CHRIS: The fundamental behind the payment portal and the payment hub system is, it's really made up of two components. The first is our customer portal, which is driven from our enterprise eCommerce platform. We've essentially selected modules that make sense as a payment portal, as a customer self-service portal, a payment hub, as we call it. And this system, at its core, is PCI-DSS compliant. We tokenize the data—the payment information—so that it's PCI-compliant wallet and allows the customers to do some of the things that you mentioned: being able to view and pay invoices, orders and refunds, deal with subscriptions, and even see subscription renewal dates, manage their address and their billing information, etc. These are things that are really powerful.
The reason that we have all of these is because we are leveraging a bigger platform, and we've narrowed the scope of it to be able to be a simple, off-the-shelf solution. But keep in mind, there's a powerful engine behind this with our eCommerce platform.
The other piece that we've brought in is our connector. Our connector is architected as an integration platform. The integration platform can operate in different physical locations. So this can physically sit behind an internal firewall as an on-prem deployment. It can sit in a Cloud deployment that's behind a secure Cloud infrastructure. It can operate as a hybrid model, where we have an agent that's on-site behind a firewall that’s securely and very myopically sharing only what's necessary to our hybrid Cloud instance from the internal systems that we're integrating to.
There are a lot of different catering aspects that we can implement for your particular business. Fundamentally, the standard solution that we see quite often is that we're using our integration platform, which we call Clarity Connect, and our eCommerce platform. These are married together to deliver a turnkey solution that's very secure.
Again, we tokenize the data, and there's a lot more detail we can share on tokenization, maybe in another talk. But the summary, the way I would convey it to you, is that all of this sensitive data, this PCI-DSS card payment information, is never stored in our infrastructure, in our database. It's never persisted into our database. It goes straight to the payment gateway and they provide us with a token, as Ron was referring to earlier.
This is great because we're putting all the sensitive data into bank-level or higher encryption, and then we're getting back a token. Then we're using your specific payment gateway account that we're integrating to in order to get access to this tokenized account by using the token as a key. And so this is really powerful. This is the fundamental of how PCI-DSS compliance operates today.
So you're getting—and this is what I think is so powerful—you're getting this eCommerce platform that's an enterprise eCommerce platform, and an integration platform that's an enterprise integration platform bundled into one solution, that we refer to as our payment hub.
RON: Yeah, that I love that. And when I'm doing demos for people, a lot of times I talk about the PCI-compliant wallet and they don't really understand what that means. They understand there's something about security there, but they don't understand. And so to [describe it in] one sentence: we don't store credit card numbers.
It's [like] a Dewey Decimal System for a book. The credit card is the book. And we have a little card that says, “Hey, we're going to refer to that card as Chris’s card number one, two, three, four. And so all we store is the expiration date, one, two, three, four, and that this is Chris’s card.
So if anybody came to hack or steal, if a disgruntled employee tried to hack this database, it doesn't matter to us because we don't have any credit card numbers, CVV numbers, we don't have any of those elements to put together. So [the information isn’t there where] somebody could steal and take an identity or steal someone's credit card.
CHRIS: And these aspects of the platform are really born out of going through hundreds and hundreds of these implementations and validating, in production, with literally millions of different transactions that we've processed, making sure that they're secure and valid.