Raiser's Edge on Server Security?

Peter McKay 2

Hello All,


Wanted to ask about security measures in place regarding credit card numbers input in Raiser's Edge.  We've begun to use the eft module and have input complete credit card information. In the case of our server being hacked, does anyone know what systems are in place for keeping that data secure?  


Hope this makes sense.  Thanks!

JoAnn Strommen

My understanding is that cc info is not stored in RE but rather with BBPS/BBMS or card processor. 


I found this knowledgebase solution which supports that:
https://kb.blackbaud.com/articles/Article/54794

Knowledgebase Home

Because credit card information is stored in BBPS, credit card numbers are no longer visible in the software applications. In each application, credit card numbers are replaced with reference tokens. When credit card transactions are processed, the software application connects to the BBPS service. The reference token in your database will summon the stored credit card number to be used in the transaction.

• Article Number: 54794
  • Products:
  • Raiser's Edge

Neither the credit card nor the token is ever stored on any workstation or server for any length of time after the data entry has occurred.  As the credit card number is entered into The Raiser's Edge, depending on what workstation(s) the data is being entered on, that is where the credit card is encrypted and sent to Blackbaud Payment Service (BBPS) securely. The credit card numbers are temporarily stored in volatile RAM, only as they are being entered, and upon tabbing to the next field/row or saving the record (depending on where you are in the program), the card number is immediately tokenized in BBPS.  When the credit card number is tokenized and converts to the (************2468) format, the session has been opened to the BBPS.

The connection from RE to BBPS uses a 128-bit SSL connection to transmit the data back and forth, so the connection is secure. 

This method has been thoroughly audited and is included in Blackbaud’s PA-DSS certification.

Joshua Bekerman bCLO bCRE

There's also some globititygloop here about Blackbaud's PCI compliance:

https://www.blackbaud.com/page.aspx?pid=9749