Validated vs Non-Validated Point-to-Point Encryption

What You Need To Know

PCI-Validated vs Non-Validated Point-to-Point Encryption: What You Need To Know

Point-to-point encryption, or P2PE, is a security standard created by the Payment Card Industry (PCI) to ensure payment card data remains secure from the beginning to the end of the transaction process. Many providers offer data encryption solutions, but not all solutions are created equal! Keep reading to learn the difference between validated versus non-validated P2PE solutions, and what that difference means for your business.

What is a PCI-Validated P2PE Solution?

In 2004, the Payment Card Industry Security Standards Council (PCI SSC) released its first version of a set of security controls. Merchants who accept credit and debit cards must follow these controls to protect against security threats to their customers’ payment card information. These controls apply to all businesses that process, transmit, or store cardholder data, and they address the requirements that merchants must implement to protect cardholder data and comply with the PCI Data Security Standard (PCI DSS).

In addition to technical, operational, and physical controls, the PCI DSS also requires merchants to implement data encryption procedures to protect cardholder data throughout the transaction process. To address the need for guidance about how merchants should implement encryption solutions, the PCI DSS created the first point-to-point encryption standard, known as P2PE, in 2012. In 2015, they updated the standard and created a specific set of criteria that an encryption solution provider or business must meet to be considered PCI validated.

What is a Non-Validated P2PE Solution?

Non-validated encryption solutions provide some protection, such as the ability to encrypt payment card data captured at the point of interaction (POI), and then decrypting the card data outside of the merchant’s network. These are known as end-to-end encryption (E2EE) solutions. Since these solutions don’t meet the full PCI SSC security criteria, businesses using these solutions may need to purchase additional products or services to ensure they can protect sensitive cardholder data from the threat of hackers or malware.

Now That You Know the Difference, Why Should You Care?

Protecting your customers’ payment card data from security threats is one of the most important aspects of your business, and implementing a PCI-validated P2PE solution is the best way to do that. Although non-validated E2EE solutions exist, you don’t really know to what extent the solution provider has ensured that their product will adequately protect against security breaches and other vulnerabilities within your network. Why take the chance on an incomplete solution?

Cardknox was one of the first payment gateways in the market to offer support for a wide variety of PCI-validated encryption solutions. Here are some of the benefits of using a PCI-validated P2PE solution for your business.

  • Reduced PCI Scope
    Businesses that use a P2PE solution are eligible to fill out the PCI Self Assessment Questionnaire (SAQ) version P2PE, which is much shorter than other SAQ forms. In fact, SAQ P2PE has 90% fewer questions than SAQ D (33 questions as opposed to 329)!
  • Enhanced Security
    Data encryption within a PCI-approved POI device prevents clear-text payment card information from being available within the device itself, or within your business’s system or network, so it remains safe from hackers as the data moves through the transaction process.
  • Save Time and Money
    Since properly encrypted cardholder data cannot be accessed, there are fewer systems and networks considered to be within PCI DSS scope, resulting in fewer costly PCI audits and penetration tests.

The Cardknox PCI-Validated P2PE Solution

The Cardknox solution provides you with robust PCI-validated point-to-point encryption, as well as P2PE support for a variety of payment terminals, including Ingenico. And best of all, businesses that integrate with Cardknox will benefit from instant Level I PCI DSS compliance!
Cardknox is A+ rated with the BBB and is available on-demand to ensure your experience is always as smooth as possible. Benefit from specialized teams offering customer service and integration guidance to support your every need.


Contact us to find out more about how using our PCI-Validated P2PE solution can keep your business and your customers’ data truly safe and secure.

Learn More About Our Secured Features

© Copyright . Cardknox Development, Inc.

Click for the BBB Business Review of this TBD in Lakewood NJ