P2PE isn’t something you switch on in Altru. It also isn’t a feature of a card reader on its own. Point-to-point encryption is a whole solution: the device, how encryption keys get loaded into it, how it’s shipped and tracked, and the provider that decrypts the card data. Your organization can’t add P2PE to a terminal it already owns. What you can do is find out whether the payment path Altru uses offers a validated P2PE option, and get your devices onto it.
This guide explains what P2PE actually covers, how it fits with Altru’s payment processing, and what to ask before you buy hardware or change your PCI paperwork.
What P2PE does and doesn’t do
With a validated P2PE solution, card data is encrypted inside the terminal the moment the card is dipped, tapped, or swiped. Your workstation, your network, and Altru only ever handle encrypted data or a token. Because readable card numbers never pass through your environment, the PCI Security Standards Council lets merchants who use a listed P2PE solution correctly complete a much shorter self-assessment (SAQ P2PE) instead of a longer one.
Three things get mixed up with P2PE all the time:
- EMV chip readers. Chip cards cut down on counterfeit fraud. That’s a separate benefit. A chip reader can still send unencrypted data to the computer it’s plugged into.
- “Encrypted” swipe readers. Lots of USB readers advertise encryption. Unless the device is part of a solution on the PCI Council’s list of validated P2PE solutions, it doesn’t qualify you for the reduced SAQ.
- Tokenization. Storing a token instead of the card number protects data at rest. It does nothing about the moment the card is read at your desk.
How this fits with Altru
Altru processes cards through Blackbaud’s payment services, and the card devices that work with daily sales, memberships, and the other point-of-sale areas are the ones Blackbaud supports. In practice your P2PE options come down to what Blackbaud and its processing partners offer. A third-party P2PE terminal won’t plug into Altru transactions just because it’s validated somewhere else.
Supported hardware and processing arrangements change over time, and I won’t list specific models here. Confirm the current state directly with Blackbaud before you plan around any device.
Questions to put to Blackbaud (and your processor)
- Which card devices are currently supported with Altru, and which of them, if any, are part of a PCI-validated P2PE solution? Ask for the solution’s name exactly as it appears on the PCI Council’s listing so you can look it up yourself.
- If a P2PE option exists, what’s required to move to it? Validated devices usually ship pre-injected with keys from the solution provider. Your current readers almost certainly can’t be converted, so plan on new hardware.
- Does the P2PE solution cover every way you take cards in Altru? Think about the front desk, the membership office, group sales, the gift shop, and event registration tables.
- What documentation will you receive? A validated solution comes with a P2PE Instruction Manual (PIM). Your acquirer and any assessor will expect you to follow it.
- Which SAQ does your acquiring bank expect from you afterward? The acquirer decides that, not your software vendor.
The parts that stay your job
Even with a validated P2PE solution, some responsibilities stay on your side, and they’re easy to drop once the new hardware arrives.
Keyed-in card numbers
P2PE covers cards read by the device. If staff type card numbers into an Altru screen for phone orders or group bookings, that data goes through your workstation and falls outside P2PE scope. Find out whether your solution supports manual entry on the encrypted terminal itself. If it doesn’t, think about moving phone and invoice payments to a hosted payment page the customer fills out themselves.
Device inventory and inspection
The PIM will require you to keep a list of every terminal with its serial number and location, and to inspect devices regularly for tampering or skimmer overlays. Give one person ownership of that list. Seasonal setups like holiday events, pop-up admissions tables, and loaned devices are where terminals tend to go missing.
Old readers
Retire the non-P2PE readers instead of keeping them in a drawer “just in case.” If one goes back into use on a busy weekend, your scope assumptions are wrong and nobody will notice.
Online channels
P2PE applies to card-present devices only. Your Altru web forms and any other online checkout fall under their own PCI requirements, usually based on whether the payment fields are hosted by a provider or by your site. Review them separately.
A sensible order of operations
- List every place and every way your organization accepts cards, including the ones that only come out a few times a year.
- Ask Blackbaud the questions above and get the answers in writing.
- Check the named solution on the PCI Council’s validated P2PE list.
- Talk with your acquirer about which SAQ applies once the change is made.
- Pilot the new devices at one station before you replace everything, and test refunds, split tenders, and membership sales, not just a basic ticket sale.
- Update your device inventory and staff procedures, then retire the old hardware.
Quick answers
Can a firmware update turn my current reader into a P2PE device?
Generally no. Validation applies to specific devices provisioned and managed by a specific solution provider. Ask Blackbaud about your exact hardware, but expect to replace it.
Does P2PE make us PCI compliant?
It shrinks what you have to assess for card-present payments a great deal. You still complete an annual SAQ, follow the PIM, and handle any other channels where you take cards.
