What is the city’s PCI scope?
PCI scope stays smaller when card numbers never touch city servers or a clerk’s screen. GovtPortal uses EMV chip devices at the counter and hosted or redirected online checkout so staff are not keying full card numbers into a city database. Ask the proposal to name the processor and state, in one sentence, whether card data is stored on city systems.
GovtPortal describes its payment solutions as PCI DSS compliant. Ask for the current Attestation of Compliance with the proposal.
What “hosted” changes, and what it does not
If the resident types a card number into a payment page hosted for that purpose, or taps a card on a validated point-of-interaction device, the city’s ordinary office computers are not storing the PAN. That is the reduction in scope clerks are looking for. It is not a certificate that says the city has no PCI duties. The city still decides who can issue a refund, which workstations can open the admin tools, how long receipts are kept, and what happens when a device is lost.
What to verify
- The attestation or responsibility matrix: which requirements sit with the processor, which with GovtPortal, and which with the city.
- That staff are told not to take card numbers by email or on a sticky note “just this once.”
- IVR design: the caller enters the card on the phone system, not by reading it to a clerk.
- Device list for the counter and any kiosk, including who orders replacements.
- Whether any department still uses a separate, older virtual terminal that does store data.
A practical scope statement
Cardholder data is captured on the hosted payment page or on EMV devices. The city keeps administrative access to payment records that do not include the full card number. The city remains responsible for its own user administration, refunds, and physical devices.