Thales HSMs provide Global Refund with highly secure and auditable encryption environment to ensure merchants’ trust and help grow business

Thales, leader in information systems and communications security, announces that Global Refund has deployed Thales hardware security modules (HSMs) from the nCipher product line to help the company secure its financial transactions and achieve compliance under the Payment Card Industry Data Security Standard (PCI DSS) for the sales tax refunds it delivers to 30,000 travellers each day.

Global Refund’s Tax Free Shopping program is the world's leading service providing tax refunds to international travellers, helping maximize business opportunities with foreign visitors for more than 240,000 merchants. Shoppers simply ask a customs agent to stamp a merchant-issued voucher when leaving for home and then present this voucher to Global Refund for a refund on their credit card. It means that visitors from abroad can get a discount of up to 15 percent on their shopping by claiming back the value added tax (VAT) or general sales tax (GST). The entire process is easy for travellers and profitable for merchants and every transaction is secure.

Thales HSMs enable Global Refund to encrypt credit card data for secure transaction processing by providing secure key generation and storage. Customer data is then safeguarded against theft or manipulation and Global Refund is protected from the potentially high costs of compromised data.

By protecting the encryption keys used to encrypt the transaction data within Thales HSMs the company has also eliminated time-consuming manual processes for managing and rotating encryption keys – a key requirement for compliance under PCI DSS. Rotating keys across Global Refund’s global operation – from its data centers in Austria, Germany and Singapore to its 200 airport credit card processing locations and to thousands of merchant voucher terminals – now takes less than two hours compared with more than two weeks using a combination of manual and software-based processes.

Thales HSMs integrate with Global Refund’s Microsoft SQL Server 2005 technology environment, are able to support the high-volume processing requirements and allow for seamless failover between devices.

“Merchants know that it is not just the allure of tax-free goods that appeals to foreign shoppers. Through Global Refund merchants are also providing a service that is reliable, secure, and easy to use,” says Viktor Kletzer, vice president of system engineering for Global Refund. “Thales HSMs allow us to easily protect, manage and rotate our encryption keys, enabling PCI DSS compliance without the need for expensive and time-consuming manual controls. We were especially impressed with Thales professional services consultants. They demonstrated the technical competence and understanding of key management best practices necessary to help us achieve our data security and compliance goals. Thales has delivered a highly secure and auditable encryption environment which in turn safeguards our ability to grow and provide trusted services to merchants and their customers.”

“The increasingly high standards of regulation and industry best practices require organizations to better protect sensitive data such as customer details and credit card account information, and encryption has emerged as the preferred method for achieving this”, says Serge Dujardin, Vice President Sales for the information systems security activities of Thales. “Thales HSMs deliver a versatile platform that allows companies of all sizes to securely and cost-effectively protect their data and comply with PCI DSS requirements. We are delighted that Global Refund has chosen Thales to protect their sensitive customer data.”