INFOSEND, INC. 1 - 2007 - Laserfiche WebLink

Home Browse Search

InfoSend Response — 12/29/2006 GR -50. The vendor shall have and maintain a disaster recovery plan to protect COSA receivables and the confidentiality of the information contained therein. Vendor shall provide COSA with a copy of the plan. Detail the proposed offsite storage location and plan for backing up data daily. Include the processing steps from transmission receipt to paper bill delivery. The successful vendor shall show evidence of a X functional contingency plan to guarantee the complete and timely processing of City of Santa Ana's work. Describe your contingency planning, documentation and testing processes on Attachment E using scenarios indicated. II.A. GENERAL REQUIREMENTS — CONTINUED GR -14: "Describe the processes and /or technologies in place to ensure the security and privacy of data transmissions." InfoSend follows the Payment Card Industry (PCI) rules set for companies that originate less than 6 million credit card transactions per year. All security procedures and policies are based around PCI. All information is confidential and protected. User passwords are stored using a one -way hash and cannot be read by anybody. The application is hosted by physical three -tier layer architecture. The presentation server, the application server, and the database server are separated onto different physical networks. Users can only connect to the presentation server over 128 -bit SSL in order to ensure that all information passed from the customer to the application is encrypted. Anti -fraud features such as Address Verification Service (AVS) and Credit Card Security Coding (CSC) are used when payment transactions are processed. External security monitoring by ScanAlert informs InfoSend if there is a perceived problem from the outside of the network. Unauthorized users cannot access utility account data, bank account or credit card numbers, or other payment information. The data that InfoSend transmits to its payment processors is encrypted. Industry standard security methods safeguard data and external site monitoring scans for open ports or other security issues. Proper access control methods insure that internal users can only access the data relates to their job functions. While InfoSend uses the Windows operating system for internal processing the EBPP application itself is hosted on Red Hat Enterprise servers. InfoSend elected to use this operating system for its web hosting because independent studies have shown it to have less critical security flaws than Windows has had over the years. Physical facility security measures are in place to prevent unauthorized access to data. Security cards /tokens are required to enter the building. Visitors must be signed in before entering. All servers are centrally located and only authorized staff members can access them. GR -19: "Vendor must be able to accommodate multiple bill formats. Bills and notices may be redesigned as part of this Agreement. Pricing should include the cost of initial bill format set up for each format required and for subsequent required changes and redesigns. Vendor must specify the type of bill or change that might constitute a "new" format. For example, when a 16