PapeX, Inc. — Card-data scope
PCI DSS Scoping Statement
PapeX Receipt Delivery Hardware (RDH)
For presentation during PCI DSS compliance reviews and assessments.
Purpose of This Document
This document is provided by PapeX, Inc. to merchants who have installed the PapeX Receipt Delivery Hardware (RDH) at their point of sale. It is intended to be presented to Qualified Security Assessors (QSAs), Internal Security Assessors (ISAs), or any party conducting a PCI DSS compliance review of the merchant’s environment.
This statement explains what the RDH device is, how it connects to the merchant’s POS system and network, what data it handles, and how it should be treated when the merchant’s Cardholder Data Environment (CDE) and PCI DSS scope are determined.
What Is the PapeX RDH?
The PapeX Receipt Delivery Hardware is a peripheral module that connects to a merchant’s point of sale environment over the merchant’s local network (Wi-Fi), and in some installations also through a standard peripheral port (USB, RS-232 serial, or Ethernet). It serves one function: capturing the receipt print data stream and delivering it digitally to the customer via NFC tap.
The RDH is installed in one of two configurations:
- Printer Replacement: The RDH replaces the existing receipt printer and connects to the same peripheral port the printer previously occupied.
- Parallel Install: The RDH is installed alongside the existing receipt printer as an additional peripheral. The existing printer keeps its own direct connection to the POS and continues to function normally. The RDH is not placed in the cable path between the POS terminal and the printer or any other device.
In both configurations the RDH joins the merchant’s local Wi-Fi network. It uses that connection for three purposes: receiving the receipt print data stream from the POS, sending completed receipt records to PapeX’s cloud service, and receiving firmware updates and remote diagnostics from PapeX. The RDH must therefore be reachable on the same network as the POS system that sends it print jobs.
Device Technical Specifications
| Device Name | PapeX Receipt Delivery Hardware (RDH) |
|---|---|
| Manufacturer | PapeX, Inc. |
| Connection Interface | Merchant Wi-Fi (local network), and in some installations also USB, RS-232 Serial, or Ethernet (standard POS peripheral ports) |
| Data Received | Receipt print data stream (ESC/POS or equivalent print commands) |
| Data Output | Digital receipt delivered to consumer device via NFC. Receipt records sent to the PapeX cloud service over HTTPS. |
| Cardholder Data Stored | None |
| Cardholder Data Processed | None |
| Cardholder Data Transmitted | None |
| PAN Handling | Device receives only masked/truncated PAN (last 4 digits) as printed on standard receipts per card network rules |
| PIN / CVV / Track Data | Never received, stored, or transmitted |
| Terminal Modification Required | None. No seals broken, no enclosure opened, no firmware altered. |
| Network Connectivity | The RDH joins the merchant's local Wi-Fi network and must be reachable from the POS. Outbound traffic is limited to receipt records, firmware updates, and diagnostics sent to PapeX. It does not connect to a payment gateway or processor. |
PCI DSS Scope Analysis
Under PCI DSS v4.0.1, a system component is in scope for PCI DSS if it stores, processes, or transmits cardholder data (CHD) or sensitive authentication data (SAD), or if it is connected to or could affect the security of the Cardholder Data Environment (CDE).
The RDH does not store, process, or transmit CHD or SAD.
The RDH receives only the receipt print data stream. Per card network operating regulations (Visa, Mastercard, American Express, Discover), printed receipts must not contain the full PAN. Receipts display only the last four digits of the card number, the card brand, and the transaction amount. The RDH never receives, and has no mechanism to receive, full PAN, CVV/CVC, PIN, or magnetic stripe/chip track data.
The RDH connects to the merchant’s local network.
The RDH is not an isolated device. It joins the merchant’s Wi-Fi and must be reachable from the POS system in order to receive print jobs. Where the merchant’s POS network is part of, or connected to, the Cardholder Data Environment, the RDH should be treated as a connected-to system component and assessed accordingly. PapeX does not represent that the RDH is network-isolated. What the RDH does not do is store, process, or transmit cardholder data: the only payload it receives is the receipt print stream described above, and the only data it sends to PapeX is that receipt record. Where a merchant places the RDH on a network segment separated from the payment environment, and that segmentation is validated, the RDH falls outside the assessed scope on the same basis as any other segmented system.
The RDH does not modify the payment terminal.
Installation does not require opening the payment terminal enclosure, breaking tamper-evident seals, altering firmware, or modifying any Point of Interaction (POI) device. The RDH connects to the same external port that any receipt printer or POS peripheral would use. PCI DSS Requirement 9.5 (protection of POI devices from tampering and unauthorized substitution) is not implicated because the payment terminal is not altered.
Device Classification
The PapeX RDH is classified as a POS Peripheral Device: a device adding functionality to a POS system (comparable to a receipt printer, barcode scanner, cash drawer, or customer-facing display) that connects via standard peripheral interfaces and does not interact with cardholder data or sensitive authentication data.
The RDH does not store, process, or transmit cardholder data or sensitive authentication data, and it is not part of the Cardholder Data Environment. It is not a Point of Interaction device and has no card-reading capability. Because the RDH connects to the merchant’s local network, whether it falls inside the assessed scope as a connected-to system depends on that merchant’s network segmentation, and is a determination for the merchant and their assessor. This document is provided to give that assessment the technical facts it requires.
Guidance for Assessors
During a PCI DSS assessment or inspection, assessors may verify the following about the PapeX RDH installation:
- The device receives only receipt print data (ESC/POS or equivalent print commands) and has no mechanism to receive full PAN, CVV/CVC, PIN, or track data.
- The device connects to the merchant's local Wi-Fi network. Its outbound traffic goes to PapeX's cloud service over HTTPS and consists solely of receipt records, plus firmware update and diagnostic traffic.
- The payment terminal's tamper-evident seals, screws, and enclosure are intact and unmodified.
- The device is clearly labeled as 'PapeX Digital Receipt Module' or equivalent.
- The device does not have any card-reading capability (no magnetic stripe reader, chip reader, or contactless payment reader).
- The only wireless output to a customer is NFC, used to deliver the digital receipt to the customer's mobile device.
- The device is not interposed in the cable path between the payment terminal and any other device. In a parallel installation, the existing receipt printer retains its own direct connection to the POS.
Contact Information
For questions about this document or the PapeX RDH, please contact:
Merchants: for device help, status light meanings, and troubleshooting, visit papex.app/support.
PapeX, Inc. — Provided to merchants for their PCI DSS review.