PCI Tokenization Migration Info Page

A big change is coming to Payments that takes effect on October 28, 2022.

If you store customer payment info or 'cards on file', this announcement pertains to you. We've been working towards a technology called Tokenization for years, and have successfully deployed it in the majority of our customer base, but there's a deadline fast approaching and we want to make sure that you are prepared for the changes to come well before that date.

Windward has put together this page to answer questions that you may have ahead this date.

What is changing?

The payment industry has evolved and the way that Windward Software interacts and stores credit cards has changed. Over the last couple of years, we have moved to a "tokenization" model for card processing, where the actual card number never touches the software. All of our integrated cloud customers already have the option to utilize tokenization, but there is a large group of customers on the legacy tech stack who will need to migrate over. The PCI Security Standards Council is now retiring the old method of integration.

Who is impacted?

Any customer who has integrated payment processing with Windward and does "card not present" or "card on file" transactions in the legacy method.

The PCI Security Standards Council is retiring the PCI PA-DSS program that Windward System Five is certified under and replacing it with the Secure Software Life-Cycle (PCI SSLC) program.

Since tokenization solutions are available for most processors, Windward Software has determined that the most secure and cost-effective method for our customers is to proceed with the tokenization option which makes participating in the PCI SSLC program not required.

You will remain PCI compliant since Datacap Systems NETePay Hosted (the middleware used to provide Windward's Tokenization) is PCI SSC's Secure SLC-Qualified Software.

How do I know if I'm storing credit card info?

If you're unsure, you can check your settings in Windward to validate if this tool is being used.

Here's how:

Navigate to Payment Processing in the Setup Wizard

If Allow collecting of credit card information for Later authorization IS enabled and Use Tokenization IS NOT enabled.

Also if you have enabled Allow Card not present transactions on screen (this option will also not be available with the PCI out-of-scope version of 6.4.)

NOTE: There may be other options available depending on your processor.

How to check if you are storing credit card info.

When is this occurring?

The traditional method of storing "card on file" and entering "card not present" transactions will be retired at the end of October. For businesses that rely on these payment methods, you should migrate to the new tech stack by October 28, 2022. In upgrading your payment processing tech, new pin pads are likely required if you are using legacy devices. When coordinating with 3rd party companies and sourcing hardware, these projects can take time, so it is best to get started now.

What do I do next?

Check whether you're impacted by using the PCI Compliance Bot. You can find it in the lower right corner of your screen↘️.

If you are affected by this change, fill out the form to get started on the Tokenization Migration to NETePay Hosted.

You can also reach out to your Account Manager to help you sort through the details on how to proceed.

Please do not wait, as there are others affected and we're going to prioritize projects on a first-come-first-served basis.

NOTE: Future System Five updates will protect you from non-compliance by disabling the legacy method.

Again, if your business model relies on recurring charges or the ability to charge a customer without the card present, you should migrate to our Tokenization solution well before that date.