Solutios Home

Solutios Security Policy

Last Updated March 15th, 2023

Definitions

Electronic commerce: Electronic financial services delivered via electronic means including, but not limited to, the Internet or other electronic delivery vehicles.

Specific examples of e-commerce activities include:

  • Internet/world wide web services
  • Email inquiries and responses
  • Publishing of general information on Solutios’ web site
  • Data entry or verification by staff on a merchant’s data processing system
  • File transfers of merchant or customer information for invoicing, payment request or statement generation
  • Web account access
  • Viewing share or payment transaction history and balances
  • Transferring funds between merchants and customers, transfers to other financials, or Person to Business Transfers (PTB)
  • Requesting a check withdrawal from a share or loan
  • Applying for Solutios services through applications or forms
  • E-mail statements
  • Electronic retrieval of check copies
  • E-alerts
  • Online bill paying services
  • Audio response/phone based
  • Wireless services
  • Mobile or neo-banking

Encryption: Is the conversion of data into a form, called a cipher text, which cannot be easily understood by unauthorized people.

Authentication: Is the process of determining whether someone or something is, in fact, who or what it is declared to be. Depending on the transactions, a more stringent authentication process may be required.

Firewall: Any hardware and/or software designed to examine network traffic using policy statements (ruleset) to block unauthorized access while permitting authorized communications to or from a network or electronic equipment.

Overview

Solutios recognizes the importance of electronic commerce (e-commerce) activities to its merchants, their customers for present day operations. Solutios is committed to using e-commerce activities in a cost effective manner that promotes accuracy, safety, security, and efficiency. These activities bring automation and efficiencies to traditional manual tasks and allow quicker access to information resulting in improved merchant services.

Purpose

This e-commerce policy is to be used as both a guideline and an overview in the management of Solutio’s electronic services.

Policy Detail

Solutios is committed to enhancing merchant and customer services through the use of many forms of e-commerce activities. Electronic commerce activities include Solutio’s web site, email, telephone access system, ACH transactions, ePayment system, online bill payment, and banking as a service.

They also include business-to-business transactions where interaction is conducted electronically between Solutios and its business partners utilizing the Internet as the communications infrastructure.

It is the practice of Solutios to safeguard merchant and their customer data at all times, including the processing of e-commerce transactions. Information must be protected at both the sending and receiving ends of each transaction.

To accomplish this, there are several levels of protection applied to e-commerce activities.

Encryption – Encrypting transactions provides security by ensuring that no portion of a transaction is readable except by the parties at each end of the transmission. This ensures that data can be transmitted securely without concern that another party could intercept all or part of the transaction. Encryption also makes certain that the transaction is not tampered with as it routes from point-to-point and data is received exactly as it was sent. Solutios will use a minimum of 128-bit encryption. This also applies to vendors that host Solutios merchant data or iFields/iFrames.

Authentication – After a secure connection is established, the initiating party must prove his/her identity prior to conducting the transaction. This is typically handled with user IDs or account numbers, along with password or PIN combinations. Additionally, encryption certificates are also employed to validate the authenticity of both servers and users. System administrators control system access by assigning users different levels of access for applications and data. These access levels are determined by senior management and are specific to each job function. This ensures that access to applications and specific types of transactions are only granted as job functions require.

Multi-factor Authentication (MFA) – For online credit card or eCheck transactions, MFA offers more than one form of authentication to verify the legitimacy of a customer’s payment method and transaction. The layered defense makes it more difficult for an unauthorized person to gain access. Solutios will send a link to the customer provide mobile device requesting a six-digit one-time passcode referred to as an OTP.

Firewalls – Solutios will deploy and utilize firewalls as necessary to protect internal systems from threats originating from the Internet, as well as those that might be present when connecting to merchants’ networks or websites. Firewall operating systems and configurations will be reviewed periodically to ensure maximum protection. An audit log will be maintained tracking all attempts to access un-configured (blocked) services. Firewalls and other access devices will be used, as needed, to limit access to sites or services that are deemed inappropriate or non-corporate in nature as specified from time-to-time by the card brands. Vendor hosted solution firewalls will be reviewed prior to implementation.

Network Traffic Rules and Restrictions – Intra-network traffic is subject to distinct operating rules and restrictions. Through the use of firewall technology, outside parties are directed only to approved, internal resources. An example of this is web page services that allow certain types of traffic from the Internet (web page browsing) but have other types of traffic blocked (i.e., administrative tasks). This strategy dramatically reduces the risk of any party gaining unauthorized access to a protected server. The internal network is also protected from virus attacks through the use of network-level anti-virus software that is updated automatically on a regular basis. These regular updates are loaded automatically to each PC, as they are available. This provides the most up to date virus protection and security available. E-mail is also scanned prior to delivery, reducing the potential of a virus entering the network in this manner.

Physical Site Security – The entire IT Department is protected by a card access entry system allowing only authorized personnel into the Department. Sensitive data, hardware, and software are secured in the Solutios data center, which is secured with a card access entry point and is monitored 24/7 by IT staff and third-party network security sources. Access to the data center is further limited to a small number of authorized personnel. It is Solutio’s practice to change administrative passwords and immediately remove card access privileges after any change in administrative, executive or IT staff. In addition to on-site storage of data, Solutios stores overnight backups of critical systems data and replicated Storage Area Network (SAN) storage to a secure, off-site location. This ensures that data is available in the event of a disaster or other critical situation.

Staff Training and Review – IT and senior staff receives training and reviews all procedures at least annually or as major system additions or changes are implemented. This training includes PCI compliance DSS requirements.

User Password Maintenance – Staff passwords, on the host data processing system, expire after 45 or 90 days, forcing users to modify their passwords. This control, along with a strict Solutios policy prohibiting users from sharing or disclosing their passwords, is intended to prohibit unauthorized access to systems and data. After receiving a change in status from the Human Resources Department or other management team members, IT staff immediately removes user access codes from appropriate systems.

Expert Assistance – Solutios recognizes that e-commerce security issues change daily. New threats to security, safety, and accuracy appear daily and government and banking or FinTech service providers publish new regulations and policies on a continuous basis. Solutios is committed to maintaining currency and accuracy in this regard including validation by certification testing authorities. The results of such certification will be available upon request and at the place of business on a requested basis.