from this foresight as it suggests new options available to promote utilization of electronic payments and increase customer satisfaction.
BETA TESTING OPPORTUNITIES
Point & Pay evaluates new technologies for processing improvements, gateway platform functionality, terminal technology, kiosk, mobile, IVR and others that support our industry. The goal is to bring the best experiences to our governmental client relationships. In doing so, our team frequently provides our strategic level customers with no cost, safe environment testing the next generation technologies that provide a "first look" at the newest emerging trends.
4. Services or technological enhancements not previously mentioned that could be considered for further improving effectiveness of the credit card system. The City is especially interested in implementing an online bill pay service to reduce over the phone transactions and absorb the low volume of City issued invoices of approximately 190 invoices per month.
City of Commerce, CA 49 RFP No. 26-1001
4.5 ONLINE MANAGEMENT TOOL FOR CITY STAFF
With Point & Pay’s ‘Workbench’ functionality, the City can access a wide array of online features for management by the billing/finance group. Staff will have full access to the real-time payment platform in and be able to perform several efficient functions referenced below. ⚫ Manage customer information and billing/communication preferences ⚫ Make payments or configure recurring payments
⚫ Manage permissions, passwords, and unlocking users
⚫ Enroll, validate, activate, and contact customers
⚫ Request new service or service termination
⚫ Manage outbound communications
⚫ Same-day voids
⚫ Full and partial refunds
⚫ Receipt retrieval
⚫ Manage “exclusions” (e.g. blacklists)
⚫ Reconciliation, reporting, and individual
5. Tools to assist City staff in the monthly reconciliation of credit card bank deposits to the City’s general ledger.
Administrative Management System
City of Commerce, CA 50 RFP No. 26-1001
ROBUST REAL-TIME REPORTING COMPONENT
Point & Pay’s suite of robust, real-time reporting tools enables all the requested details, filters, and parameters to provide real time/ad hoc reporting, file-based reporting, and our API supports querying capabilities. As a SaaS payment solution, our reporting component does not require a specific software product to receive and view reports. All reports are available in real-time and accessed on the internet via a secure browser. Designated users can create instant, online reports based on the following data fields: 1) Date range, 2) Product (i.e., payment types), Channel (online, IVR, POS), Status, Payment method, Office location, and Settlement/deposit data.
We are able to deliver daily payment files to designated users, as well as, make online reports available for immediate download in Excel, CSV, HTML, etc. We can also customize batch or end-of-the-day reporting to fit the needs of the City and ensure we satisfy all specific report requirements, including access rights and appropriate permissions for all employees. The system manages an unlimited hierarchy control and reporting per client instructions from any tier of that structure.
Point & Pay provides a vast array of reports, including those listed below. • Batch Detail and Batch Summary • Merchant Disbursement by Bank • Order Detail and Order Summary • Net Revenue
• Invoice Detail and Invoice Summary • Processor Deposit • Merchant Disbursement • Refund Detail and Refund Summary • Merchant Disbursement by Bank • Settlement Batch and Settlement Detail • Invoice Item Detail and Item Summary • Return Detail and Return Summary
AD-HOC REPORTING
Point & Pay also includes ad hoc reporting as a standard part of our account management service and is available to City users 24/7. We utilize Salesforce’s Lightning application for case management, ticket tracking, incident reports, document tracking, and operation management practices. The ad hoc reporting tools feed into dashboards for tracking concerns like case load, aging, pattern recognition, and other performance improvement activities.
CUSTOM REPORTING OPTIONS
Point & Pay’s reporting component is comprehensive and customizable. During implementation, our technical team can customize flexible configurations for the City’s reports to “roll up” or “drill down” directly within the online reporting tool by selecting various levels of report parameters customized for content, format, and frequency.
City of Commerce, CA 51 RFP No. 26-1001
The system is also able to map
MIDs and deposit configurations
to individual payment types, and
the payments and records are
perpetually linked for all
secondary service interactions
like voids, refunds, etc. The Point
& Pay system is able to manage
an unlimited hierarchy and
control settlement and reporting
per client instructions from any
tier of that structure.
Since Point & Pay’s reporting
component is available in realtime, we can transmit transaction level detail reporting to the City
at any preferred timing schedule,
as well as send these reports to
designated staff via email and/or
via our SFTP web service. We are
able to deliver daily payment files
to designated users, as well as,
make online reports available for
immediate download in Excel,
CSV, HTML, PDF, and other
formats.
Custom Report Parameters
City of Commerce, CA 52 RFP No. 26-1001
Point & Pay’s reporting component provides both detail and summary transaction details online to include the criteria above and any other criteria as required by the City. Please see a sample daily batch summary and daily batch detail report below. Both of these reports are available in real time via the Point & Pay online reporting component and we can also send these reports via email.
Daily Batch Summary Report
Daily Batch Detail Report
City of Commerce, CA 53 RFP No. 26-1001
The Payment Report (shown below) allows for flexible grouping and filtering parameters where the City can run them on an Enterprise level or in segregation. The report displays the details for each group/filter, as well as for all payment channels.
City of Commerce, CA 54 RFP No. 26-1001
MICROSOFT POWER BI
We propose use of the Microsoft Power BI reporting tool that interacts instantly and seamlessly with Excel to view and receive reports. With this impressive tool, City users will be able to connect to and transform data with advanced data preparation capabilities, interactive data visualizations, not to mention intuitive dashboards to drive informed reporting actions throughout the City.
Point & Pay has had success
utilizing Microsoft's Power BI as a
shared reporting environment for
enterprise class clients because it
functions well on all devices, allows
for fast implementation of
sophisticated, data-rich dashboards
and performance monitors, and
makes the process of pushing
regular reports to clients very
simple.
SAME-DAY VOID
Within our robust Workbench tool, there are permission-controlled functions for same-day voids, including authorization release. Designated staff with the appropriate access level can void a payment the same day a customer
submits it by searching for the
customer’s name or
confirmation number and then
selects the option to void it; the
system then prompts the user
to confirm the action. The
process of voiding a payment
happens in real-time and posts
to the report immediately.
Furthermore, a void implies
that no funds will debit from
the customer’s card/account.
Void Payment
City of Commerce, CA 55 RFP No. 26-1001
POSTBACK CONSOLE
Point & Pay also creates integration dashboards for key clients and partners so they are able to maintain full visibility into the status of all data interactions. With our Postback Console feature, City users are able to track communications between two integrated platforms, observe their statuses, view their progress in any retry routine that has been configured, and manually retriggers posts for any out of sync transactions.
EXCLUSION MANAGER
With the Exclusion Manager, our payment solution enables clients to exclude or reject all payment types, checks, credit cards, bank account number, routing numbers, and specific credit card numbers. This function also allows clients to reduce returned items, manual handling, and reduce customer service issues by providing a method of rejecting undesirable data elements during the pre-authorization validation process. Designated users have the ability to add records via manual entry or file upload, as well as the ability to view existing exclusions.
Configuration Screen for Exclusion Manager
City of Commerce, CA 56 RFP No. 26-1001
FULL OR PARTIAL REFUNDS
Point & Pay offers real-time access to refund processing across the enterprise through our administrative Workbench tool. Designated staff can view transaction details and select the void or refund options appropriate to the transactions in question. We can also restrict access to the void/refund functions to specific permissions within the user hierarchy.
Our system is designed intelligently to manage partial refunds for complex shopping carts and tracks all refunds against a particular order and prevents refunds that would exceed the initial transaction amount.
Our system also captures reason codes and the credentials authorizing the refunds. Designated staff can view transaction details and select the refund options appropriate to the transactions in question. 1 The “Refunds” button is the same for
full and partial.
2 Once that button is selected, the
refund screen will open in a separate
internet browser.
3 The system will display all line items
for the payment, except fee lines.
For a Full Refund, the user selects a reason for
the refund and has the ability to enter
comments. For a partial refund, the user
enters the amount to refund and refunds are
allowed at the line item level.
4.6 BENEFITS OF PIN PAD TECHNOLOGY
Point & Pay is proud to offer the City with the Ingenico Desk/1600 option that is compatible with the Desk/2600 – one of the PCI-validated P2PE models.
Please refer to Attachment III - Cost Summary for the fee per device. No other added cost applies.
8. Please provide information on the benefits of incorporating Pin Pad technology and include the added cost to provide this service.
Options for Partial and Full Refunds
City of Commerce, CA 57 RFP No. 26-1001
5 REFERENCES
Point & Pay is pleased to provide the six (6) following references for the City to contact.
ENTITY NAME: City of Garden Grove, California
CONTACT & TITLE: Tina Ngo, Revenue Manager
EMAIL & PHONE: [email protected] | 714.741.5065
DATES OF SERVICE: 2025 - current
SOW DESCRIPTION: Online and POS payment solutions for multiple departments ENTITY NAME: Riverside County, California
CONTACT & TITLE: Matt Jennings, Treasurer-Tax Collector EMAIL & PHONE: [email protected] | 951.955.3900
DATES OF SERVICE: 2023 - current
SOW DESCRIPTION:
Online, IVR, and POS payment solutions for Treasurer-Tax Collector and Sheriff’s Office
ENTITY NAME: Orange County Sanitation District, California CONTACT & TITLE: Ruth Zintzun, Finance Manager
EMAIL & PHONE: 714.593.7580 | [email protected]
DATES OF SERVICE: 2025 - current
SOW DESCRIPTION: All payment solutions for utility, sewer, waste bills Provide a minimum of three (3) references for work similar to this scope of services that your firm has provided within the last three (3) years. Include the following:
• A detailed description of the services,
• The agency or firm names, contact names, phone numbers, email addresses, and • Dates of services performed.
City of Commerce, CA 58 RFP No. 26-1001
ENTITY NAME: Tulare County, California
CONTACT & TITLE: Jorge Garcia-Perez, Assistant Treasurer-Tax Collector EMAIL & PHONE: [email protected] | 559.636.5250 DATES OF SERVICE: 2023 - current
SOW DESCRIPTION:
Online, POS, and IVR payment solutions for Treasurer-Tax Collector - Megabyte integration
ENTITY NAME: Stanislaus County, California
CONTACT & TITLE: Donna Riley Treasurer-Tax Collector
EMAIL & PHONE: [email protected] | 209.525.4463
DATES OF SERVICE: 2020 - current
SOW DESCRIPTION:
Online, POS, and IVR payment solutions for Treasurer-Tax Collector -Megabyte integration
ENTITY NAME: Santa Cruz County, California
CONTACT & TITLE: Laura Bowers Chief Deputy Auditor Controller EMAIL & PHONE: [email protected] 831.454.2684 DATES OF SERVICE: 2018 - current
SOW DESCRIPTION:
Online, POS, and IVR payment solutions for Treasurer-Tax Collector and other departments
City of Commerce, CA 59 RFP No. 26-1001
6 PRICING PROPOSAL
Point & Pay understands and provides the requested information on Attachment III – Cost Summary.
Point & Pay understands and complies with this requirement. 7 SIGNATURE
Point & Pay understands and provides this information signing authority on the enclosed Cover Letter which is the first page of our response.
Provide a fee schedule/pricing information in the Cost Summary template as set forth in Attachment III. ▪ Submit a complete overall pricing structure to include fixed costs, surcharges, one-time set up charges, and all other fees including, but not limited to transactions, settlements, communications, chargebacks, research and all other fees that will or could be charged. o Include costs to upgrade to EMV (Europay, Mastercard and Visa) equipment. The City will need system at our City Hall Location and a portable system for our special outdoor events. o Include pricing for additional items or a quote for the hourly rates, if applicable, for all staff proposed to work on the project or services including any sub-consultants if applicable. ▪ Proposers must submit their pricing utilizing the Cost Summary as set forth in ATTACHMENT III, which represents a sample of monthly transactions and other fees. The column titled “Proposer’s Price” must be completed in its entirety.
• Provide pricing to upgrade all sites to the latest technology for EMV chip readers, which currently totals 11.
The City shall not provide reimbursement for business or travel-related expenses; therefore, such costs must be absorbed in the hourly rate or lump sum fee structure.
Pricing shall remain firm for the entire first term of the Agreement. Thereafter, any proposed pricing adjustment for follow-on renewal periods shall be submitted to the City Representative in writing at least ninety (90) days prior to the new Agreement term. The City reserves the right to negotiate any proposed pricing adjustment not to exceed the Bureau of Labor Statistics Consumer Price Index (CPI) data as follows: Los Angeles-Long Beach-Anaheim, CA; (This information may be found on the U.S. Department of Labor’s website at www.bls.gov.)
The proposal shall be signed by an official authorized to bind the firm, including his or her printed name and title.
Proposer shall include a statement to the effect that their firm’s proposal is valid for one hundred and twenty (120) days.
RFP S-1342
ATTACHMENT “C”
MERCHANT QUESTIONNAIRE
COMPANY NAME
COMPANY REPRESENTATIVE NAME
FIRM INFORMATION
1. Does your firm utilize criminal background checks for all positions that create software or in any way handle or have access to credit card information?
2. Please provide a summary description of their internal controls environment.
3. If your company utilizes sub-contractors or third party service providers, what controls do you utilize to ensure their compliance with PCI DSS?
4. Has your firm failed to meet PCI DSS compliance criteria within the past 5 years? If yes, please explain.
5. Has your firm had any credit card breaches (lost data) within the past 5 years? If yes, please explain.
Point and Pay, LLC d/b/a Point & Pay Mark Ruis, Director of Sales - Western Region Yes, our parent corporation, 'North', (f/k/a North American Bancard), conducts a thorough background screening process for every employee, not just those who access credit card information.
Once the candidate verbally accepts an offer from North or any of its subsidiaries, employment invitations are sent out immediately, inclusive of an authorization form requesting an e-signature and the necessary personal data to initiate the background screening process referenced below.
- Criminal Record Search – County
- Criminal Record Search – State
- Education Verification
- Employment Report
- Federal Criminal National (US, FEDERAL)
- Multi-Jurisdiction Index Search
- Social Security Trace Report
- Employment Credit Report
- 10-Panel Drug Screen - Urinalysis
Point & Pay’s security system includes state of the art SSL (TLS 1.2) and encryption algorithms, firewall protection, intrusion detection systems, and additional proprietary security technology. We deploy a number of security layers to prevent unauthorized access to our systems and data, including:
- Network Segmentation: Separate zones for DMZ, Internal Processing, Vendor, Encryption, Database, etc.
- Multi-Person Controlled Key Management: A minimum of three (3) people are required for encryption key or HSM access, periodic key rotation, etc. - Data Vault: Segregated and encrypted card number storage, with strict ACLs - PAN Masking: External applications do not have Data Vault access and only have last four of card numbers, limiting exposure
- Internal Log Event Monitoring: Daily and real-time event observation and correlation - Third-Party Log Monitoring: 24/7/365 event observation and correlation by third-party - Datacenter Physical Access Controls: Secured systems in individually keyed and locked cabinets in an access-control datacenter on an access-controlled floor - Penetration Tests: At least annually, external and internal penetration tests are performed, as well as application-level pen testing
- Security Policy: Internally published guidelines with signed acknowledgments, regular training
- Database Security: For added safety, we control database access at the operating system layer and database connection level. Access to production databases is restricted to a limited number of points. Connections are monitored and audited. Production databases do not share a master password database. Application-specific accounts limit functionality to base functionality requirements. Sensitive cardholder information is separated from other transaction information, and stored in a highly secured database vault.
- Data Isolation: All merchant data is kept separate from other merchants. Even within a single merchant, logical data separation is used to establish organizational hierarchy levels such that only specified users can access and report on data for each defined organizational level.
- Data Encryption: We employ some of the most powerful encryption products available to safeguard your data and communications.
- Internal Network Security: Inside perimeter firewallsour systems are protected by Point & Pay does not intend to utilize any sub-contractors to fulfill this contract for the City of Commerce. No. We have never failed to meet PCI-DSS compliance since our founding in 1999.
No. Point & Pay has also never experienced a credit card breach or any other type of security breach since our formation. We look forward to completing this potential contract with that record intact. However, should an event occur, it is our philosophy to involve client in the remediation process from the beginning, with full transparency, as we make decisions that affect our shared customers. Please refer to our Technical Response for a full description of our incident response plan.
6. What capabilities does your firm offer to provide disaster recovery/business continuity for the services?
7. How many years has your firm been in business? A minimum of five (5) years of experience is required to submit a proposal for this RFP.
PROCESSOR OVERVIEW
1. Provide a general overview and brief history of the processing of credit card payments.
2. Identify if you offer card processing or partner with a third-party processor. Identify third party processors.
TECHNICAL CAPABILITIES
1. Identify if you can process transactions with our existing equipment (magnetic card readers) and web-based applications. If not, identify which components will need to be changed and any associated costs.
2. Provide high-level API specifications for all your services that are proposed here.
Point & Pay understands our clients require a technology infrastructure ecosystem that provides the highest economies of scale, risk mitigation, sustainability and investment protection of the financial data shared our systems and platform. Therefore, we utilize two "Tier 5 Platinum/Tier Elite" data center hosting facilities operated by Switch, a recognized world leader in data center design, development, and mission critical operations. Our primary location is Switch Las Vegas (The Core) and the secondary/backup location is Switch Grand Rapids (The Pyramid).
Switch Las Vegas requires no shutdowns for equipment replacement and maintenance. A redundant delivery path for power and cooling is added to the redundant critical components of Tier II so that each component needed to support the IT processing environment can be shut down and maintained without impact on the IT operation. In addition, the facility is SSAE18 SOC 1 Type II compliant.
In the event of a power loss, backup power is provided by up to 24 generators. Bulk fuel is stored onsite, and multiple refueling contracts are in place. The facility houses other entities deemed critical by the Department of Homeland Security, ensuring priority access to diesel fuel for any long-term emergencies.
The secondary datacenter, Switch Grand Rapids, has externally redundant telecommunications and dedicated servers for each key processing process in the DMZ, Internal Processing, Encryption, and Database segments. Each node has internally redundant hard drives and power supplies, and the secondary data site is protected by UPS and generators.
All transaction data is replicated in real time between the primary and secondary data centers. At our remote back-up location, we house redundant authorization hardware, databases, and Internet connectivity should our main physical facilities become unavailable. Should the need arise; we can recover any missing data from our redundant databases.
All networking components, SSL accelerators, load balancers, Web servers, and application servers are assembled in a redundant network architecture. Our data is maintained on a database server cluster for redundancy. All customer data is cached on carrier-class disk storage using RAID solid-state drives and multiple data paths. All customer data, up to the last committed transaction, is automatically backed up to a storage device on an ongoing nightly basis. Backup storage devices are moved to secure, fire-resistant, off-site storage on a regular basis.
Business recovery efforts are automatically invoked in response to a disaster. Key systems are monitored 24/7 with automatic notification for network administrators. In addition, we have comprehensive disaster recovery and incident response plans in place.
The recovery plans are reviewed and tested regularly.
We perform Disaster Recovery (DR) testing at least once a year. During these tests, depending on the level and areas being tested, UPSs, generators, alternate telecommunication lines, DNS traffic shifting mechanisms, and various functionality of the DR site are exercised. During a typical test, production traffic is shifted automatically to the DR site during pre-established maintenance windows, for 15 to 60 minutes, depending on the specific testing.
We provide additional information in Section C.1 in "Supporting Specifics to Attachment C, Merchant Questionnaire".
Point & Pay was founded in 1999, but later acquired by North American Bancard in 2010.
For 25 years, Point & Pay has developed unique payment solutions for online, phone, in-person, and mobile technologies that present bills, capture payments, and post, settle, and reconcile via centralized points of integration, with the highest security standards and compliance as their foundation. Point & Pay is part of the North (f/k/a North American Bancard) family of companies that processes payments specifically for government agencies. Our clients benefit from this dynamic by having the gateway, acquiring, and processing components of payment processing under one roof.
Our steady growth since the acquisition in 2010 enabled us to gain additional partnerships with governments, utilities, courts, and other organizations to build and integrate specialized payment solutions to meet each client’s unique needs and requirements for several services. Together with our parent corporation, we provide secure, end-to-end encrypted payment solutions for agencies at all levels - consolidating all functions in a payments workflow - gateway, acquirer, processor and engagement.
Today, Point & Pay provides more than 5,000 clients nationwide with sophisticated payment solutions that enable their customers to pay for several services at any time.
We understand the unique challenges faced by governments and are able to facilitate service transitions quickly. If an existing processing solution is in place, we are able to integrate seamlessly and successfully, avoiding disruption to customers, yet making the payment process more secure and effective. We are pleased to offer a flexible approach in delivering a best in class payments solution that provides convenient customer experiences and efficient operations.
We provide additional information in Section C.2 of "Supporting Specifics to Attachment C, Merchant Questionnaire".
Point & Pay’s sister company and in-house processing engine is EPX, who provides secure, end-to-end encrypted payment processing for government agencies at all levels.
We are proud to serve as an All-in-One payment provider with the gateway, acquiring, and processing components under one roof. Our clients benefit from this dynamic by combining the strengths of our best-in-class family of companies.
Point & Pay prefers to process transactions with new POS devices (equipment) to ensure our payment solution operates accurately, efficiently, and at the highest uptime levels.
No costs are associated with exchanging these devices for in-person payments.
All of Point & Pay’s solutions operate in a secure, fully hosted, cloud based Software-as-a-Service (SaaS) environment accessible from any secure browser.
Please refer to our Technical Proposal for information on our POS payment solution for the City.
Point & Pay’s approach in providing an electronic payment interface to the City’s hosted webpages is to meet and discuss integration needs required to support the ideal solution with goals to identify opportunities to save time, reduce errors, and enhance the customer experience. We utilize a wide array of integration methodologies with techniques designed to address needs from all parts of the integration spectrum: from those looking for a backend gateway, to those who want to perform complete customer handoff. In addition to the base specifications, Point & Pay has the ability to write to client specifications to perform many of the same data in/out functions described here, in clients’/partners’ native formats. We are highly experienced in completing similar integrations and are confident in our ability to deliver and integrated product. In past successful procurements where integration has been a significant consideration, we have sggested making the aard and reslting contract contingent on the completion of the
3. Identify the latest time that sales transactions can be transmitted to meet settlement times.
4. Describe the card processing transaction flow and, if applicable, how it relates to your processing partners.
5. Identify your established service levels for system availability.
6. Describe the system or tools you use to resolve chargebacks.
7. Describe your local backup or redundant systems.
CUSTOMER SERVICE
1. Identify the Relationship Manager that will be assigned to this engagement/project and include his/her resume. The Relationship Manager will be the primary point of contact for the City and must be available on an as-needed basis. Describe how the Project Manager will guarantee availability to the City during the entire duration of the engagement/contract.
With settlements via ACH, Point & Pay must configure cutoff times to allow enough time for batches to generate and transmit in time for an 11:00 PM EST submission deadline. If settling by wire transfer, we can configure the cutoff times to meet the City’s needs.
For the flow of transaction processing for both consolidated and direct funds settlement, please refer to our Technical Proposal.
With Point & Pay’s consolidated settlement, the system aggregates all payment types processed during the client-defined ‘accounting day’ into one deposit. This process makes reconciliation substantially faster and we are able to report on the movement of money for all items at any point. To facilitate the consolidation of payments, we combine deposits from the card association banks, ODFIs, processors, and partners in a holding account and released to the City per the agreed-upon timelines.
In a Direct Settlement, the City will receive funds directly from the card association banks, ODFIs, processors, and any other partner components processing transactions independently. Point & Pay will report on these transactions via our centralized repository and report settlement advice; however, we are one-step removed from full control of the process. The advantage of this approach is speed, as settlements do not require any additional steps. We can apply the settlement model of choice at any level in the City’s hierarchy and departments’ can choose the best option to fit their needs.
Point & Pay reserves two time windows per week for code releases and system maintenance. These occur on Thursday’s and Sunday’s between 11:00 PM - 2:00 AM PST. Though these windows are reserved, a typical month may only have two (2) to three (3) instances of scheduled maintenance take place. Due to system redundancy, the vast majority of our maintenance windows contain no impact to our clients’ payment processing capabilities and are transparent to users.
Point & Pay provides seven (7) days advance notice of any scheduled maintenance that will result in system unavailability, as well as send email notifications for any changes weekly to designated City representatives. To maintain continuous payment processing during normal business hours, we do not schedule system upgrades between standard nationwide business hours Monday through Friday.
Point & Pay’s virtual server architecture allows for rapid scaling as needs arise and our robust enterprise performance monitoring tools allows us to maximize system and capacity performance on a proactive basis. One of the tools we utilize is New Relic, which is a cloud-based performance analysis tool that offers real-time monitoring, error tracking, and scalability. We have found it to be an extremely beneficial solution that enhances application performance, reduces downtime and aids in efficient resource allocation.
Since Point & Pay’s platform is built for long term scale, and because of our experience in the government payments business, which is all highly due-date driven, we are experienced in maintaining systems where day-to-day throughput and peak use may vary by factors of 100x or more. Our systems are designed to accommodate loads of that nature and resource pools can be rapidly supplemented for anticipated peaks. Our environment is load tested regularly using tools to ensure the platform can support all requirements and beyond. Additional cloud environments will allow for as needed scaling and elasticity during peak times. In addition to a capacity plan, Point & Pay takes stress tests its enterprise-class deployments, pushing volume many multiples in excess of the anticipated volume.
With Point & Pay’s ‘Workbench’ functionality, the City is able to access to a wide array of online features for management by the billing/finance group. City staff will have full access to the real-time payment platform and be able to perform several efficient functions, including the chargeback/dispute process.
Point & Pay handles chargebacks in the same manner year-round, regardless of holidays. We receive chargebacks in two categories:
• Allocation chargebacks are related to authorization and/or fraud, and we process those immediately, or as soon as we receive notification through our CRM system. • Collaboration chargebacks are related to processing errors, customer disputes, or similar, and we handle these requests in an overnight process.
As soon as Point & Pay receives notification of a chargeback, the customer has received a temporary credit. Our standard procedure is to notify the merchant the same day we receive the chargeback. Less than 1% of all Point & Pay transactions are chargebacks.
The internal process involves handling first-level follow up with the agency by sending a detailed email about the chargeback and within 10 days of that notification, our system will reverse it.
Staff can view the reversal on the payment report and the payment details section displays it specifically as a chargeback. The City can dispute chargebacks in the same manner by providing us with the appropriate documentation, as well as the necessary signatures. Point & Pay will always submit the full set of technical transaction information that we capture for all payments. We submit this supporting documentation on behalf of the City and continue to communicate the outcome to City representatives. During this time, we hold the reversal until all associated actions are complete. Current card association guidelines indicate a chargeback resolution timeframe of 30 days and our overall process fits well within the 30-day cycle.
There is no difference if a transaction processes on a Monday that is designated as a holiday and the customer disputes it later, the system does not recognize that Monday as a holiday. Transactions that occur over the weekend on Saturday and Sunday will post on Monday; therefore, when we are notified of the chargeback, our system will display it as processed on the following business day.
Point & Pay understands our clients require a technology infrastructure ecosystem that provides the highest economies of scale, risk mitigation, sustainability and investment protection of the financial data shared our systems and platform. Therefore, we utilize two "Tier 5 Platinum/Tier Elite" data center hosting facilities operated by Switch, a recognized world leader in data center design, development, and mission critical operations. Our primary location is Switch Las Vegas (The Core) and the secondary/backup location is Switch Grand Rapids (The Pyramid).
Switch Las Vegas requires no shutdowns for equipment replacement and maintenance. A redundant delivery path for power and cooling is added to the redundant critical components of Tier II so that each component needed to support the IT processing environment can be shut down and maintained without impact on the IT operation. In addition, the facility is SSAE18 SOC 1 Type II compliant.
In the event of a power loss, backup power is provided by up to 24 generators. Bulk fuel is stored onsite, and multiple refueling contracts are in place. The facility houses other entities deemed critical by the Department of Homeland Security, ensuring priority access to diesel fuel for any long-term emergencies.
The secondary datacenter, Switch Grand Rapids, has externally redundant telecommunications and dedicated servers for each key processing process in the DMZ, Internal Processing, Encryption, and Database segments. Each node has internally redundant hard drives and power supplies, and the secondary data site is protected by UPS and generators.
All transaction data is replicated in real time between the primary and secondary data centers. At our remote back-up location, we house redundant authorization hardware, Point & Pay designates Mark Ruis as the City’s primary account/relationship manager responsible for maintain ongoing communications with key stakeholders at the City. He will facilitate the contracting process, guide the City through Point & Pay’s product offerings, and perform regular meetings to update staff with new developments. Mr. Ruis will coordinate any questions or concerns immediately with Diana Andino, the City’s designated Client Success Manager. We recognize that a positive client success experience involves being responsive and timely in resolving any inquiries since they are vital to efficient daily operations for City departments.
As Point & Pay’s Director of Sales of the Western region, Mark Ruis has developed and maintained key relations with clients in CaliforniaMrRuis also serves in a consulting
2. Identify additional key personnel from your company that will be assigned to this contract. Please provide resumes for each person which include past experience, education, their current job title, length of time with the company, the role they will play in the engagement/contract, and any other pertinent information.
3. Provide an organizational chart for your company and include an issue escalation process for problem resolution.
PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS
1. Describe your PCI DSS Compliance status, program and how you maintain your compliance with PCI standards. Have you been certified as compliant by a third-party assessor?
2. Describe your role in supporting merchant PCI compliance.
REPORTING
1. Describe the daily and monthly reconciliation reports available to the City, as well as the delivery methods and standard delivery time for such reports.
Providing the necessary staff and resources for the City is of utmost importance to us; therefore, we assign the following highly skilled, key project personnel dedicated to the City’s project throughout implementation and the contract duration.
DIANA ANDINO, CSM | BILINGUAL CLIENT SUCCESS MANAGER
Diana Andino will serve as the Client Success Manager to provide hands on management to ensure we provide ongoing support and a positive client success experience for the City. In this role, she is responsible for maintaining the associated communications and expectations between staff, clients and their customers. Ms. Andino will also provide regular service performance reporting to the City. Ms. Andino’s key responsibility is to monitor the City’s support queue in our CRM platform to maintain visibility with all business/project issues that may arise. She will serve as an advocate by building trust and maintaining fast time-to-value results. Diana Andino demonstrates superior leadership skills in managing communications for complex program deliveries with a focus on exceeding client expectations.
With over a decade of experience in onboarding, implementations, and product management, Ms. Andino approaches client communication with a deft hand, providing timely and accessible assistance, feedback, instruction, and reporting according to address the County’s specific needs. Her position as a Certified Scrum Master guarantees she is equipped to manage implementations on this scale, and her previous awards, including Top Sales Manager at the Tampa Tribune, demonstrates her commitment and desire to exceed expectations. Diana Andino earned an AA Business Degree from the American College of Puerto Rico.
MARGIE LIRIANO, CSPO, DIRECTOR OF OPERATIONS/IMPLEMENTATIONS Margie Liriano is responsible for managing the entire life cycle of new client implementations to ensure project completion on time and on budget. She coordinates post Go Live requests between multiple departments by instituting innovative process that result in an efficient workflow. Ms. Liriano also develops weekly status reports, implementation schedules, and maintains the associated communications and expectations between staff, clients and software providers. She further serves as a product manager by meeting regularly with the development team to train staff on new product design.
Margie Liriano has a decade of experience in managing implementations and client project requests with differing technical and business requirements. Ms. Liriano’s technical skills include SQL Jira, Salesforce, MS Office, Google Suite, and connecting VPN tunnels and FTP sites for delivery of sensitive material.
CHRIS GEISEL, A-CSPO, CPP, PRODUCT MANAGER
Chris Geisel will work alongside Margie Liriano during the implementation to determine the best products for additional City departments to ensure that each set of requirements align with the Point & Pay product offering. Mr. Geisel is an experienced, technically trained business leader and product owner, adept at using technology to improve business processes.
In this pivotal role, he manages client product specifications for government clients nationwide with use of the applicable project management skills. Chris Geisel is adept at Point & Pay provides an organizational chart for the project team and escalation graphic in our Technical Proposal.
Point & Pay’s project team possesses over 30 years’ experience in delivering, implementing, and managing large-scale projects for government agencies nationwide.
Our Operations and Client Success divisions are comprised of multiple functional teams supporting each client’s implementation. We have found using telepresence platforms to manage large-scale projects prove most successful and efficient.
Point & Pay defines “critical” incidents as any event that affects a client’s ability to process transactions. This includes system downtime, integration issues, hardware issues, and even customers struggling to access our virtual terminal application with username and password challenges. We are generally amicable to SLA’s for responsiveness to issues in the priority breakdown in the graphic that summarizes our turnaround timeframes for problem resolution.
Point & Pay is both PCI-DSS Level 1 and SOC 2 Type I compliant and undergo annual audits of our systems’, including penetration tests. We understand the importance of ensuring our clients’ financial data is kept secure and believe a holistic approach is the best posture to ensure card data security. Our focus is to uphold the highest level of security to exceed the needs of our clients.
We are active participants in the PCI Council and other industry associations where we discuss common security concerns like NACHA, the ETA, NACO, and NACTFO. North, our parent corporation, also employs a compliance group that tracks all aspects of transaction processing compliance and sets corporate policies and procedures to ensure good standing with the PCI Council, NACHA, and all card associations.
Point & Pay has pioneered several payment acceptance methods that would help the City dramatically reduce their PCI compliance burdens. We operate an independent compliance service through the brand and we offer robust scanning and SAQ services.
In addition to these compliance tools, we engineered our solutions to reduce scope.
Wherever possible, Point & Pay suggests to:
- Utilize solutions that hand customers off to Point & Pay for critical processing steps - Use tokenization strategies instead of storing card information - Use PCI-encrypted solutions to prevent clear text transmission across the City’s networks
Point - Use &
embedded
Pay’s suite
solutions
of robust,
for
real-time
working within
reporting
existing
tools
cashiering
enables all
solutions
the requested details,
filters, and parameters to provide real time/ad hoc reporting, file-based reporting, and our API supports querying capabilities. As a SaaS payment solution, our reporting component does not require a specific software product to receive and view reports. All reports are available in real-time and accessed on the internet via a secure browser.
Designated users can create instant, online reports based on the following data fields: 1) Date range, 2) Product (i.e., payment types), Channel (online, IVR, POS), Status, Payment method, Office location, and Settlement/deposit data.
We are able to deliver daily payment files to designated users, as well as, make online reports available for immediate download in Excel, CSV, HTML, PDF, and other formats.
We can also customize batch or end-of-the-day reporting to fit the needs of each City ff
2. Describe how multiple merchant numbers are reported and the flexibility afforded the City for customizing the reports.
3. Provide sample statements and reports that would be provided to the City relative to the needs described by the City in the scope of services (e.g., merchant account statements, etc.). Indicate how these reports are provided to the City (e.g., online, mail, email, etc.).
IMPLEMENTATION & TRAINING
1. Describe the merchant training process with regard to:
○ Initial new merchant training
○ On-going training- Describe any regular or on-going service or training opportunities and how such service/training is accessed (e.g., online, hosted calls, in-person seminars, etc.). ○ Updates and dissemination of industry-related rules or regulatory changes
Point & Pay’s reporting component is comprehensive and customizable. During implementation, our technical team can customize flexible configurations for the City’s reports to “roll up” or “drill down” directly within the online reporting tool by selecting various levels of report parameters customized for content, format, and frequency.
The system is also able to map MIDs and deposit configurations to individual payment types, and the payments and records are linked for all secondary service interactions like voids, refunds, etc. The Point & Pay system is able to manage an unlimited hierarchy and control settlement and reporting per client instructions from any tier of that structure.
Point & Pay provides sample reports in Section C.6 of "Supporting Specifics to Attachment C, Merchant Questionnaire". Since Point & Pay’s reporting component is available in real-time, we can transmit transaction level detail reporting to the City at any preferred timing schedule, as well as send these reports to designated staff via email and/or via our SFTP web service. We are able to deliver daily payment files to designated users, as well as, make online reports available for immediate download in Excel, CSV, HTML, PDF, and other formats.
Point & Pay will provide training to City staff that revolves around all system functionality and business flow of electronic payments. We offer a full training package with our staff, including multiple online/web sessions to accommodate work schedules, on-site instructor led training to accommodate personnel prior to implementation (if/as needed), as well as dedicated support prior throughout the roll out process.
Key areas of our training initiatives include:
• Administrative Application: User management, views of real time and other reports, search for payments, and similar issues
• Online Components: Managing bills, batches, various functions, and customer interactions
• Counter Application: Methods for accepting, voiding, and refunding payments • Settlement, Reporting, and Reconciliations: Principles of Point & Pay reporting products, identify settlements, and reconcile your payments
Point & Pay also developed a Client Training Portal that includes a variety of user guides, documentation resources, as well as video tutorials for additional reference.
Point & Pay’s ongoing training sessions are conducted on Wednesday's via the Google Meet web collaboration tool to introduce new users to Point & Pay’s systems and demonstrate how to perform the various functions of our online payments portal. For additional information, please refer to Section C.7 of "Supporting Specifics to Attachment C, Merchant Questionnaire".
Point & Pay frequently conducts industry trends presentations to government audiences at all levels with a goal to educate and keep governments abreast of industry and/or regulatory changes, as well as emerging trends in electronic payment processing that may be impactful. Point & Pay identifies these as major drivers of resource investment for our product and service offering. Our clients benefit from this foresight as it suggests new options available to promote utilization of electronic payments and increase customer satisfaction.
ATTACHMENT III
COST SUMMARY (to be completed by Proposer)
Proposers MUST complete this table in order to be considered compliant with the RFP. Enter text and prices in shaded boxes, where applicable. You may submit your own fee schedule/pricing information in addition to this Cost Summary.
Number of
Transactions Net Sales Card Type
Proposer's
Price Comment
589 $ 1, 542,393 VISA This section represents one Fiscal Year. Do NOT include the interchange rates governed by the credit card
companies.
281 $ 450,390 MASTERCARD
4 $ 481 DISCOVER
176 $ 524,946 AMERICAN EXPRESS
173 $ 151,593 Debit Cards
Total for all Card
Types
Other Service Charges Price Comment
Fee per Chargeback
Batch Fee
Monthly Relationship Fee for Parent Account
Monthly Relationship Fee per Merchant ID
One Time Set-up Fee
Online Reporting Fees Price Comment
Per Parent Relationship/month
Per Merchant ID/month
Per User/month
Equipment Charges Price Comment
Chip & PIN Machines Ingenico Desk/2600 - no cost for 1, additional $400 each Wireless Machines for Special Event Use Ingenico Move/5000 - no cost for 1, additional $850 each PinPads for Debit Card Use Ingenico Desk/1600 - no cost for 1, additional $325 each Other Charges (List all charges not mentioned above) Price Comment Third Party Transactions(ie. AMEX) – transactions
that are passed directly to Thirds Party Service
Providersfor processing and/or funding
5 $0
$0
$0
$0
$0
$0
$0
$0
$0
$0
$0
2.75% $1.50
Same
Same
Same
Same
2.75% $1.50
$0
Payment Card Industry
Data Security Standard
Attestation of Compliance for Report
on Compliance – Service Providers
Version 4.0.1
Publication Date: August 2024
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance - Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page i PCI DSS v4.0.1 Attestation of Compliance for Report on
Compliance – Service Providers
Entity Name: Point and Pay, LLC
Date of Report as noted in the Report on Compliance: 2025-03-20 Date Assessment Ended: 2025-02-27
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 1 Section 1: Assessment Information
Instructions for Submission
This Attestation of Compliance (AOC) must be completed as a declaration of the results of the service provider’s assessment against the Payment Card Industry Data Security Standard (PCI DSS) Requirements and Testing Procedures (“Assessment”). Complete all sections. The service provider is responsible for ensuring that each section is completed by the relevant parties, as applicable. Contact the entity(ies) to which this AOC will be submitted for reporting and submission procedures.
This AOC reflects the results documented in an associated Report on Compliance (ROC). Associated ROC sections are noted in each AOC Part/Section below.
Capitalized terms used but not otherwise defined in this document have the meanings set forth in the PCI DSS Report on Compliance Template.
Part 1. Contact Information
Part 1a. Assessed Entity
(ROC Section 1.1)
Company name: Point and Pay, LLC
DBA (doing business as): Not Applicable
Company mailing address: 110 State Street E., Suite D, Oldsmar, FL 34677 Company main website: https://pointandpay.com
Company contact name: Scott Richardson
Company contact title: Manager, Information Security (IT Risk and Compliance) Contact phone number: +1 (720) 673-2679
Contact e-mail address: [email protected]
Part 1b. Assessor
(ROC Section 1.1)
Provide the following information for all assessors involved in the Assessment. If there was no assessor for a given assessor type, enter Not Applicable.
PCI SSC Internal Security Assessor(s)
ISA name(s): Joshua Wingate
Qualified Security Assessor
Company name: CompliancePoint, Inc.
Company mailing address: 4400 River Green Parkway, Suite 100, Duluth, GA 30096 Company website: https://compliancepoint.com
Lead Assessor name: John Barbier
Assessor phone number: +1 (770) 255-1100
Assessor e-mail address: [email protected]
Assessor certificate number: 204-131
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 2 Part 2. Executive Summary
Part 2a. Scope Verification
Services that were INCLUDED in the scope of the Assessment (select all that apply):
Name of service(s) assessed: Payment Gateway
Type of service(s) assessed:
Hosting Provider: Managed Services: Payment Processing:
☐ Applications / software ☐ Systems security services ☒ POI / card present ☐ Hardware ☐ IT support ☒ Internet / e-commerce
☐ Infrastructure / Network ☐ Physical security ☒ MOTO / Call Center ☐ Physical space (co-location) ☐ Terminal Management System ☐ ATM ☐ Storage ☐ Other services (specify): ☐ Other processing (specify):
☐ Web-hosting services
☐ Security services
☐ 3-D Secure Hosting Provider
☐ Multi-Tenant Service Provider
☐ Other Hosting (specify):
☐ Account Management ☐ Fraud and Chargeback ☒ Payment Gateway/Switch ☐ Back-Office Services ☐ Issuer Processing ☐ Prepaid Services ☐ Billing Management ☐ Loyalty Programs ☐ Records Management ☐ Clearing and Settlement ☐ Merchant Services ☐ Tax/Government Payments ☐ Network Provider
☐ Others (specify):
Note: These categories are provided for assistance only and are not intended to limit or predetermine an entity’s service description. If these categories do not apply to the assessed service, complete “Others.” If it is not clear whether a category could apply to the assessed service, consult with the entity(ies) to which this AOC will be submitted.
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 3 Part 2. Executive Summary (continued)
Part 2a. Scope Verification (continued)
Services that are provided by the service provider but were NOT INCLUDED in the scope of the Assessment (select all that apply):
Name of service(s) not assessed: Not Applicable
Type of service(s) not assessed:
Hosting Provider: Managed Services: Payment Processing:
☐ Applications / software ☐ Systems security services ☐ POI / card present ☐ Hardware ☐ IT support ☐ Internet / e-commerce
☐ Infrastructure / Network ☐ Physical security ☐ MOTO / Call Center ☐ Physical space (co-location) ☐ Terminal Management System ☐ ATM ☐ Storage ☐ Other services (specify): ☐ Other processing (specify):
☐ Web-hosting services
☐ Security services
☐ 3-D Secure Hosting Provider
☐ Multi-Tenant Service Provider
☐ Other Hosting (specify):
☐ Account Management ☐ Fraud and Chargeback ☐ Payment Gateway/Switch ☐ Back-Office Services ☐ Issuer Processing ☐ Prepaid Services ☐ Billing Management ☐ Loyalty Programs ☐ Records Management ☐ Clearing and Settlement ☐ Merchant Services ☐ Tax/Government Payments ☐ Network Provider
☐ Others (specify):
Provide a brief explanation why any checked services
were not included in the Assessment:
Not Applicable
Part 2b. Description of Role with Payment Cards
(ROC Sections 2.1 and 3.1)
Describe how the business stores, processes, and/or
transmits account data.
Point and Pay receives CHD through one of three
URLs, namely pnpapi.pointandpay.net,
agent.pointandpay.net, and client.pointandpay.net
across a TLS V1.2+ connection to a load balancer
which connects the connection to a web server and
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 4 holds the data in VRAM. The web servers transmits the
CHD to a middle tier server which transmits the
transaction request across a TLS V1.2+ connection to
the payment processor, after which the result is
returned to the merchant. PAN, cardholder name, and
expiry are written to an AES-256 encrypted database
after which PAN and SAD are purged from VRAM.
Describe how the business is otherwise involved in or
has the ability to impact the security of its customers’ account data.
Not Applicable
Describe system components that could impact the
security of account data.
No employees have access to account data in the
ordinary course of business. Under extraordinary
circumstances such as troubleshooting an individual
transaction, an employee may invoke a low-level
decryption tool and provide the encrypted value of a
single stored PAN value after which the PAN value
would be returned to the employee. Access to the tool
is limited to administrators with a legitimate business case, and use is logged accordingly.
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 5 Part 2. Executive Summary (continued)
Part 2c. Description of Payment Card Environment
Provide a high-level description of the environment covered by this Assessment.
For example:
Connections into and out of the cardholder data
environment (CDE).
Critical system components within the CDE, such as POI devices, databases, web servers, etc., and any other
necessary payment components, as applicable.
System components that could impact the security of
account data.
Point and Pay is a payment gateway that
enables merchants to accept swiped and keyed
cards and then provides a secure gateway to
obtain approvals. Payments are received on
out-of-scope client or third-party systems
through web portals, IVR payments, mobile
payments, recurring billing, SMS payments,
POS terminals, or kiosks. In all cases, card data
is captured into the Point and Pay systems
through one of the URLs, namely
pnpapi.pointandpay.net, agent.pointandpay.net,
and client.pointandpay.net using a TLS V1.2+
connection which transmits the CHD to the
payment processors for authorization.
Indicate whether the environment includes segmentation to reduce the scope of the Assessment.
(Refer to the “Segmentation” section of PCI DSS for guidance on segmentation) ☒ Yes ☐ No
Part 2d. In-Scope Locations/Facilities
(ROC Section 4.6)
List all types of physical locations/facilities (for example, corporate offices, data centers, call centers and mail rooms) in scope for this Assessment.
Facility Type
Total Number of
Locations
(How many locations of
this type are in scope)
Location(s) of Facility
(city, country)
Data Center 2 Grand Rapids, MI (USA)
Las Vegas, NV (USA)
Corporate Office (Not in scope) 1 Oldsmar, FL (USA)
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 6 Part 2. Executive Summary (continued)
Part 2e. PCI SSC Validated Products and Solutions
(ROC Section 3.3)
Does the entity use any item identified on any PCI SSC Lists of Validated Products and Solutions? ☐ Yes ☒ No
Provide the following information regarding each item the entity uses from PCI SSC's Lists of Validated Products and Solutions:
Name of PCI SSC
validated Product or
Solution
Version of
Product or
Solution
PCI SSC Standard to
which Product or
Solution Was Validated
PCI SSC Listing
Reference
Number
Expiry Date of
Listing
Not Applicable Not
Applicable
Not Applicable Not Applicable Not Applciable
* For purposes of this document, ”Lists of Validated Products and Solutions” means the lists of validated products, solutions, and/or components, appearing on the PCI SSC website (www.pcisecuritystandards.org) (for example, 3DS Software Development Kits, Approved PTS Devices, Validated Payment Software, Point to Point Encryption (P2PE) solutions, Software-Based PIN Entry on COTS (SPoC) solutions, Contactless Payments on COTS (CPoC) solutions), and Mobile Payments on COTS (MPoC) products.
For purposes of this document, ”Lists of Validated Products and Solutions” means the lists of validated products, solutions, and/or components appearing on the PCI SSC website (www.pcisecuritystandards.org)for example, 3DS Software Development Kits, Approved PTS Devices, Validated Payment Software, Payment Applications (PADSS), Point to Point Encryption (P2PE) solutions, Software-Based PIN Entry on COTS (SPoC) solutions, and Contactless Payments on COTS (CPoC) solutions.
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 7 Part 2. Executive Summary (continued)
Part 2f. Third-Party Service Providers
(ROC Section 4.4)
For the services being validated, does the entity have relationships with one or more third-party service providers that:
Store, process, or transmit account data on the entity’s behalf (for example, payment gateways, payment processors, payment service providers (PSPs, and off-site storage)) ☒ Yes ☐ No
Manage system components included in the entity’s Assessment (for example, via network security control services, anti-malware services, security incident and event management (SIEM), contact and call centers, web-hosting companies, and IaaS, PaaS, SaaS, and FaaS cloud providers)
☒ Yes ☐ No
Could impact the security of the entity’s CDE (for example, vendors providing support via remote access, and/or bespoke software developers).
☐ Yes ☒ No
If Yes:
Name of Service Provider: Description of Services Provided:
RingCentral IVR Services
North - Shared Service Hosting, shared services
Note: Requirement 12.8 applies to all entities in this list.
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 8 Part 2. Executive Summary (continued)
Part 2g. Summary of Assessment (ROC Section 1.8.1)
Indicate below all responses provided within each principal PCI DSS requirement.
For all requirements identified as either “Not Applicable” or “Not Tested,” complete the “Justification for Approach” table below.
Note: One table to be completed for each service covered by this AOC. Additional copies of this section are available on the PCI SSC website.
Name of Service Assessed: Payment Gateway
PCI DSS
Requirement
Requirement Finding
More than one response may be selected for a given requirement.
Indicate all responses that apply.
Select If a
Compensating
Control(s) Was
Used
In Place Not Applicable Not Tested Not in Place
Requirement 1: ☒ ☒ ☐ ☐ ☐
Requirement 2: ☒ ☒ ☐ ☐ ☐
Requirement 3: ☒ ☒ ☐ ☐ ☐
Requirement 4: ☒ ☒ ☐ ☐ ☐
Requirement 5: ☒ ☒ ☐ ☐ ☐
Requirement 6: ☒ ☐ ☐ ☐ ☐
Requirement 7: ☒ ☒ ☐ ☐ ☐
Requirement 8: ☒ ☒ ☐ ☐ ☐
Requirement 9: ☒ ☒ ☐ ☐ ☐
Requirement 10: ☒ ☐ ☐ ☐ ☐
Requirement 11: ☒ ☒ ☐ ☐ ☐
Requirement 12: ☒ ☒ ☐ ☐ ☐
Appendix A1: ☐ ☒ ☐ ☐ ☐
Appendix A2: ☐ ☒ ☐ ☐ ☐
Appendix A3: ☐ ☒ ☐ ☐ ☐
Justification for Approach
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 9 Part 2. Executive Summary (continued)
For any Not Applicable responses, identify which subrequirements were not applicable and the reason.
1.2.6 - No insecure services, protocols, or ports
are used within the assessed in-scope
environment.
1.5.1 - No systems have access to untrusted
networks and CDE systems
2.3.1, 2.3.2 - No wireless environments are within
the assessed in-scope environment.
3.3.1.3 - No access to PIN or PIN blocks.
3.3.2 - SAD is not stored in any capacity at any
time.
3.3.3 - Point and Pay is not an issuer nor do they
provide any issuing services.
3.4.2 - No employees with remote access
technology to cardholder data.
3.5.1.1 - Hashing is not used to render PAN
unreadable.
3.5.1.2, 3.5.1.3 - No disk-level or partition-level
encryption is used to render cardholder data
unreadable.
3.7.6 - No cleartext cryptographic keys in use.
3.7.9 - Cryptographic keys are not shared with
customers.
4.2.1.2 - No wireless networks connected to the
CDE or used to transmit CHD.
4.2.2 - Point and Pay prohibits the transmission of
PAN using end-user messaging technologies.
5.2.3, 5.2.3.1 - Anti-malware is deployed on all
hosts.
6.5.2, 11.3.1.3, 11.3.2.1 - Point and Pay did not
undergo any significant changes.
7.2.5, 7.2.5.1, 8.6.1, 8.6.2, 8.6.3 - This
assessment was completed prior to March 31,
2025.
8.2.3 - No access to customer premises or
systems.
8.2.7 - No third-party accounts for remote access
into Point and Pay's environment.
8.3.10, 8.3.10.1 - Point and Pay does not provision
customer accounts for access to in-scope
systems.
9.4.1.1, 9.4.1.2, 9.4.3, 9.4.4, 9.4.5, 9.4.5.1 - Point
and Pay does not maintain removable electronic
media that interacts with or contains cardholder
data.
9.4.2 - No in-scope physical media.
9.4.6 - No hard-copy materials that contain
cardholder data.
9.5.1, 9.5.1.1, 9.5.1.2, 9.5.1.2.1, 9.5.1.3 - No POI
devices that interact with cardholder data.
11.4.7, A1.1.1, A1.1.2, A1.1.3, A1.1.4, A1.2.1,
A1.2.2, A1.2.3 - Point and Pay is not a multi-tenant
service provider.
12.3.2 - Point and Pay does not use a customized
approach to meet any PCI DSS requirements.
A2.1.1, A2.1.2, A2.1.3 - No POI terminals using
SSL or early TLS.
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 10 Part 2. Executive Summary (continued)
For any Not Tested responses, identify which subrequirements were not tested and the reason. Not Applicable Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 11 Section 2 Report on Compliance
(ROC Sections 1.2 and 1.3)
Date Assessment began:
Note: This is the first date that evidence was gathered, or observations were made. 2024-12-10
Date Assessment ended:
Note: This is the last date that evidence was gathered, or observations were made. 2025-02-27
Were any requirements in the ROC unable to be met due to a legal constraint? ☐ Yes ☒ No Were any testing activities performed remotely? ☒ Yes ☐ No Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 12 Section 3 Validation and Attestation Details
Part 3. PCI DSS Validation (ROC Section 1.7)
This AOC is based on results noted in the ROC dated (Date of Report as noted in the ROC 2025-03-20).
Indicate below whether a full or partial PCI DSS assessment was completed:
☒ Full Assessment – All requirements have been assessed and therefore no requirements were marked as Not Tested in the ROC.
☐ Partial Assessment – One or more requirements have not been assessed and were therefore marked as Not Tested in the ROC. Any requirement not assessed is noted as Not Tested in Part 2g above.
Based on the results documented in the ROC noted above, each signatory identified in any of Parts 3b-3d, as applicable, assert(s) the following compliance status for the entity identified in Part 2 of this document (select one):
☒ Compliant: All sections of the PCI DSS ROC are complete, and all assessed requirements are marked as being either In Place or Not Applicable, resulting in an overall COMPLIANT rating; thereby (Point and Pay, LLC) has demonstrated compliance with all PCI DSS requirements except those noted as Not Tested above.
☐ Non-Compliant: Not all sections of the PCI DSS ROC are complete, or one or more requirements are marked as Not in Place, resulting in an overall NON-COMPLIANT rating; thereby (Point and Pay, LLC) has not demonstrated compliance with PCI DSS requirements.
Target Date for Compliance: Not Applicable
An entity submitting this form with a Non-Compliant status may be required to complete the Action Plan in Part 4 of this document. Confirm with the entity to which this AOC will be submitted before completing Part 4.
☐ Compliant but with Legal exception: One or more assessed requirements in the ROC are marked as Not in Place due to a legal restriction that prevents the requirement from being met and all other assessed requirements are marked as being either In Place or Not Applicable, resulting in an overall COMPLIANT BUT WITH LEGAL EXCEPTION rating; thereby (Point and Pay, LLC) has demonstrated compliance with all PCI DSS requirements except those noted as Not Tested above or as Not in Place due to a legal restriction.
This option requires additional review from the entity to which this AOC will be submitted.
If selected, complete the following:
Affected Requirement Details of how legal constraint prevents requirement from being met
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 13 Part 3. PCI DSS Validation (continued)
Part 3a. Service Provider Acknowledgement
Signatory(s) confirms:
(Select all that apply)
☒
The ROC was completed according to PCI DSS, Version 4.0.1 and was completed according to the instructions therein.
☒
All information within the above-referenced ROC and in this attestation fairly represents the results of the Assessment in all material respects.
☒
PCI DSS controls will be maintained at all times, as applicable to the entity’s environment.
Part 3b. Service Provider Attestation
Signature of Service Provider Executive Officer Date:
Service Provider Executive Officer Name: Robert Hotaling Title: Chief Information Security Officer Part 3c. Qualified Security Assessor (QSA) Acknowledgement If a QSA was involved or assisted with this
Assessment, indicate the role performed:
☒ QSA performed testing procedures.
☐ QSA provided other assistance.
If selected, describe all role(s) performed: Not Applicable Signature of Lead QSA Date:
Lead QSA Name: John Barbier
Signature of Duly Authorized Officer of QSA Company Date:
Duly Authorized Officer Name: Brandon Breslin QSA Company: CompliancePoint, Inc.
Part 3d. PCI SSC Internal Security Assessor (ISA) Involvement If an ISA(s) was involved or assisted with this
Assessment, indicate the role performed: ☐
ISA(s) performed testing procedures.
☒
ISA(s) provided other assistance.
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D 3/21/2025
3/21/2025
3/21/2025
PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 14 Joshua Wingate, ISA, assisted Point and Pay personnel
with procuring and gathering appropriate evidence, and
performed reviews to provide additional context for provided documentation.
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D PCI DSS v4.0.1 Attestation of Compliance for Report on Compliance Service Providers August 2024 © 20062024 PCI Security Standards Council, LLC. All rights reserved. Page 15 Part 4. Action Plan for Non-Compliant Requirements
Only complete Part 4 upon request of the entity to which this AOC will be submitted, and only if the Assessment has Non-Compliant results noted in Section 3.
If asked to complete this section, select the appropriate response for “Compliant to PCI DSS Requirements” for each requirement below. For any “No” responses, include the date the entity expects to be compliant with the requirement and provide a brief description of the actions being taken to meet the requirement.
PCI DSS
Requirement Description of Requirement
Compliant to PCI
DSS Requirements
(Select One)
Remediation Date and
Actions
(If “NO” selected for any
Requirement)
YES NO
1 Install and maintain network security
controls ☐ ☐
2 Apply secure configurations to all system
components ☐ ☐
3 Protect stored account data ☐ ☐
4 Protect cardholder data with strong
cryptography during transmission over
open, public networks
☐ ☐
5 Protect all systems and networks from
malicious software ☐ ☐
6 Develop and maintain secure systems and
software ☐ ☐
7 Restrict access to system components and
cardholder data by business need to know ☐ ☐
8 Identify users and authenticate access to
system components ☐ ☐
9 Restrict physical access to cardholder data ☐ ☐
10 Log and monitor all access to system
components and cardholder data ☐ ☐
11 Test security systems and networks
regularly ☐ ☐
12 Support information security with
organizational policies and programs ☐ ☐
Appendix A1 Additional PCI DSS Requirements for MultiTenant Service Providers ☐ ☐ Appendix A2
Additional PCI DSS Requirements for
Entities using SSL/early TLS for CardPresent POS POI Terminal Connections☐ ☐ Note: The PCI Security Standards Council is a global standards body that provides resources for payment security professionals developed collaboratively with our stakeholder community. Our materials are accepted in numerous compliance programs worldwide. Please check with your individual compliance accepting organization to ensure that this form is acceptable in their program. For more information about PCI SSC and our stakeholder community please visit:
https://www.pcisecuritystandards.org/about_us/
Docusign Envelope ID: 291E2BD1-FCDB-4FF4-81FE-0DF67AACD26D