P2PE: What is Point to Point Encryption?

FAQs about P2PE

Point-to-Point Encryption (P2PE) is a data encryption solution that protects sensitive cardholder data throughout the entire payment process as well as the merchant’s payment infrastructure (POS terminal) from unauthorised access.

Using a listed P2PE solution allows merchants to complete the mandatory PCI DSS compliance process quickly, easily and cost-effectively.

This page answers key questions about P2PE, explaining what it is, how merchants benefit from it and what requirements must be met to use P2PE.

P2PE (Point-to-Point Encryption)

What is P2PE and how does P2PE work?
The Point-to-Point Encryption (P2PE) solution is based on the card data security standard established by the Payment Card Industry Security Standards Council (PCI SSC). P2PE is a data encryption application that protects cardholder data throughout the entire payment process from unauthorised access – from the moment the card interacts with the card reader to its arrival at the data centre.
Within a closed process, payment data is encrypted directly at the card terminal and decrypted only within the high-security environment of PAYONE’s data centres before further processing.
Why do retailers need P2PE?
Point-to-Point Encryption (P2PE) simplifies compliance with the mandatory PCI DSS regulations by encrypting all cardholder data at the point of sale via the terminal. As a result, network infrastructure, cash registers and peripheral devices are excluded from the PCI DSS assessment framework, significantly reducing the scope and complexity of PCI DSS certification.
What is the Payment Card Industries Security Standards Council (PCI SSC)?
The Payment Card Industry Security Standards Council (PCI SSC) was established by card organisations including American Express, Diners/Discover, JCB, Mastercard, UPI and Visa to enhance the security of payment and cardholder data. The PCI SSC aims to define and continuously develop standards to protect card payments (PCI DSS).
These PCI Data Security Standards (PCI DSS) apply to all participants in the card payment industry involved in processing card transactions – from merchants to network operators, acquirers and card issuers to system and terminal manufacturers. All industry participants that process, transmit or store card transactions must comply with PCI DSS requirements.
Businesses required to provide compliance evidence that fail to meet the standard may face severe penalties, including the revocation of card acceptance rights. More information is available here.
What are the benefits of P2PE for merchants?
Your benefits at a glance:
Faster, simpler and more cost-effective PCI DSS certification
Shortened self-assessment questionnaire with 32 instead of a maximum of 430 questions
Network infrastructure, cash registers and peripherals are no longer part of PCI DSS approval
No additional security measures such as VPN, SSL, network segmentation, scans or penetration tests required
Full support for terminal functions, payment products and reading technologies
Who is responsible for cardholder data security under PCI when using P2PE?
With P2PE, the solution provider – in this case, PAYONE GmbH – is primarily responsible for ensuring the security of cardholder data in accordance with PCI requirements. PAYONE operates and maintains a PCI DSS and P2PE-compliant security infrastructure that also includes terminals within the merchant’s environment.
As a result, most PCI DSS requirements for merchants are transferred to the P2PE solution provider. This eliminates the need for merchants to establish and maintain their own costly PCI DSS compliance.
What do I need to be able to use P2PE?
To benefit from the simplified PCI DSS certification with P2PE, you only need a terminal that meets P2PE requirements, meaning it must be equipped with the necessary encryption technology and required certifications.

Downloads

Security of payments P2PE

FAQs about P2PE

P2PE (Point-to-Point Encryption)

Downloads

DE: Betriebshandbuch für die PAYONE P2PE-Lösung

EN: Operating manual for the PAYONE P2PE solution

DE: PAYONE ONE-P2PE Broschüre (POINT-TO-POINT ENCRYPTION)

EN: PAYONE ONE-P2PE Brochure (POINT-TO-POINT ENCRYPTION)

CCV repair order - RMA P2PE 1/2022

Verifone repair order - RMA P2PE V6.5

DE: PAYONE Supplementary Agreement P2PE Appendix 04/2024