4
Important Security Notice
2.3
Third Party Applications
The end-to-end transaction process, beginning with entry into the third party application until the response from the
payment engine is returned, must meet the same level of compliance. In order to claim the third party application is
end-to-end compliant, the application would need to be submitted to a QSA for a full PA-DSS audit.
The end user and/or P.O.S. developer can integrate and be compliant in the processing portion of a payment
transaction. A brief review (given below) of the PA-DSS environmental variables that impact the end user merchant
can help the end user merchant obtain and/or maintain PA-DSS compliance. Environmental variables that could
prevent passing an audit include without limitation issues involving a secure network connection(s), end user setup
location security, users, logging and assigned rights. Remove all testing configurations, samples, and data prior to
going into production on your application.
2.4
PA-DSS Guidelines
The following PA-DSS Guidelines are being provided by IDTech as a convenience to its customers. Customers
should not rely on these PA-DSS Guidelines, but should instead always refer to the most recent PCI DSS Program
Guide published by PCI SSC.
1. Sensitive Data Storage Guidelines
Do not retain full magnetic stripe, card validation code or value (CAV2, CID, CVC2, CVV2), or PIN block data.
1.1 Do not store sensitive authentication data after authorization (even if encrypted): Sensitive authentication
data includes the data as cited in the following Requirements 1.1.1 through 1.1.3. PCI Data Security Standard
Requirement 3.2
Note: By prohibiting storage of sensitive authentication data after authorization, the assumption is that the transac-
tion has completed the authorization process and the customer has received the final transaction approval. After
authorization has completed, this sensitive authentication data cannot be stored.
1.1.1 After authorization, do not store the full contents of any track from the magnetic stripe (located on the back
#80136501-001 IDTech Windows SDK Guide for Kiosk III/IV