WL SIPS DOCS

The Worldline Sips solution secures card data through a tokenisation process.

The tokeniser principle is to associate a single token for a given card number: this assigned token is non-reversible and does not make it possible to find the card number.

The token is a number shared by you and Worldline Sips and replaces the credit card number (PAN) securely.

Token usage is a simple method that contributes to the PCI DSS compliance.

Messages exchanged between you and Worldline Sips are signed by encryption keys.

Worldline Sips security keys ensure:

• your authentication
• the authorisation request from the cardholder's bank
• data privacy, as data is encrypted over the Internet
• the integrity of data exchanged

Depending on the type of connector used, security is either provided by a secret key (for HTTPS connectors) or by X509 certificates (used to secure web-service type connectors).

Using an ID and a password provides access to the Worldline Sips interfaces with the associated rights. The user can log out at any time. To ensure the security of users, the implemented security policy requires the following:

• enter a new password the first time you log in
• frequent password renewal (valid for three months)
• the password must have a minimum length of 10 characters and must include:
  • at least one alphabetic character
  • at least one digit
  • at least one special character
• the password must be different from the last four passwords used

All of these contribute to securing the data.

Resources are pooled for all customers of the Worldline Sips offers: same databases, same application servers.

Each merchant is associated with a commercial offer itself associated with a technical offer. Following the authentication step to an application, it is the application itself that ensures the compartmentalisation of merchants and their webshops.

Securing exchanges of internal Worldline files and external customer files is ensured by our file transfer gateway set up in a mutualised bubble that is subject to all the management restrictions and procedures imposed by the PCI DSS standard.

Data exchanges by secure file transfer or secure web services implement:

• an authentication by identification (user/password) on the Secure File Transfer Protocol (SFTP) server
• a SSL/TLS (TLS 1.2) encrypted protection of streams exchanged for FTPS and PeSIT protocols
• a SSH (two-key) encrypted protection of streams exchanged for SFTP.

The HyperText Transfer Protocol (HTTP) allows you to connect to a web server and transfer data over the web. But this protocol is not secure, which means that an evil-minded third party could intercept and read such data.

Its secure variant, the Secure HyperText Transfer Protocol (HTTPS) adds a Secure Socket Layer (SSL) / Transfer Layer Security (TLS) protocol to HTTP. Not only does this additional protocol ensure data integrity and encryption (which makes it unreadable by a third party) during transmission, it also allows the holder of an SSL/TLS certificate used on a website to be authenticated, thanks to a "padlock" icon displayed next to the URL in the user's browser. This authentication is done through the use of a X509 digital certificate issued by a Certificate Authority (CA).

Worldline Sips data flows exchanged via the web are secured by using TLS version 1.2.

The TLS protocol consists of:

• A "negotiation" between the customer and the server ("handshaking"), during which cryptographic algorithms (also referred to as the "cipher suite") are negotiated based on the customer's and server capabilities, with the creation of a session key at the end of this phase.

• a session during which the session key is used to securely exchange data.

The Worldline Sips solution is a bi-site implementation to provide a disaster recovery plan across all layers, systems, and applications.

Each Worldline Sips technical component on each site and the file transfer platform are redundant and configured for load balancing.

If a unit equipment is down, the load distribution is automatically adapted by eliminating the faulty equipment from the flow.

The disaster recovery plan will be activated to deal with extreme faulty situations: fire, water damage, major accident, seismic or weather phenomenon, flood, air conditioning failure, loss of power, loss of telecommunications equipment, hardware failure (DRP), jeopardisation of staff availability, etc.

To ensure the resuming or continuity of critical business, Worldline has implemented a Business Continuity Plan (BCP).

This continuity plan is not limited to the continuity of services/applications, it also takes into account the retreat of users, the health risk (epidemic, pandemic), the coordination steps for crisis management (labour contrainsts, crisis centre, etc.), crisis communication, business-related workaround measures, cross-functional positions (HR, logistics).

Business continuity plan tests are conducted every year and are intended to test that all Worldline Sips service URLs are able to accommodate all flows on a single site in the event of a major incident.

PCI DSS is an international security standard whose objectives are to ensure the confidentiality and integrity of cardholders’ data, thereby securing card and transaction data protection. Merchants and payment providers are required to comply with this standard, to varying degrees depending on the importance of their business.

Worldline is PCI DSS certified and implements, among other things, the following security actions:

• information system security policy
• premises monitored and protected by access control
• secure servers and backed up data
• regularly audited information system
• highly secure hosting centres

Worldline is responsible for the security of cardholers' data, but the company is not responsible for the PCI DSS compliance of its clients.

Please have a discussion about this with your acquiring institution.

In order to comply with PCI DSS, you are asked to fill in a more or less extensive questionnaire depending on the type of payment solution implemented. This questionnaire is to be returned to your acquiring bank once a year (see the 'SAQ' section).

You will need to show your PCI DSS certificate of conformity to your acquiring bank as soon as possible.

This certificate of conformity is declarative and you will be required to complete a Self-Assessment Questionnaire (SAQ) that will allow you to know whether you are compliant or not with the PCI DSS requirements.

So your approach to SAQs is a two-step process:

FIRST STEP: DETERMINE THE LEVEL YOU BELONG TO

Whether you accept a few payments per card per year or millions, you will be classified into one of the following four levels defined by international schemes.

If in doubt, take the number of transactions per card brand, contact your acquiring bank and ask for confirmation of your level. Acquiring banks have the ultimate decision-making power over the levels of their merchants, so you need to check your assumptions with your bank.

STEP TWO: DETERMINE WHAT YOU NEED TO SUBMIT FOR VALIDATION.

Once you have identified the level you belong to, you will be able to determine what you need to provide to your acquiring bank.

If you are Level 2 to 4, you must complete a self-assessment questionnaire that is appropriate for your activity. Self-assessment questionnaires are documents that contain a series of questions that you must answer.

There are three types of SAQ covering the Worldline Sips offer: A, A-EP AND D.

The General Data Protection Regulation (GDPR) is a regulation put in place by the European Union to oversee the collection and processing of personal data in Europe.

Its purposes are to strengthen the rights of individuals, to empower the various stakeholders with respect to data processing and to give credence to the regulations in place. This regulation is a continuation of the CNIL (Commission Nationale de l'Informatique et des Libertés), a French administrative body created in 1978 to ensure respect for privacy during the computer processing of personal data.

On the other hand, the GDPR terminates the previous reporting obligations to the said CNIL, since the latter may now conduct checks at any time.

To ensure and prove its compliance with privacy, Worldline has followed and implemented the 6 CNIL advisory steps:

1. appoint a data protection officer
2. map data processing
3. define corrective actions
4. analyse/manage risks
5. set up internal procedures
6. document compliance