What is point-to-point encryption (P2PE)?
Anyone whos responsible for PCI DSS compliance at their business may be interested in point-to-point encryption (P2PE), an encryption method that offers the best protection for your customers payment information. Get the lowdown on point-to-point encryption solutions, from P2PE compliance to the difference between point-to-point and end-to-end encryption. Put simply, point-to-point encryption is an encryption standard established by the Payment Card Industry Security Standards Council. It stipulates that cardholder information is encrypted immediately after the card is used with the merchants point-of-sale terminal and isnt decrypted until it has been processed by the payment processor. This standard is met by point-to-point encryption solutions  comprehensive services delivered by specialist providers comprising of all the software and devices that are needed to meet the requirements of P2PE compliance. Its worth noting that not all P2PE solutions receive validation from the PCI. For a point-to-point solution to receive validation  confirming that it meets the rigorous controls defined in the PCI P2PE Standard  it must undergo an assessment and audit from a P2PE Qualified Security Assessor (QSA). After that, it will be brought to the PCI Council for approval. Essentially, P2PE encrypts card information as soon as its taken from the payment processor, using an algorithm that turns the information into an unreadable code. This code is then transferred to the payment processor, where its decrypted using a secure key. As the decryption takes place electronically, the merchant doesnt ever come into contact with their customers financial information, rendering it more or less invisible. Although point-to-point encryption solutions and end-to-end encryption (E2EE) are similar, there is a key difference. Namely, that E2EE solutions dont meet the standards of the PCI Council, mostly because there are other systems between the POI and processing point, increasing the chances of a hack or breach. In contrast, P2PE solutions transfer data directly, with no other systems in between. Its also worth remembering that P2PE is assessable, whereas there arent any standards associated with encryption solutions that are branded as end-to-end. Point-to-point encryption solutions and PCI DSS compliance  Assuming youre using a point-to-point encryption solution that meets PCI P2PE requirements, youll be out of scope of PCI DSS compliance. Put simply, compliance will be the P2PE providers responsibility, and in the unlikely event of a data breach, the provider will be held accountable, not you. That means that you wont need to worry about any of the potential penalties associated with PCI DSS, such as fines, suspension of your ability to receive credit card payments, and credit card replacement costs. Final word  By ensuring that your business never touches card data, point-to-point encryption (P2PE) helps you to avoid the fallout from data breaches, whether thats damage to your reputation or financial penalties. Bottom line: if you keep your customers data safe, youll keep your business safe too. We can help  GoCardless helps you automate payment collection, cutting down on the amount of admin your team needs to deal with when chasing invoices. Find out how GoCardless can help you with ad hoc payments or recurring payments.