Payment Card Industry Compliance
The Payment Card Industry Data Security Standard (PCI DSS
Thredd has relationships with existing card manufacturers, who we can instruct to print your cards. We use Secure FTP (sFTP) to send the card manufacturer a generated bulk XML file containing card details. This is sent on a daily basis, or at a frequency that can be customised for your service. The card manufacturer prints the cards and sends to the cardholder. Any white label test cards are typically sent to Thredd , the Program Manager and the Card Schemes. For Thredd card interface specifications to be used by manufacturers.) is an information security standard for organisations that handle credit cards from the major card schemes. All Program Managers who handle customer card data must be compliant with this standard. See: https://www.pcisecuritystandards.org/pci_security/
Retrieval of the full PAN Also known as CVV2 or CVC2. This is a 3-digit number which is located on the card’s magnetic stripe tracks 1 and 2. It is used to help prevent fake magnetic stripe transactions, but is vulnerable to copying if someone can see the original magnetic stripe data. from the Thredd platform is available only to organisations that are PCI DSS Level 1 compliant. Where this capability is not available, Thredd provides the following alternative to support your implementation:
Thredd clients are responsible for ensuring that their implementation complies with all applicable security and regulatory requirements, including PCI DSS where applicable.
Using the Thredd Public Token
Customers who are not PCI DSS compliant must use the Thredd-created Public token, which is unique per card, and which is used to query and manage all transactions on that card. The public token is generated when you submit a Create Card request using the Thredd web services or Cards API, and is returned in the response to your request.