Braintree Merchant Case Study
As a Level 1 merchant doubling in size every 12-18 months, this global vendor of nutritional products came to Braintree with considerable growing pains in payment processing, specifically PCI Compliance, technology, and customer service.
Challenges:
- PCI Compliance – This merchant determined that obtaining and maintaining compliance internally would be a major undertaking and a costly distraction from their core business. With the PCI Standard continually evolving and new threats always emerging, it was clear that an internal compliance approach would cost more and consume more resources and time than anticipated. And even if compliance was achieved internally, millions of credit card numbers would still be sitting on their internal servers, vulnerable to attack by both outside criminals and rogue employees.
- Service & Support – Existing payment processing vendors were unable to resolve outstanding transaction challenges or provide the flexibility needed to help address the unique challenges they were facing.
- Technology Limitations – Daily batches for recurring billing took hours to process, unnecessary transaction errors were affecting revenue generation and other vendor limitations were taxing IT resources.
After an intense vetting process, Braintree was selected as their key payment processing partner. Leveraging Braintree’s dedicated integration team, the merchant was live within 30 days. In the first few months, a few critical objectives were achieved:
Solutions:
PCI Compliance – by using Braintree’s solutions, the merchant was able to reduce PCI Scope to fewer than 20 controls from the standard 250, making compliance achievable within 90 days. There was no change to user experience and the merchant retained full control and functionality of the credit card data.
- Step 1: Environment Cleansing – By importing all the credit card data from the merchant’s environment into Braintree’s Vault, the merchant created a single repository for all sensitive data and transaction history. Most importantly, no credit card data was left in the merchant environment to be stolen.
- Step 2: Credit Card Data Tokenization- A unique token was generated for each credit card stored in Braintree’s vault. These tokens were then used in place of the credit card number for recurring billing and or subsequent transactions. Each token included other stored cardholder information including a billing and shipping address and other relevant information for reporting and reconciliation purposes. Even if stolen, tokens are useless to criminals.
- Step 3: Preventing Entrance of Credit Card Data – Using Braintree’s Transparent Redirect, the merchant was able to continue to use their website, phone and in-store acceptance channels without ‘handling, processing, or storing’ any credit card data without making any change to the user experience.
Service & Support – In the merchant’s own words, Braintree was their single most responsive and helpful partner, always going above and beyond what was expected.
Processing Improvements – Daily batch processing time for recurring billing was reduced by over 90%, transaction errors were eliminated and system customizations enhanced revenue generation.
To find out how Braintree can meet your PCI Compliance needs, contact us.
