308.7 – University of North Carolina at Chapel Hill Procedure on The University's Payment Gateway

Introduction

Purpose

The University of North Carolina at Chapel Hill is using TouchNet's hosting service. TouchNet will run, manage and maintain our licensed TouchNet software in their Data Center. TouchNet certifies that its Data Center meets the stringent requirements of Payment Card Industry Data Security Standard (PCI DSS). No credit card data interacts with the University's systems greatly reducing the risk of a security breach attributable to University actions.

TouchNet is the University's preferred payment gateway and is required to be used for all online credit card transactions. To apply for an exception, email certifi@unc.edu.

Scope

This procedure applies to any official or administrator with responsibilities for managing university payment card transactions and those employees entrusted with handling payment cards and payment card information.

Procedure

A user will access the merchant's university web application and will be transferred to TouchNet's Marketplace uPay site when it comes time to pay for a service. Each merchant will have a defined site, called uPay, where the payment card information will be entered. Then the TouchNet Payment Gateway will process the payment from our customers sending the payment data to our credit card processor. The payment gateway stores the payment transaction information in a database tokenized encrypted data files.

The TouchNet payment gateway sends all required data to our processor for both the authorization and settlement. Settlement occurs every evening starting at 10:00 PM. The Payment Gateway will run an automatic, daily batch settlement at the specified time that we defined in the merchant set up.

In the Payment Gateway Operations Center, you can review payment data in reports. At login, every Operation Center user sees only the Merchant accounts, tasks and reports for his or her access rights. A user's role may include rights to view reports, configure the payment gateway, set up Operation Center users, set up merchant and host accounts, process credit or complete single authorizations.

Related Requirements

External Regulations and Consequences

• NC Office of the State Controller: Statewide Electronic Commerce Program
• E-Commerce Policies and Procedures – Maximization of Electronic Payment Methods
• E-Commerce Policies and Procedures – Master Services Agreements for Electronic Payments
• PCI Security Standards Council

University Policies, Standards, and Procedures

• Finance Policy 308 - University of North Carolina at Chapel Hill Policy on Merchant Card Services
• Compliant Electronic Receipt Transactions through Innovation and Financial Integrity (CERTIFI) committee
• University IT Policies

Contact Information