Separate parking session information from card data, and establish payment security responsibilities across the actual payment flow.
Establish which systems and parties store, process or transmit payment account data. The merchant's payment advisers should determine assessment responsibilities from that actual flow, supported by current evidence covering the relevant services.
PCI DSS concerns the payment environment. An assessment for one terminal or software component does not establish that the whole parking deployment has been assessed, including its connections and support arrangements.
PCI SSC: merchant payment security process
Cash collection and card acceptance create different records. Connected terminals introduced a payment environment alongside the parking ledger, while later interfaces made it possible to exchange a payment reference without exchanging full card details.
That separation matters when a visit is linked to a plate. Staff reviewing entitlement usually need to know whether a session covers the vehicle, zone and time, rather than how the driver authenticated the payment.
An outsourced processor or hosted payment page may reduce the data handled locally. It still leaves the merchant needing advice about its own responsibilities and the applicable validation route; outsourcing does not settle that scope automatically.
A provider reference, plate, zone and validity window may be enough to investigate a missing session. Card credentials add a different handling responsibility and should not drift into case notes or screenshots.
Map the terminal, processor, web page, refund process and support tools. Current validation evidence needs a service scope and assessment date, with responsibilities allocated to each party. Agree the minimum return fields before connecting the parking and payment services.
Payment-security standards prohibit retaining sensitive authentication data after authorisation, even when encrypted. Establish how that boundary works in the proposed arrangement, and separately document how the payment provider handles refunds and disputed settlements.
CORE's Paid Parking feature brings session information into vehicle review. That fits an entitlement check needing session context rather than raw card data. The supported provider interface and exchanged fields need confirmation for the proposed deployment.
The feature description does not verify a payment terminal, a merchant assessment or a native gateway. Each needs its own supplier evidence and agreed scope within the payment review.
Sources were reviewed on the publication date. Check the linked material for current details.
