Tessitura products and the hosting services environment are all certified as PCI compliant. As stated in the Tessitura Network Attestation of Compliance, Tessitura is compliant with all PCI DSS requirements. Our customers are responsible for their own PCI DSS compliance. Some DSS requirements may be met by using Tessitura Hosting Services. However, most requirements are either shared responsibilities between the Tessitura customer and Tessitura Hosting Services, or entirely the customer’s responsibility.

For members who use our hosting services environment, this document describes our responsibilities and yours. Some elements of PCI compliance (particularly at the end-user or processing agent level) may require you to develop and follow policies and procedures.

Download Tessitura PCI Responsibility Summary 〉

View Security Policies and Recommendations 〉

We use a defense-in-depth approach to secure the Tessitura hosting services environment. One of our control layers is to regularly test our software and infrastructure for vulnerabilities. We do this using automated vulnerability scans and manual penetration tests. As part of the hosting services agreement, you agree to not perform your own probing, scanning, penetration testing, or any other vulnerability testing against the hosting services environment.

No entity is immune to cyber security vulnerabilities or breaches. Another of our control layers is incident preparedness, including our formal Cybersecurity Incident Response Plan (CIRP). In the event of a suspected cyber incident, we would follow this plan. Our CIRP is regularly reviewed, tested, and updated. Because the CIRP includes detailed and sensitive information, we do not share it with members. Our CIRP is split into discrete steps, including promptly notifying members of incidents. If you are developing your own incident response plans, we encourage you to align to a formal methodology such as those from NIST or SANS.

Tessitura regularly tests the performance of the hosting services environment; we do not currently perform load tests for individual members. In the Hosting Services Agreement, members agree not to perform or attempt any network discovery, load testing, or any other performance tracking of the hosting services environment unless expressly authorized by Tessitura in writing. This includes using tools like the AWS Application Discovery Service and AWS AppSync.

Hosting services users must ensure that no unauthorized person has access to the hosting services environment. Members must ensure that their authorized users take no action that would violate the agreement, and that they do not use the environment or software other than for the member’s business purposes.

Each individual who will log in to Tessitura must have a unique user account set up in the Security application. Sharing logins or disclosing passwords for unique Tessitura or Hosting Services accounts is prohibited, as is using vendor-supplied defaults for system passwords. Unencrypted passwords, and sensitive data such as unencrypted credit cards, may not be stored in Tessitura or the hosted environment in any way. If you need to transmit passwords or sensitive data such as credit cards to Tessitura, you must use the encryption utility. This PCI-compliant utility ensures that sensitive data is never stored in an unencrypted fashion during the work of the support ticket. If sensitive data such as unencrypted credit cards or passwords are stored in Tessitura, the hosting environment or helpdesk system, we reserve the right to initiate Cybersecurity Incident protocols and remove noncompliant data. Please note, for organizations using our hosting services you may request we add the encryption utility as a standalone application on your Citrix storefront.

We aim to provide our members with the most secure and reliable environment possible. To achieve that goal, we regularly undertake routine maintenance of the hosting environment. This includes firewall upgrades, monthly server patches, and Citrix updates. To avoid interrupting your business, we schedule it to occur nightly between 11pm and 5am in your local time. Planned maintenance activities are posted on the service status page. To subscribe to Service Status updates, including maintenance, please visit our service status page and select the region and services relevant to you. 

Hosting Services provides members with SQL Server Management Studio (SSMS) access upon approval of a primary contact. Database access includes the ability to query and update data as well as to create and modify custom tables, views, and stored procedures. Elevated access beyond these functions is available for certain use cases, including the management of SQL Agent jobs, use of SQL Profiler, and accessing sp_who2 to identify and resolve database blocking. We do not grant system administrator level privileges for any reason. Direct database connections such as ODBC are not permitted from outside the hosting environment.

We perform automated backups on the following schedule: transactional backup every 15 minutes, differential backup every eight hours, and full backup weekly. Backups are retained for four weeks. Data backups are routinely validated as part of our replication process as well as part of the standard Production to Test copy requests from our members, to ensure backups restore as expected and application access is confirmed afterward.

Hosting Services provide backups for the following items for a limited time. In general, members should plan to back up files you wish to retain long-term in a location outside the Cloud Hosting Environment.

• FTP data (X drive) – automatically removed 30 days from creation date of file.
• Extraction data – (files in Clients\Prod\Impftp\) – files over 90 days old will be purged periodically.
• Print At Home (PAH) files – It is not recommended to save PAH tickets as they can always be reprinted.
  • Currently the PAH Output folder may have files up to 14 days old. Files may be removed sooner than that if space becomes a consideration.