September 2024 Summaries

As autumn approaches, Basis Theory announced several product updates, including self-serve Single Sign-On for Enterprise customers through OIDC, SAML, and Okta connections, supported by new documentation. Proxy enhancements now provide response masking to remove sensitive destination data without a Reactor and expanded Expressions support for injecting Proxy or Reactor configuration into headers and request bodies. Additional fixes address v2 token API and Portal issues, Tenant Owner permission settings, American Express Account Updater edge cases, an iOS SDK bug, Elements Proxy handling of 504 responses, Audit Log errors, token-list loading failures, and improved performance when creating multiple tokens in a single tokenize request.

Point-to-Point Encryption (P2PE) is a PCI Security Standards Council framework for protecting card-present payment data by encrypting it at the payment terminal and ensuring that only a PCI-validated payment provider can decrypt and process it, keeping unencrypted card details out of merchant systems. Unlike less stringent end-to-end encryption arrangements, PCI-validated P2PE typically relies on proprietary hardware and encryption keys controlled by the provider, helping merchants reduce PCI-DSS scope, limit exposure to data breaches, shift certain security responsibilities to the provider, and potentially streamline transaction processing. Its main limitation is provider dependence: merchants may face difficulty changing processors or using stored card data for services such as subscriptions because they do not control the customer payment information. Since validated P2PE depends on secure physical point-of-interaction devices, it is primarily suited to brick-and-mortar commerce, although e-commerce merchants can approximate its security model by sending card data directly to independent token vaults that return tokens for storage and payment processing while allowing flexibility among multiple payment providers.

Stripe merchants may face account restrictions or shutdowns because of high chargeback rates, suspected suspicious activity, involvement in prohibited industries, or mistaken associations with high-risk businesses, with restrictions also influenced by regional banking partners. Reviews can result in a permanent closure, a temporary transaction pause, refunds to customers, and withheld merchant funds, while resolution is uncertain and support is often handled primarily through email rather than direct escalation. The passage argues that reliance on a single full-service payment processor can leave businesses vulnerable, especially smaller companies that may struggle to migrate their payment infrastructure. It presents card-data vaulting and tokenization through Basis Theory Elements as an alternative approach, allowing merchants to route payments among multiple payment service providers, potentially reduce processing costs, improve authorization rates, and continue accepting payments if one provider suspends or closes an account.

Localized payment processing helps international merchants improve payment acceptance by offering country-specific payment methods and routing card transactions through processors with a presence in the customer’s home country. Local options such as Alipay, Twint, and Boleto can be important in markets with low credit-card penetration, as an estimated 10% to 15% of online shoppers may abandon purchases when their preferred method is unavailable. Processing transactions locally can also reduce declines caused by cross-border fraud controls, which are estimated to reject about 11% of international transactions, and may lower fees under different regional pricing and regulatory structures. Implementing this strategy generally requires payment automation, relationships with multiple payment service providers, a transaction-routing decision engine, and secure PCI-DSS-compliant handling of cardholder data, often through a token vault. For merchants operating on narrow margins, gains in authorization rates and reductions in processing costs can provide substantial returns while expanding flexibility in global payment operations.