Douglas Payne, CIO, Massage Envy
Walk into any of Massage Envy Limited's 440 locations and you'll learn how massage can "relieve stress, encourage relaxation, lower blood pressure, relax the muscle and relieve headaches."
But ask a franchise owner what could happen if they lost a customer's payment card data, and you'll see their stress, blood pressure and muscle tension go sky-high. That's why the Scottsdale, Arizona based company decided in June 2007 to replace their existing payment services provider with the Element Express Processing Platform.
The franchisees who join Massage Envy form a personal relationship with their customers, and know that losing those customers' data would jeopardize the trust that brings customers to their facilities week after week. They're also all too aware of the financial penalties that banks and payment processors can levy on merchants who are suspected of losing control of critical data.
For Massage Envy as a corporation, the stakes are just as high. Ranked one of the Inc. 500 fastest-growing companies for 2007 and as one of the top new franchises by Entrepreneur Magazine for 2008, its reputation is critical to attracting and keeping top-quality franchisees.
But even Massage Envy CIO Douglas Payne was surprised when he learned about the complicated formula payment card associations use to calculate the fraud liability of a member bank in case customer data was compromised. He also learned that while the card associations do not fine merchants, banks and payment processing vendors do. Even in the absence of fines, individual merchants (and franchise organizations) can spend months of effort and tens of thousands of dollars disproving a claim that it was their lack of effort that allowed hackers to steal their customers' payment card data.
To avoid that risk, Massage Envy integrated with the Element Express Processing Platform. Using Element Express' PASS (Payment Account Secure Storage), Massage Envy franchisees can keep customers' payment card information off-site and bill their cards automatically for their weekly visits. The use of a 128-bit encrypted SSL connection keeps the cardholder data safe as it is transmitted from the merchant to Element's PCI DSS compliant data storage facility. Once the cardholder data is stored, all that is kept on the merchant's premises is a GUID (Globally Unique Identifier) which is used as a placeholder for further transactions.
Element's Virtual Terminal, a secure Web portal, allows Massage Envy franchisees to authorize and perform credit card transactions, process credits, and perform other functions from any computer with an Internet connection. Payne also likes the fact that Element provides end-to-end encryption of cardholder data throughout the entire payment process.
Payne sees his move to Element Express as low-cost insurance against the damage the loss of customer data could cause to his business, and to his franchisees. In fact, though, there's been no cost, because in addition to providing enhanced security, his franchisees find they are receiving payment more quickly and paying lower transaction fees than with their previous processor.
"For us, Element is a key part of the value we offer to our franchisees," says Payne. "We can offer them a PCI DSS compliant payment solution that provides them with faster payment, lower transaction fees, and vastly improved reporting. Element Express allows our franchisees to focus on their businesses, not on the fine points of transaction processing and PCI DSS compliance."
And that's enough to make any entrepreneur feel better, even without a massage.