Reference Transaction / Quick Charge Form

[franklin]

Hi C&P
Can you please clarify how the Quick Charge Form works? I read that it references the original transaction with the bank instead of storing card numbers. So does it modify the original transaction?

A couple orgs have expressed security concerns and would definitely like to disable. Is this possible?

Thanks
Franklin

[CnP.Support]

Franklin,

There is absolutely no security concern with this method. Click & Pledge is PCI Level 1 certified and every feature is reviewed and approved by auditors and if there was any concern for security we would not be able to offer it.

All credit card information is stored by the gateway as part of the process. Gateways have to store the encrypted data since chargebacks and refunds need to be processed. In the absence of having the credit card information no refunds could be made.

Click & Pledge does not store credit card numbers and we do not store the card verification numbers. These 2 numbers are not anywhere in our system. We don't even store them in memory while processing and that is why the credit card information is always the last step of the process.

With every transaction we store a reference to the transaction which we refer to as Vault GUID (Global Unique Identifier). The Vault GUID is unique for the credit card, client, and Click & Pledge. Even if the Vault GUID is stolen it will be totally useless since it references a credit card for the single client with whom the card was charged and through Click & Pledge. So a Vault GUID may only be processed by Click & Pledge for the client for that card. A VAULT GUILD cannot be used for any other client or purpose.

We use the Vault GUID for recurring transactions and we are simply giving the organization the same capability to process a card once authorized by the card holder.

We have plans for the next release to offer On/Off feature of this capability on a per user basis.

Please let me know if you wish to have additional information about this. I am not sure what else we can explain about this.

[franklin]

Thanks for the thorough response C&P. You guys do a great job with security & compliance. I think my clients that have expressed concern are more worried about internal staff having that capability.

To relay some client concerns - "I could sit here and just start charging...it's one thing to store info for recurring payments that are documented, another thing to basically have your donors set up as ATM machines."

Ha, it's a bit of a dramatic comment but I can see where they are coming from. Thanks for making this On/Off in the next version and being adaptable.

[CnP.Support]

Franklin,

Your request makes sense and it was also brought up in the last Click & Pledge Partner meeting.

We will make sure provisions are added in release 8.0