Whether you’re processing a payment online or through a payment terminal that’s connected to the internet, it’s essential to keep your customer’s payment data properly secured—if not, hackers can intercept it while it’s being transmitted. Read more below about how to keep your business and your customer’s data safe using validated Point-to-Point (P2PE) encryption and tokenization.

What is Point-to-Point Encryption?

P2PE encryption is the Payment Card Industry’s (PCI) solution for safely encrypting card data, ensuring that it remains secure during every step of the payment process and cannot be intercepted by hackers. When a customer swipes or dips a payment card, sensitive cardholder information is transmitted to the issuing bank for verification. P2PE uses a combination of complex algorithms, hardware, software applications, and secure devices to encrypt the customer’s payment card data as it moves from the point of interaction (such as a POS terminal) through the merchant’s system to protect it from theft during the transaction process.

What is Tokenization?

Tokenization is a process that uses unique, randomly-generated tokens to replace a customer’s payment card data. The actual data is stored either in-house in a “token vault” or at a secure off-site environment such as a PCI-certified vendor. When processing a transaction, the merchant sends the token representing the data to the secure environment to retrieve the customer’s data, then forwards it to the issuer for authorization.
Because the customer’s data never moves through the merchant’s system, it remains safe from hackers. And even if a criminal were to steal tokens, they are worthless because they contain no customer data.

What are the Benefits of a PCI-Validated P2PE Solution?

Payment Card Industry Data Security Standard (PCI DSS) compliance is necessary for all businesses that process, store, or transmit cardholder data. If a business is not compliant, not only will the business be at risk for a data breach, but it can also face financial penalties and/or experience issues with obtaining a merchant account. Merchants who use P2PE technology not only benefit from advanced customer fraud protection, they also experience an easier PCI compliance experience.

PCI DSS compliance requires businesses that handle sensitive customer data to follow certain regulatory requirements. You start the process by completing the PCI Self Assessment Questionnaire (SAQ) relevant for your business; if you have a P2PE solution in place for your business, you can use the SAQ P2PE form which has fewer questions and does not require a vulnerability scan or penetration test!

The Cardknox Solution: P2PE Plus Tokenization

The Cardknox solution gives you combined fraud protection using both PCI-validated point-to-point encryption and true tokenization.

We offer P2PE support for a variety of payment terminals, including Ingenico. In addition to P2PE support, Cardknox’s advanced tokenization technology assigns a unique identifier for each transaction so that actual payment data cannot be accessed. Every time a transaction is received, all payment card and personal data are stored in our token vault, and a token is sent to your system. That token can be used to invoke future transactions without having to send payment card details each time. Businesses that integrate with Cardknox will benefit from instant Level I PCI DSS compliance since data is fully out of scope.