CCS12: a platform to secure card payments

CCS12 offers banks, e-merchants and cardholders strengthened payment authentication, online as well as at the point of sale. Its method, which it presents as patented, combines a QR code and a physical authentication grid to put the cardholder back at the center of security. We built the software platform that makes it run.

The context

A payment-authentication solution lives in the middle of an ecosystem: issuing banks, card networks, merchants and end users. It must fit into existing journeys, notably the authentication protocol for online payments, without adding friction, and remain auditable at every step.

What we built

• The central API, which orchestrates authentication requests and their logging.
• The super-administration dashboard, to manage partners, rules and incidents.
• The partner portal, where banks and merchants configure their integration and follow their transactions.
• The security foundation: per-partner access keys, separation of roles, action log.

How we worked

Starting from the journeys of the three audiences, bank, merchant and user, to define what each one sees and can do. Security choices were written down and reviewed before implementation: what is stored, what never is, what is encrypted and who holds the keys.

Technologies

Node.js and Express API, MongoDB database, React interfaces with a component library, containerized deployment.

What we take away

In payments, the visible product is small and the invisible platform is large. Quality is judged by the clarity of roles and by traceability, as much as by the interface. These are the same principles we apply in our web development projects for finance.