SAAS Vendor Achieves Highest Security Standards for Cloud Transactions

Increased reliance on cloud computing and on-demand software models
is highlighting the need for airtight security, particularly where
billing is concerned.

Aria Systems, a provider of on-demand billing and customer lifecycle
management, is leaving nothing to chance. On Jan. 7, the company
revealed its A+ Billing Platform has achieved Level One PCI (Payment
Card Industry), as recognized by the PCI Security Standards Council, a
status Aria executives expect will instill confidence in the company’s
customers and buoy its upcoming channel recruitment efforts.

Aria’s achievement, still relatively rare in the SAAS (software as a
service) world, is significant because level One PCI compliance covers
the actual processes involved when data moves around the cloud, as
opposed to just securing the infrastructure.

“Anything we do that touches our customers’ financial information is
PCI-compliant at the highest level,” says Aria CEO Ed Sullivan.

Securing the cloud is a complex proposition for businesses that tap
applications and transmit data through the Internet’s vast public
infrastructure. The potential for data breaches exists at various
levels, including network access points and the transmission of
information through the cloud.

“We think that’s one of the dangers of the cloud,” he says.

Is your data safe?  Find out here.

Sullivan contends that while some companies boast of PCI compliance,
they are not compliant in the all-encompassing way that Aria has
achieved. In many cases the infrastructure is secure, he says, but on
the backend there are manual processes where potential breaches could
occur.

Aria’s technology automates all transaction-related activity,
including tracking late payments and notifying merchants of default.
Since its founding in 2003, Aria has processed more than 1 billion
transactions and has about 1 million users currently, say executives.

The vendor sells its technology through SAAS contracts either
directly or through partnerships with companies such as Rackspace. The
company now is setting its sights on the solution provider and managed
services provider channels, and its vice president of marketing, Jim
D’Arcangelo, believes the Aria’s Level One PCI compliance will play big
with the channel companies.

That’s because it addresses concerns over security and questions of
accountability that tend to surface when providers add SAAS to their
offerings. Providers want technology they sell to customers to be
rock-solid, secure and profitable, D’Arcangelo says.

In achieving Level One PCI compliance, Aria joins a distinguished
group of IT heavies, including Google, Oracle and Microsoft, by meeting
the credit card industry’s strictest security measures.

Aria executives say the company spent the last six months updating
its security standards and implementing the policies and procedures
necessary for obtaining Level One PCI Compliance. 

The security measures protect Aria customers against lost
transactions and the financial penalties associated with credit card
fraud, identity theft, network breaches and Internet viruses. Companies
doing commerce over the Internet risk monthly fines of  $5,000 to
$25,000 for failing to comply with PCI standards.

In accordance with Level One PCI Compliance standards, Aria tracks
and monitors access to network resources and cardholder data, encrypts
data transmissions and tests periodically to prevent unauthorized
access.

Sullivan says people typically focus on protecting credit card
numbers, which is important, but a truly secure transaction environment
also has to meet privacy standards against letting cardholder data fall
into the wrong hands.
D’Arcangelo says Aria is in the early stages of designing a channel program for solution providers.