Payment Gateway UberCart

First Atlantic based in Bermuda sent us to Scotiabank who gave us this:

Your browser may not support display of this image. INTERNET MERCHANT ACQUIRING

  Scotiabank has had several years experience in working with different credit card payment programs. We have a team of skilled personnel both locally and in our Head Office in Toronto who manages the various implementations.  

  We have signed a number of large clients locally, for example, the e-payment service currently being used by Jamaica Customs is facilitated by us. Here Importers and Custom Brokers can stay at their offices and pay their custom duties using a credit card denominated in either Jamaican or US Dollars. 

  Our Internet Merchant Acquiring business facility is offered in a very secured environment that is based on international standards.

  Upon receipt of the signed relevant documents and your written confirmation that all requirements for the Web Site have been met, we will require approximately three weeks to complete set up procedures. 



  Pricing 

  The pricing is broken down into two segments as follows:

     1. Scotiabank costs
     2. Gateway provider costs 



  1. Scotiabank Costs

        Discount Rate    -        negotiable

        Set up fee           -  USD$200.00   

  2. Gateway provider costs    (If First Atlantic Commerce is used)

        Set up Fee  - USD$695.00 (one time only fee)

        Monthly Fee       - USD$100.00

        Transaction Fee  - USD$0.50 per transaction.



  Note: A Merchant has the option of using other gateway providers that are currently certified with our credit card processors (Cable & Wireless is currently certified with us).   

Technical Requirements

Below is a summary of the technical requirements as well as a questionnaire for establishing the answers of some pertinent questions for facilitating this payment option:

                                                  Appendix I

WEB SITE REQUIREMENTS
Web Site Requirements:

All Internet web sites used for Internet transactions must prominently display the following:

           1. The company’s trade name,
           2. A complete description of goods or services (including voltage requirements, measurement scale, clothing size protocol, etc.),
           3. Return/Refund policies,
           4. Privacy statement regarding customer information,
           5. All customer service contact information (e.g. e-mail  address, telephone numbers - including country code, toll-free and non-toll-free numbers, facsimile numbers, etc.;
           6. Transaction currencies available, to be selected by the cardholder (e.g. US Dollars),
           7. Export restrictions (if applicable),
           8. Delivery policy including restrictions, and
           9. The country in which the seller is officially registered and located.

Database Management Requirements:

Any database containing card information from the merchant’s sales (whether hosted by an Internet Service Provider or by the merchant) must be protected from unauthorized access via the web or other means, and must be encrypted. As merchants are responsible for their transaction data, they must also ensure that:

           1. The database is in a physically secured (locked) room,
           2. Access is restricted to staff on a business need only basis,
           3. Database access is password protected,
           4. The default database, web server and application passwords and access privileges are changed on a monthly basis,
           5. The default system access privileges must be changed / tightened upon system implementation to ensure that least access is permitted for authorized individuals only,
           6. The default database product encryption key are changed on an annual basis,
           7. The database backups are afforded proper physical safekeeping and access is limited to authorized staff only,
           8. Obsolete database backups are properly erased to ensure that card data cannot be recovered, and
           9. The database used to store card data is not resident on the Web server and is not addressable/accessible directly from the Internet.

Web Server Requirements:

The minimum security requirements for the merchant’s Web Server must include the following:

           1. The Web Server must have a valid Digital Certificate;
           2. The factory pre-set passwords for your Web Server must be changed before you begin processing Internet Transactions and thereafter, must be changed on a monthly basis;
           3. Unused services on the Web Server, including but not limited to various other communication protocols, must be disabled or removed;
           4. A firewall must be installed between the Web Server and the Internet to screen out other communication protocols that are not required for Internet Transactions;
           5. All web transactions must be secured with Secure Socket Layer (SSL) encryption;
           6. The controls as defined above are to be reviewed on a periodic basis to ensure that they are still in effect; and
           7. All Firewall and Web Server access activity must be logged and this activity data stored in an appropriate manner, for ten years from the date the records of all Internet Transactions relevant thereto arose.

ELECTRONIC RECEIPT REQUIREMENTS

An electronic receipt must be provided to the cardholder once authorization is obtained for the cardholder to print, and via e-mail. At a minimum, each receipt must include:

           1. The date that the processing data was obtained for the relevant Internet transaction,
           2. Merchant number used for Internet transactions,
           3. The company’s trade name,
           4. The card type,
           5. The amount of the transaction,
           6. The currency the transaction was processed in,
           7. The authorization number,
           8. The order number,
           9. A detailed description of the goods sold and/or services provided,
          10. The contact name, mailing address, e-mail address, telephone and fax number of the person responsible for Internet Transaction disputes, and
          11. Your URL (Uniform Resource Locator) or on-line address.
          12. Any restrictions for returns or refunds.

Please note that the card number MUST NOT be included on the receipt.

Appendix II
INTERNET MERCHANT QUESTIONNAIRE

Merchant Name:
General Requirements Comments

1. Name of your Internet Service Provider (ISP) and/or name of the company hosting your web site.

2. Types of goods and/or services being offered via the Internet.

3. Average ticket size for Internet sales.

4. Estimated annual Internet sales.

5. Target market for goods/services.

6. Your web site address.

7. Screen prints of your web site’s on-line order form (showing proof of a secure HTML order form), pay page and electronic receipt.

8. A brief description of the hardware/software/firewalls/ access procedures and controls employed in your secure Internet Commerce Setup.

9. Proof of a digital certificate for Internet security.

   1. URL(s) (Uniform Resource Locator) from which the transactions will be submitted and the responses received (if different).

   2. Server must be set to only take SSL transactions.

   3. Your e-mail address.

   4. Copy of privacy statement regarding customer information.

Web Site & E-mail

1. Minimum information requirements for web site (tick all that are met):

   • business trade name

   • a complete description of goods or services

   • return/refund policies
   • customer service contact information, e.g. e-mail address, telephone numbers, facsimile numbers,
   • domicile country and transaction currency
   • export restrictions (if applicable)
   • delivery policy
   • country in which merchant is officially registered and located
   • display an appropriate VISA acceptance mark on you Web site (unless prohibited by trade associations)

2. Sample of return e-mail to customer to confirm transaction, which should include the following information (tick all that are met):

   • processing date,

   • your merchant # for Internet transactions,

   • Company trade name,
   • card type (no card number),
   • amount of the transaction,
   • currency the transaction was processed in,
   • authorization number,
   • order number,
   • detailed description of the goods sold and/or services provided,
   • any restrictions for returns or refunds,
   • the URL, and
   • the following contact information for Internet Transaction dispute:
   • contact name,
   • mailing address,
   • e-mail address,
   • telephone and fax number of contact person

Hardware and Software

1. What hardware platform are you currently running?

   • Apple Macintosh

   • Digital

   • Sun
   • Dell
   • Compaq
   • Hewlett Packard
   • IBM
   • SGI
   • Intel (x86, Pentium)
   • Other – please specify

1. What operating system are you currently running?

   • Macintosh

   • Windows 3.1

   • Windows 95
   • Windows 98
   • Windows NT
   • UNIX: SUN OS 4.1.3
   • UNIX: SPARC Solaris 2.3
   • UNIX: SPARC Solaris 2.4
   • UNIX: SPARC Solaris 2.5
   • UNIX: HP UX
   • UNIX: AIX
   • UNIX: BSD/386
   • UNIX: IRIX
   • UNIX: LINUX
   • UNIX: OSF/1
   • Other – please specify

   ---

2. What type of payment software is currently used for your web site?

   • AT&T SecureBuy

   • ClearCommerce Merchant or Hosting Engine

   • ClearCommerce Store Manager
   • CyberCash Cash Register
   • ICOMS MerchanTRAX
   • ICVerify
   • Microsoft Site Server Commerce Edition with Cash Register
   • Microsoft Site Server Commerce Edition with NetVerify
   • Microsoft Site Server Commerce Edition with PCAuthorize
   • Netscape Merchant System
   • Netscape Publishing Expert
   • NetVerify
   • Open Market TransAct
   • PaymentNet
   • Other (please specify)

   ---

Security Database Requirements
Describe Your Solution

1. The database should be encrypted.

2. The database is in a physically secured (locked) room.

3. Access is restricted to staff on a business need only basis.

4. Database is password protected.

5. The default database, web server and system passwords and access privileges have been changed and will be changed on a regular basis (monthly).

6. The default database product encryption key has been changed, and will be changed on an annual basis.

7. The database backups are afforded proper physical safekeeping and access is limited to authorized staff only.

8. Obsolete database backups are properly erased to ensure that card data cannot be recovered.

9. The database used to store card data is not resident on the web server and is not addressable/accessible directly from the Internet

10. Unused services on the web server (e.g. ftp, telnet) have been disabled or removed.

11. A router or firewall is installed between the web server and the Internet to screen out protocols (e.g. ftp, telnet) that are not required for Internet Commerce.