PCI compliance with Aloha 6.1 1

[newbie09]

Hi all,

At our restaurant, we run Aloha 6.1.10 and are fearful that come July, we'll no longer be PCI compliant.

Is there anyone on this forum who knows of a way to allow us to continue to be PCI compliant while remaining on 6.1.

So far, I have one work-around that looks viable; by using our banks stand alone CC processing stations and pulling a new phone line for them, I could make the bank responsible for our PCI compliance, then I'd only have to figure out how to put a payment button on Aloha that says something like "OTHER" or "CREDIT" so that I can still run decent audits from BOH.

Any advice would be appreciated.

Newbie09

 

[posrescue]

If you go that route on the day you have the stand-alone credit card boxes installed change the existing credit card tenders in Aloha so they don't require a card number, do authorization or have an expiration date.

Your staff should close credit card checks to the appropriate tender type and still enter tips as always, they just won't swipe the card. This way at the end of the shift their checkout should still work like always. Just be sure to audit the chekouts from the credit card box to the Aloha checkout to ensure the amounts ballance...

 

[newbie09]

prorescue,

That sounds like great advice and certainly looks like wonderful, clean, streamlined logic to me.

I will have to learn how to make the changes to the settings but, at least I have until July to do so.

You worded your answer "If you go that route;" do you know of another way to remain compliant while still remaining on Aloha 6.1?

Many thanks for your help!
B

 

[TobeThor]

The list of PCI DSS validated payment platforms includes Aloha 6.1 so no worry at this time but as is the case with many versions the standards will change and 6.1 may fall out of favor.

Why not upgrade to 6.7? With Radiants software membership it's free.

 

[SwampGas]

Isn't aloha 6.7 in controlled deployment right now and not in full release?


MegabyteCoffee.com

 

[newbie09]

TobeThor,

I was under the impression that Aloha 6.1 would "fall out of favor" regarding PCI compliance during the coming July. Am I wrong?

Our reason for not wanting to "upgrade" our software is principally based on cash flow. We are not on subscription/membership.

Newbie09

 

[TobeThor]

Megabyte,

Sorry spoke too soon, you are 100% right, 6.7 is not available for general release.

What about Ver 6.1 will make it non-compliant?

 

[DTSMAN]

I am starting back to work for an Aloha dealer here soon. When talking to them, they said they are moving all their customers to 6.4 for current compliancy.

Newbie, your biggest concern is your CC vendor. They are the ones who say yes or no to what you can process using. They will probably give you the terminals you need if you chose not to upgrade or if they even keep up with your Aloha version.

The biggest con to NOT upgrading and using stand-alone terminals is that you will have a balancing nightmare at the end of shifts because of the double entry of the monies, if you are going to try and have them do tips through Aloha for tip outs etc.

Unfortunaltely software upgrades are an associated cost of doing business. Even with other business applications like Quick Books or Peachtree that need to keep up with changing tax issues.

Do the upgrade, it will pay for itself. You should easily get a year+ out of it until some DA in the compliancy dept. makes up something new, but will never fill the hole where the server walks away with your CC and comes back 5 minutes later. Hmmm, I guess we will have to have wifi terminals to roll around to the tables next.

Bo

Remember,
If the women don't find you handsome,
they should at least find you handy.
(Red Green)

http://www.redgreen.com

 

[newbie09]

TobeThor said:
What about Ver 6.1 will make it non-compliant?

TobeThor,

I am under that impression as a result of an email I received from our Aloha Dealer. I will re-read it to be sure.
Am I wrong?

DTSMAN,

Thank you for your considered response.
I agree with you with regard to software costs being a part of doing business; none the less, I do not think that "upgrading" to every incremental release serves to profit everyone involved in the chain.

Working in architecture in my previous life, we had the annual debate on cost/benefit relating to upgrading to the then current version of AutoCAD/Architectural Desktop. Most often, it was the consensus that it was not worth it "at that point."

As is the nature of public companies, new product has to be released to show shareholders that staff isn't idle. As a result, a large portion of the changes I've seen between releases of MS Office, Autodesk, Adobe and others, have related to re-packaging the product.
Re-training staff to become accustomed to the new look/feel, time into updating stations, paying for software, my time spent ironing out wrinkles that invariably come up, and more issues all have to be considered.
From where I'm sitting, for the upgrade to pay for itself, it would have to save me money over my current release.
I can't imagine it being improved to a sufficient level to do that, but I should probably look at the Aloha site to see what's new.
Also, it wouldn't be the first time that I was called unimaginative.

Sincerely,
Newbie09

 

[newbie09]

An excerpt from our dealer's email:"All CC Processing Software versions are validated for adherence to specific criteria based on the date of the analysis. This software version is then considered “Validated” against the version of the standards in place at the time of validation. These standard validation versions typically expire 2 to 3 years from issuance. When the standard validation version expires, the software version validation expires.
...
Aloha v6.1 (all point versions) expires on 3/1/10"

As to WHY, I still don't know, do any of you?

 

[TobeThor]

This is a curious subject. Hopefully someone can offer a few insights.
Will Ver 6.1 become non-compliant simply because it's validation expired?

Is Ver 6.1 technically still "compliant" but it's validation only expired?

Do software providers incur a cost to have each version of their software validated?

Is it fair to say that Radiant simply chose to avoid the cost of having 6.1 "re-validated"? If that is so, it seems very unfair to the businesses who buy POS software as the need to upgrade will be constant and in many cases unnecessary.

 

[newbie09]

posrescue,
Thank you for your guidance.
When we switch (soon) how would I go about changing the credit card tenders so they don't require a card number, authorization or expiration date?

Many thanks in advance for your help

newb

 

[DTSMAN]

Page 6 of this document.

http://foremostpos.com/uploads/ComplianceNewsletter_072008.pdf

Bo

Remember,
If the women don't find you handsome,
they should at least find you handy.
(Red Green)

http://www.redgreen.com

 

[Circle9]

Bo,

Are you working for Foremost (or will you be) or did you just find the file on their site? I am currently a Foremost customer!

Just curious

 

[DTSMAN]

I do not work for foremost. I found that shared document. Here is another from Visa. Do a search of the page for Radiant or whomever you want to see compliant versions and how long they will except them.

http://usa.visa.com/download/merchants/validated_payment_applications.pdf

Bo

Remember,
If the women don't find you handsome,
they should at least find you handy.
(Red Green)

http://www.redgreen.com

 

[DTSMAN]

Here is a link to those making the standards.

https://www.pcisecuritystandards.org/index.shtml

Bo

Remember,
If the women don't find you handsome,
they should at least find you handy.
(Red Green)

http://www.redgreen.com

 

[posrescue]

newbie09,

From Aloha Manager go to [Maintenance][Payments][Tenders].
Go to the first of your credit card types in the list.
You can typically leave the settings on the "Tender" tab and the "Type" tab the same. On the "Identification" tab uncheck "require Identification". On the "authorization" tab uncheck "Require Authorization".

You can still close the checks to the appropriate tender type in Aloha and enter the tips for each transaction. This will make the checkout process pretty simple. The servers just need to make sure their checkout on the credit card terminal balances against the Aloha checkout. If not they can make the needed adjustments. Since you won't be swiping cards (capturing any card holder data) you will not have to worry about compliency other than clearing existing cardholder data already on the system.