CU's guidelines for data security compliance protect both constituents and university units. eComm's use of Cvent is governed by CU APS 4056, the Office of Information Security and the Office of the Treasurer. Credit card processing practices in Cvent undergo an annual security assessment to ensure that all practices comply with Payment Card Industry Data Security Standard v4.0.1.

Compliance is Your Responsibility

If you create event registration forms in Cvent that require credit card transactions, you MUST meet CU data security standards to ensure that the university can continue to use secure merchant accounts in Cvent.

What is PCI? 

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment.

PCI FAQs

How can I ensure I am compliant?

If you create event registration forms in Cvent that require credit card transactions, the following activities are NOT PCI compliant and could result in steep fines or inability to use a merchant account with our partner bank, Wells Fargo Merchant Services (WFMS). 

  • Do not accept credit card information over the phone, via mail and in-person (e.g. at an event).
  • Do not enter credit card information into Cvent using a CU-owned device (computer, laptop, phone, etc.)
  • Do not configure Cvent to "Process Payment at a Later Date."
  • Do not use Cvent's Event in a Box solution to process credit card payments.

What alternative payment processing options exist?

We understand that PCI compliance requirements may present challenges for your unit. The alternatives below are available to help you identify a solution that will meet your business needs. 

1) Take Cash or Check

For those attendees who cannot register for an event using a personal device and who would have previously provided credit card information over the phone or via mail, encourage them to mail a check or bring cash (check with your unit finance representative about cash) or check to the event. 

Cost

There is no cost to your unit with this option.
​

2) Purchase (or Rent) a Credit Card Terminal

Obtain an individual merchant account that is owned by your unit AND purchase (or rent) a terminal ("swiper"). You will be able to accept call-in, mail-in and in-person credit card information using this terminal that is associated with your unit-owned merchant account. 

Cost

 

Merchant accounts are FREE if associated with a terminal ("swiper"). You must have a merchant account AND a swiper to be compliant. 

You have a few options for a credit card "" terminal: 

PURCHASE RENT
  • Wireless terminal
  • Must be associated with a phone service (AT&T or Sprint, etc.) so additional cellular costs apply
  • Becomes property of your unit
  • Your unit owns it forever
  • $600 one-time cost
  • Wireless terminal
  • Must reserve at least a week in advance
  • $45 rental fee + $15 cell service fee = $60 total

Other considerations:

  • You must have a merchant account AND a swiper to be compliant. 
  • Your merchant account can be associated with your desired speedtype. 
  • Your unit's finance representative can access the account for processing, refunding and other purposes for any transaction made via the swiper. 
  • To obtain a new merchant account, the process takes about 2 weeks
  • A new credit card swiper will arrive within a week after purchase
  • In addition to using the swiper for call-in, mail-in and in-person transactions, we recommend you also process "OFFLINE" registrations via your Cvent form. This allows you to capture all registrations activity for future analysis, reporting and reconciliation purposes.
  • All merchant account holders must work with their campus security teams on their annual compliance assessment. 
​

3) Use a Terminal and Establish a Cvent Internet Merchant Account (IMA)

In addition to obtaining a merchant account and purchasing a swiper (see 2nd alternative above), you can also purchase a separate Internet Merchant Account (IMA) and set it up within Cvent. 

  • This option allows you to accept call-in, mail-in and walk-up transactions using the terminal (2nd option).
  • The Cvent IMA allows for a smoother money process as all transactions will go straight to your IMA, instead of via the CU-shared IMA where the money eventually ends up in your speedtype via reconciliation and journal entries made by Treasury and Controller offices.  

  • The separate merchant account is specific to online transactions for Cvent. This is required by Wells Fargo Merchant Services (WFMS). If you go with this option, you will have TWO merchant accounts: one for the terminal/swiper and the other for online transactions (via Cvent). 

  • All merchant account holders must work with their campus security teams on their annual compliance assessment. 

Cost

 

  • The online gateway (IMA) with Wells Fargo Merchant Services (WFMS) is $200 one-time set-up and then $20 monthly ($240 annual). The process takes about 2 weeks. This step must be complete before setting up the Cvent Internet Merchant Account (IMA). 
  • The cost with Cvent is $970 set-up and then $750 each year after that. This process takes 5-7 days. 
​

4) Establish Dedicated Computers

NOTE: You must work with your campus information security team to determine if this is an option. 

If you set up dedicated computer(s) within your unit that are ONLY used for processing credit card transactions (eg; via Cvent forms) and that are approved by your campus security team:

  • you need to purchase a separate merchant account (see option 3 above)
  • you do not need to purchase a terminal ("swiper").

Cost

 

Yes. There is a cost - see option 3. You would be doing option 3 + option 4 in this scenario. 

Frequently Asked Questions

What is a Merchant Account?

A bank account that enables the holder to accept credit cards for payment.

Why can’t we enter credit card information into a Cvent form on a CU device?

The non-compliant component is that the credit card information is transmitted on a CU-owned device. Review the "Compliant Alternatives and Costs" tab for details on other options. 

Can I use the Cvent mobile app and Cvent swiper?

The Cvent mobile app and swiper solution NOT approved to accept credit card transactions.  However, your unit can use it for any purposes other than credit card transactions.

How much does it cost to get a new merchant account?

It depends on which option works best for your unit. See the "Compliant Alternatives and Costs"  tab for more information.

If I obtain a merchant account for my unit, can I have all of my Cvent forms associated with that?

No. You would have to set up a separate merchant account that is specific to online transactions. The cost for a merchant account online gateway is $200 and $20 per month after that. There is an annual cost with Cvent of $750 for an integrated merchant account. One-time cost is $970. Annual cost is $750. See the "Compliant Alternatives and Costs"  tab for more information. 

Can a “walk-up” attendee use their own phone to register and pay using their credit card?

Yes. As long as the transaction takes place on a NON-CU device, you are compliant. 

How do I ensure Cvent reflects the registration if we are using a swiper to accept credit card transactions for call-in, mail-in or in-person transactions?

Register as normal using Cvent, but mark the registration as “Offline.” Visit our How-Tos page for help on how to do this. You will do this IN ADDITION to using the credit card swiper. 

Is there a university policy that addresses PCI compliance?

Yes. Refer to CU APS 4056 for more information.

If I am conducting a fundraising event and using the CUF merchant account for registration payments, can I also use this same account for other event activities such as auctions or merchandise sales?

No, auction and/or merchandise sales will require the rental or purchase of a wireless terminal through the Treasurer’s Office.  Revenues from these types of activities should be deposited to the University and to your event Speedtype.

Compliance Confirmation

If you are a CU Cvent user, confirm that you are PCI compliant in your use of the CU Cvent "CU Events" merchant account.

  • Complete this form even if you host free events.
  • Complete this form even if you are not an authoritative event form "approver" in your unit. 
  • Failure to complete this form may result in Cvent access discontinuation. 

Complete form

Contact Us

Jennifer Mortensen | University Information Services (UIS)
Contact Jennifer for more information about eComm or Cvent.

Brad Judy | Office of Information Security
Contact Brad for more information about PCI and data security.

Alisha Palas | Treasury
Contact Alisha for more information about merchant accounts or if you would like to set one up for your unit.