Background
In this article, you will be guided through the correct answers for the Clover PCI Compliance survey. You may wonder why this step is even necessary.
In fact, Worldline is making an effort to be able to bypass this step for merchants whose only means of processing payments is via their software partners. Unfortunately, they have not been able to get approval at this time.
However, assuming SquadFusion is the sole mechanism you use to collect payments with your Worldline account, they have worked with us to provide the following answers.
Note: if you collect payments using your Worldline account outside of SquadFusion's software, you should instead refer to the help documents on the Worldline site for guidance. The answers below apply only to SquadFusion software.
Format
There are two major sections below. They contain the same information, but the first section is more abbreviated.
First, we'll provide a text-only set of answers, with the page title from the Clover survey along with the expected response.
In the possibility your page does not have the same page title as the abbreviated guide, the next section will show screenshots. The actual survey shows different questions based upon replies from prior questions.
Abbreviated Version
Q: How do you accept payment cards?
A: e-Commerce store
Notes: Check only this option.
Q: How do you accept e-Commerce customer card payments?
A: I have an e-Commerce store
Notes: Check only this option.
Q: Do you use a third party company to host your website?
A: Yes
Q: Please provide the name of your web hosting company.
A: SquadFusion
Notes: You will first have to start typing in the word SquadFusion.
When you get a message about no results found, click on the "add your own" link.
Then click just below that paragraph, into the empty area, and type "SquadFusion".
You may need to press Enter. When you see a tag which says "Other: SquadFusion" you can press Next.
Even though the instructions say to press "Add" there is no "Add" button.
Q: Are your online customers also redirected from your company's website to a payment gateway/processor hosted payment webpage/iFrame to process card payments?
A: Yes
Q: Do you provide your customers with the ability to enter payment card data directly into your website(s) for processing?
A: No
Q: My company's eCommerce store was:
A: Built by an external third party or agency
Q: Please provide the name of your web development company
A: SquadFusion
Q: Please select all of your Payment Service Provider(s) below
A: There are two items to select: First Data Integrated Payment Systems, Beanstream Internet Commerce Corp
Notes: You can use their text box to filter results
Q: Can you verify or provide proof that your Payment Service Provider is PCI Compliant for the services they provide you?
A: Yes
Q: Have you verified with your Payment Service Provider (PSP) that they do not pass card data back to your payment application or website?
A: Yes
Q: Please select your shopping card provider(s) from the selection below
A: SquadFusion
Notes: This is the same process as you used for adding SquadFusion as the web hosting company.
Q: Does anyone in your organization send or receive full card numbers via email or instant messaging?
A: No
Q: Does your company otherwise store, transmit, or receive cardholder data electronically in any other way and for any other purpose? This could be via CD-ROM, USB drive or an internet network.
A: No
Notes: The answer to the first question is outside the scope of the software. If you have your members email or otherwise transmit their full credit card information outside of the software, we recommend against doing so.
Q: To handle payment cards you are required by the Payment Card Industry Data Security Standard (PCI DSS) to have an Information Security Policy in place for your organization. This must cover all relevant areas to the standard.
A: I already have an Information Security Policy in place that covers ALL of the relevant clauses of the Payment Card Industry Data Security Standard (PCI DSS)
Notes: This is covered in SquadFusion's terms of service and privacy policies. No financial information is stored within SquadFusion, unless you add custom fields for some reason (which we strongly recommend you do not do).
Q: Security measures for your business
A: Click the radio button for "Click here to download your free security guide.
Q: A summary of how and where you handle card payments
A: For all three answers: "Third party software is collecting and processing payments for my business."
Notes: You can use a different term than "business" for your organization if you would like ("non-profit organization," "league," etc.)
If the next page says you are compliant...
You are complete with this task!
If the next page indicates you are not compliant...
- Press the "Begin step" button
- You need to be able to answer Yes to each of the questions.
- Some of the questions in this part of the document are process-oriented. In other words, it goes beyond the SquadFusion software. For instance, there is a question about passwords. While you don't have access to back end or operating system passwords, you do set passwords for administrative account access.
- So, please read each question and reach out to us if you have any issue replying "Yes" to a question not able to be enforced by the software. For any items which do relate to the software, SquadFusion has implemented all necessary compensating controls.
Compliance Confirmation
Most fields will already be filled in. You may need to supply the organizational title of the Merchant Executive Officer.
Full Version
Same questions and answers as above, but with screenshots below for each item.
Q: How do you accept payment cards?
A: e-Commerce store
Notes: Check only this option.
Q: How do you accept e-Commerce customer card payments?
A: I have an e-Commerce store
Notes: Check only this option.
Q: Do you use a third party company to host your website?
A: Yes
Q: Please provide the name of your web hosting company.
A: SquadFusion
Notes: You will first have to start typing in the word SquadFusion.
When you get a message about no results found, click on the "add your own" link.
Then click just below that paragraph, into the empty area, and type "SquadFusion".
You may need to press Enter. When you see a tag which says "Other: SquadFusion" you can press Next.
Even though the instructions say to press "Add" there is no "Add" button.
Q: Are your online customers also redirected from your company's website to a payment gateway/processor hosted payment webpage/iFrame to process card payments?
A: Yes
Q: Do you provide your customers with the ability to enter payment card data directly into your website(s) for processing?
A: No
Q: My company's eCommerce store was:
A: Built by an external third party or agency
Q: Please provide the name of your web development company
A: SquadFusion
Q: Please select all of your Payment Service Provider(s) below
A: There are two items to select: First Data Integrated Payment Systems, Beanstream Internet Commerce Corp
Notes: You can use their text box to filter results
Q: Can you verify or provide proof that your Payment Service Provider is PCI Compliant for the services they provide you?
A: Yes
Q: Have you verified with your Payment Service Provider (PSP) that they do not pass card data back to your payment application or website?
A: Yes
Q: Please select your shopping card provider(s) from the selection below
A: SquadFusion
Notes: This is the same process as you used for adding SquadFusion as the web hosting company.
Q: Does anyone in your organization send or receive full card numbers via email or instant messaging?
A: No
Q: Does your company otherwise store, transmit, or receive cardholder data electronically in any other way and for any other purpose? This could be via CD-ROM, USB drive or an internet network.
A: No
Notes: The answer to the first question is outside the scope of the software. If you have your members email or otherwise transmit their full credit card information outside of the software, we recommend against doing so.
Q: To handle payment cards you are required by the Payment Card Industry Data Security Standard (PCI DSS) to have an Information Security Policy in place for your organization. This must cover all relevant areas to the standard.
A: I already have an Information Security Policy in place that covers ALL of the relevant clauses of the Payment Card Industry Data Security Standard (PCI DSS)
Notes: This is covered in SquadFusion's terms of service and privacy policies. No financial information is stored within SquadFusion, unless you add custom fields for some reason (which we strongly recommend you do not do).
Q: Security measures for your business
A: Click the radio button for "Click here to download your free security guide.
Q: A summary of how and where you handle card payments
A: For all three answers: "Third party software is collecting and processing payments for my business."
Notes: You can use a different term than "business" for your organization if you would like ("non-profit organization," "league," etc.)
If the next page says you are compliant...
You are complete with this task!
You should see a Compliance badge.
If the next page indicates you are not compliant...
- Press the "Begin step" button
- You need to be able to answer Yes to each of the questions.
- Some of the questions in this part of the document are process-oriented. In other words, it goes beyond the SquadFusion software. For instance, there is a question about passwords. While you don't have access to back end or operating system passwords, you do set passwords for administrative account access.
- So, please read each question and reach out to us if you have any issue replying "Yes" to a question not able to be enforced by the software. For any items which do relate to the software, SquadFusion has implemented all necessary compensating controls.
Compliance Confirmation
Most fields will already be filled in. You may need to supply the organizational title of the Merchant Executive Officer.
