Orange County NC Website
Browse       Search
Delerrok Confidential Page 13 of 21 <br />via the Merchant Portal or, if such sale is made using bankcards via the <br />Passenger Portal or Mobile Application, by processing of the sale transaction via <br />TouchPass Hosted System interaction with AGENCY’s designated bankcard <br />payment acquirer (“Payment Gateway”) with AGENCY serving as Merchant of <br />Record and subject to any credit card posting delays and charges resulting from <br />the Payment Gateway. AGENCY shall retain all such revenues and shall pay <br />transaction fees to Delerrok subject to the provisions of Section 4 of this <br />Agreement. <br />vii. Support Delerrok, AGENCY and passenger online management of passenger <br />accounts via the TouchPass Hosted Services. <br />b. Minimum Security Requirements. The TouchPass System shall employ industry <br />standard security measures addressing fare evasion, fraud, revenue theft and data theft. <br />Including the following security features: <br />i. Fare media authentication <br />A. The TouchPass System includes Positive List, an optional feature which <br />enables the AGENCY to upload lists of cards issued by third party <br />organizations that can then be used by passengers as fare media to board <br />AGENCY vehicles by presenting the cards to the TouchPass Readers. <br />The uploaded lists typically include only a unique identifier (UID) <br />number which is stored in an unencrypted form in card memory and can <br />be accessed by any device that sends the required commands to the card. <br />This provides a convenient mechanism to enable acceptance of third <br />party-issued cards but does not provide any means to authenticate those <br />cards using standard encryption techniques. Without the use of <br />authentication, the fraudulent creation and use of counterfeit cards is <br />possible and could not be detected by the TouchPass System. In the <br />event AGENCY elects to use the Positive List feature, AGENCY accepts <br />this reduced security and will hold Delerrok harmless for acceptance of <br />counterfeit cards and loss of revenue that may result from such <br />acceptance. <br />ii. Message protections <br />iii. Sensitive data storage <br />iv. Encryption key management and storage <br />v. System monitoring and testing <br />vi. Procedures for handling breaches <br />c. Compliance with Standards. The TouchPass System shall be compliant with the <br />following standards, which govern certain aspects of electronic fare payments. Any non- <br />compliance with the following standards shall be stated in written form to AGENCY <br />prior to Agreement execution: <br />i. ISO/IEC 14443 – Contactless integrated circuit cards <br />ii. ISO/IEC 7816-1 – Physical characteristics of cards <br />iii. ISO/IEC 18092 – NFC, Interface and Protocol <br />4. Compensation. AGENCY shall pay the following to Delerrok as compensation for the <br />Equipment and Services: <br />a. Equipment. AGENCY shall pay Delerrok for equipment upon delivery and acceptance, at <br />the unit prices listed below: <br />Item Quantity Unit Price Total Price <br />Reader Loan 19 $50.00/month/unit $11,400.00/yr <br />TouchPass Card 1,000 $2.00 $2,000.00 <br />Reader Installation Kit 16 $148.50 $2,376.00 <br /> <br />DocuSign Envelope ID: 000FC59A-58C3-40A5-B7DA-3677E8179B51