MasterPass Authorized Vendor. Introducing Pecunda The MasterPass Modular Wallet

Transcription

1 MasterPass Authorized Vendor Introducing Pecunda The MasterPass Modular Wallet

2 Context With the introduction of the MasterPass wallet, MasterCard offers merchants and consumers a new, quick and secure checkout process. MasterPass simplifies the way we shop, whether at home, in a store or on the go. It is the perfect combination of security and convenience. Wallet MasterPass API Consumers can safely store their payment and shipping information in their wallet, and so spend less time checking out and more time for the customer journey. By choosing to issue your own Partner-hosted MasterPass Wallet, your branded digital wallet joins the MasterPass Acceptance Network of wallets. This gives your customers the benefit of a safe, convenient, and smart way to checkout wherever MasterPass is accepted. The innovative MasterPass API gives your digital wallet the flexibility to grow as your needs grow. Support Building a wallet requires setting up development and test environments, implementing secure coding practices and procedures, and integrating with the MasterPass API and sandbox environment. Compliance with the MasterPass standard involves implementing two-factor authentication, following branding and UI guidelines, and going through a MasterCard acceptance test. And, wherever card information is stored, a PCI compliant infrastructure should be in place, with the proper implementation of cryptographic services, secure infrastructure and auditable maintenance processes. But ultimately it s all about developing your own customer journey and value added services inside your MasterPass wallet to offer the market the real benefits of your new wallet. 2

3 Card storage Offer To kickstart your development of a MasterPass wallet, Chess ix offers a modular platform Pecunda - that implements all MasterPass functionalities and API s, and complies with all requirements regarding security and branding. Available modules are shown in the architecture drawing below. It can be used as-is, or integrated with your own platform and application using several integration points, such as single sign-on and bulk provisioning. UI Tier White-labelled Lightbox UI Add/edit/delete manual card External Services Prefs Partner/issuer Frontend Tier REST API Add/edit/delete addresses Address store API Partner login Partner login Checkout Add/edit/delete loyalty card Loyalty card store* Modular wallet Local login Merchant pairing User preferences User store External services Backend Tier SOAP API Direct provisioning Direct provisioning API Card validation Card store Not card data environment Bulk upload Bulk upload API MasterPass API Crypto key store Card data environment MasterPass backend Card authorization 3

4 Frontend 4 Scenario s The modular wallet platform consists of components that can be combined in several ways, offering maximum flexibility and integration options. The heart of the platform is our secure module that deals with storing and transmitting sensitive card data. Other components do not deal directly with card data, and are thus outside the scope of PCI DSS audits. This means they can be developed and maintained independently of the PCI DSS audit activities, without sacrificing security. As an authorized vendor, we combine the strength of the MasterPass platform and roadmap without our state-of-the-art software development capabilities and PCI DSS-compliant processes and infrastructure. We offer turn-key hosting and operational support for you wallet. As your partner, we ensure your wallet remains up-to-date with the latest MasterPass developments, and will keep you up to date of the latest possibilities the platform provides. Scenario s Pecunda can be used in different scenario s, depending on your requirements. Implementation scenario 1 - Stand alone Hosted solution No integration required into existing payment systems Quick time-to-market For Issuers & Organisations that issue credit cards and also want to add extra functionalities to the wallet (loyalty, shipping options) Implementation scenario 2 Backend integration Integrated into backend systems of Issuers to support MasterPass functionality Pecunda integrates with your own wallet implementation For Banks and Financial Institutes that want to use/develop an own front-end system As Product Manager, I want the best consumer proposition and so I want to integrate our value added services into our new Wallet. It is comforting to know that Chess ix as ICT partner is both a MasterPass expert, but also capable of developing the custom integration I need. 4

5 4 Scenario s Implementation scenario 3 Frontend integration Integrated with the Issuer s system in the browser of the user Pecunda will be integrated into Issuer s frontend systems to support MasterPass For Banks and Financial Institutes that want to use a standard frontend API for their frontend systems instead of own development Implementation scenario 4 Loosely coupled Pecunda wallet is operated as a stand-alone wallet Supported by user authentication at the Issuer s site Ideal for Organisations that want to provide a wallet without the hassle of system integration, using the existing user authentication The high-level architecture of the different addendum. scenario s can be found in the Pricing is simple, transparent, and competitive the modular wallet will benefit any business case. We take care of the technology, so you can concentrate fully on your business. Standard approach We offer you a solid approach to create the best wallet implementation for your needs. Starting in a short but intense workshop, we cover every aspect of creating your own wallet. As Product Owner I need re-assurance that when implementing one of the scenario s, I can rely on the expertise of Chess ix. All 4 scenario s are fit for use fit for purpose fit for change. 5

6 1. Define Quick scan Specifications Modular wallet Plan & Costs Operations 2. Configure& Test Basis modular wallet setup Extension & Adaptions Secure Sandbox Automated testing Performance & PCI From functional used cases and look-and-feel, to non-functional requirements around performance and security. Our 360 degree scan will deliver a solid implementation plan. This can range from a standard implementation of the available components, or an extended implementation including custom development and integration activities. Definition During a short but intense definition phase, we define the goals and requirements of your wallet solution, and map these to our modular platform s capabilities. Standard process to realize your wallet Testing 24 / 7 Made to measure We tailor the modular wallet platform to your needs and requirements. If necessary, we use our quality-driven software development center to create custom integrations and capabilities for your wallet. With a strong focus on test-driven development and agile processes, any custom adaption will integrate smoothly with the standard components of the platform. Test Throughout the whole delivery process we automatically test both the functionality and the integration of your wallet. Several times a day, the whole suite of automated tests is run against the wallet, ensuring that each and every build is of provable quality, and can safely be deployed to acceptance environments without the need for costly and time-consuming manual tests. 6

7 Maintenance & Support Chess ix can offer full support on the modular wallet, including an ITIL service desk, configuration management and change management. Hosting Optionally Chess ix can host your wallet implementation in a PCI DSS-compliant environment. Indication of timelines The definition phase takes from two to four weeks, depending on the extent of your custom demands and availability of key resources on both sides. In-App Timeline Costs Based on our experience the time-to-market of the system delivery can be relatively short. A standard implementation typically takes about three months, while extended implementation and custom integration typically take longer depending on scope and complexity. Indication of Costs Pricing of the modular wallet is based on a combination of one-time fee and variable fees per year. The one time fees consist of a one-time license fee and the (fixed) cost of the definition phase. There are fixed setup fees for maintenance & support and hosting. The yearly fees consist of a fixed yearly fee plus a fee per active wallet. These yearly fees covers all costs in operations including maintenance & support and PCI compliant hosting. Extra development and services are offered separately. On-line In-Aisle 7

8 Addendum 4 Scenario s Front image

9 Implementation scenario 1 Stand alone In this Stand alone scenario, Pecunda is offered as a complete, hosted solution which can run without any integration with issuer applications. We see this scenario as a starting point/pilot environment for issuers who wants to launch a new wallet quickly. And serves also as a first step in an roadmap to other scenario s aimed at integration. Issuers offering a Wallet with Pecunda to their customers as an additional service. They don t want to integrate payment systems into their own infrastructure. They do want to expand the use of their loyalty cards. Browser Issuer Identity provider Consumer API Frontend PECUNDA Wallet API Key Server Card Form Issuer systems Provisioning API MasterPass API Card authorization

10 Implementation scenario 2 - Backend integration In this scenario, Pecunda is integrated in the backend systems of the issuer. The issuer integrates MasterPass functionality into their own backend systems. The Wallet API (SOAP) is used server-to-server, so no need for end-user authentication or SSO Wallet API is used for Storing wallet data (cards, loyalty, addresses, personal information) Communication with the MasterPass API Generating a token for authorizing Card Form actions Card Form is used for Providing one or more methods for adding cards manually (card form) Authenticating manually added cards Provisioning API is used for on-boarding wallets Issuer with own wallet implementation, using Pecunda as an accelerator to connect easy and fast to the MasterPass backend with the ability to let users add foreign cards to their wallets. Frontend integration to use MasterPass is managed by the issuer themselves. Browser Issuer systems Wallet API Provisioning API Key Server Card Form PECUNDA Issuer Issuer systems MasterPass API Card authorization

11 Implementation scenario 3 Frontend integration In this scenario, Pecunda is integrated with the issuer s systems in the browser of the user. The issuer integrates MasterPass functionality into their own frontend systems. The Consumer API is used user-to-server, so we need to authenticate the end-user and authorize access Issuers will want to provision and maintain (parts of) the wallet data of end-users Issuer with own wallet implementation, using Pecunda as an accelerator to connect easy and fast to the MasterPass backend with the ability to let users add foreign cards to their wallets Also, issuer wants to use standard frontend API instead of programming their own in order to be able to use MasterPass Browser Issuer systems Consumer API PECUNDA Wallet API Key Server Card Form Issuer systems Provisioning API Issuer MasterPass API Card authorization

12 Implementation scenario 4 Loosely coupled In this scenario, Pecunda is only loosely coupled with the issuer s systems to support user authentication at the issuer s site. The wallet is operated as a stand-alone wallet. Consumers get redirected to issuer s systems for logging in (using OpenID Connect) Issuers will want to provision and maintain (parts of) the wallet data of end-users Organisations who want to offer a wallet, using their own identy/user store, but without the need of fully integrate into their own infrastructure Browser Identity provider Consumer API Frontend PECUNDA Wallet API Key Server Card Form Issuer systems Provisioning API Issuer MasterPass API Card authorization

13 Addendum - Standard approach Front image

14 Chess ix follows a 2 step standard process for building your new wallet. Step 1: Define / Quick scan a During a 2 day Quick scan the main outlines of the wallet is defined a b c d e f Quickscan Workshop Step 1 Define Impact analysis Development Deliverables: After the Quick scan we have: A report outlining your wallet case General defined scope of the modular wallet An agenda for the next phase Step 2 Development & Test Sandbox testing Day 1 9:00 Introduction, who s who (30 min) 9:30 Client business case goals and vision (45 min) 10:15 Break (15 min) 10:30 The MasterPass TM concept in detail (90 min) 12:00 Discussion and lunch (90 min) 13:30 Functionality and added value (120 min) 15:30 Break (15 min) 15:45 High-level architecture and system context (60 min) 16:45 Wrap-up, actions, decisions (30 min) 17:15 Session end Day 2 9:00 Introduction, summary, agenda (30 min) 9:30 Non-functional aspects overview (45 min) 10:15 Break (15 min) 10:30 PCI-DSS considerations (90 min) 12:00 Discussion and lunch (90 min) 13:30 Performance, security (60 min) 14:30 System architecture & technology (45 min) 15:15 Break (15 min) 15:30 Project organization (45 min) 16:15 Maintenance and operations (45 min) 17:00 Wrap-up, actions, decisions (30 min) 17:30 Session end 14

15 Chess ix follows a 2 step standard process for building your new wallet. Step 1: Define / Workshops / Impact b,c The requirements, plan and costs are defined in close collaboration sessions a b c d e f Workshops After the Quickscan, one or more workshops are held to analyze the requirements detail. Chess ix shall translate these into a plan for implementation. Quickscan Impact Analysis Based on this plan an impact analysis is made including a budget overview. Workshop Impact analysis Development Sandbox testing Deliverables: Requirements have been defined in a SRS (Software Requirements Specifications) Adaptions to the modular wallet architecture (System/Subsystem Design Description) A viable implementation plan is drafted Budget finalisation Step 1 Define Step 2 Development & Test 15

16 Chess ix follows a 2 step standard process for adaptions and extensions Step 2: Development & Test d,e Development, continuous testing a b c d e f Quickscan Workshop Impact analysis Development Sandbox testing Design Start with the modular wallet as is. Optional : Light-weight stack of modern open source components (Java) for adaptions Designed with automated test and deployment in mind Optional Development & test PCI-DSS compliant process including CERT-based source code audits Automated, 24/7 unit and system testing with high coverage Continuous monitoring on code quality aspects (duplication, complexity) Automated deployment to test and acceptance environments Agile process with varying client involvement according to needs. Acceptance Full support for client acceptance testing with knowledge and dedicated MasterPass test tooling and sandbox environments. Step 1 Define Step 2 Development & Test Deliverables: Software of proven functional and technical quality Our system documentation Sandbox test environment Hosting and maintenance: Hosting and operation can be fully outsource to Chess ix 24/7 maintenance organization starting with 2 nd line ITIL service desk PCI-DSS compliant datacenters in Amsterdam 16

17 Chess it International B.V. KvK Lichtfabriekplein TE Haarlem Netherlands P.O. Box CA Haarlem +31 (0) [email protected] About Chess ix Chess IT International B.V. (Chess ix) designs and develops mission critical software for innovative organisations. We support our clients with realising their business goals by delivering: 1. Product development projects and high-quality software development projects 2. Card-based facility management and payment solutions. We offer a drastically reduced time-to-market by integrating existing software components for online payment processing, card management, and facility management, as well as hardware NFC readers for payment and public transport cards. 17