PapeX, Inc. — Compliance Documentation
PCI DSS Scope Exclusion Statement
PapeX Receipt Delivery Hardware (RDH)
For presentation during PCI DSS compliance reviews and assessments.
Purpose of This Document
This document is provided by PapeX, Inc. to merchants who have installed the PapeX Receipt Delivery Hardware (RDH) at their point of sale. It is intended to be presented to Qualified Security Assessors (QSAs), Internal Security Assessors (ISAs), or any party conducting a PCI DSS compliance review of the merchant’s environment.
This statement explains what the RDH device is, how it connects to the merchant’s POS system, what data it handles, and why it falls outside the merchant’s Cardholder Data Environment (CDE) and PCI DSS scope.
What Is the PapeX RDH?
The PapeX Receipt Delivery Hardware is a peripheral module that connects to a merchant’s POS system via a standard peripheral port (USB, RS-232 serial, or Ethernet). It serves one function: capturing the receipt print data stream and delivering it digitally to the customer via NFC tap.
The RDH is installed in one of two configurations:
- Printer Replacement: The RDH replaces the existing receipt printer and connects to the same peripheral port the printer previously occupied.
- Inline Extension: The RDH is placed between the POS terminal’s print output and the existing receipt printer (POS → RDH → Printer). The printer continues to function normally.
Device Technical Specifications
| Device Name | PapeX Receipt Delivery Hardware (RDH) |
|---|---|
| Manufacturer | PapeX, Inc. |
| Connection Interface | USB, RS-232 Serial, or Ethernet (standard POS peripheral ports) |
| Data Received | Receipt print data stream (ESC/POS or equivalent print commands) |
| Data Output | Digital receipt delivered to consumer device via NFC |
| Cardholder Data Stored | None |
| Cardholder Data Processed | None |
| Cardholder Data Transmitted | None |
| PAN Handling | Device receives only masked/truncated PAN (last 4 digits) as printed on standard receipts per card network rules |
| PIN / CVV / Track Data | Never received, stored, or transmitted |
| Terminal Modification Required | None. No seals broken, no enclosure opened, no firmware altered. |
| Network Connectivity | The RDH connects to the consumer's mobile device via NFC. It does not connect to the merchant's payment processing network. |
PCI DSS Scope Analysis
Under PCI DSS v4.0.1, a system component is in scope for PCI DSS if it stores, processes, or transmits cardholder data (CHD) or sensitive authentication data (SAD), or if it is connected to or could affect the security of the Cardholder Data Environment (CDE).
The RDH does not store, process, or transmit CHD or SAD.
The RDH receives only the receipt print data stream. Per card network operating regulations (Visa, Mastercard, American Express, Discover), printed receipts must not contain the full PAN. Receipts display only the last four digits of the card number, the card brand, and the transaction amount. The RDH never receives, and has no mechanism to receive, full PAN, CVV/CVC, PIN, or magnetic stripe/chip track data.
The RDH does not connect to the CDE network.
The RDH connects to the POS system solely through a peripheral print port (USB, serial, or Ethernet for print traffic). It does not connect to the merchant’s LAN, payment gateway, or any network segment that carries cardholder data. Its only wireless communication is outbound NFC to the customer’s mobile device at the point of tap.
The RDH does not modify the payment terminal.
Installation does not require opening the payment terminal enclosure, breaking tamper-evident seals, altering firmware, or modifying any Point of Interaction (POI) device. The RDH connects to the same external port that any receipt printer or POS peripheral would use. PCI DSS Requirement 9.5 (protection of POI devices from tampering and unauthorized substitution) is not implicated because the payment terminal is not altered.
Device Classification
The PapeX RDH is classified as a POS Peripheral Device: a device adding functionality to a POS system (comparable to a receipt printer, barcode scanner, cash drawer, or customer-facing display) that connects via standard peripheral interfaces and does not interact with cardholder data or sensitive authentication data.
As a peripheral that does not store, process, or transmit CHD/SAD, and does not connect to or impact the security of the CDE, the PapeX RDH is out of scope for PCI DSS assessment of the merchant’s environment.
Guidance for Assessors
During a PCI DSS assessment or inspection, assessors may verify the following about the PapeX RDH installation:
- The device connects to the POS system via a standard peripheral port only (USB, serial, or Ethernet for print traffic).
- The device does not connect to the merchant's LAN, Wi-Fi, or any network segment carrying payment traffic.
- The payment terminal's tamper-evident seals, screws, and enclosure are intact and unmodified.
- The device is clearly labeled as 'PapeX Digital Receipt Module' or equivalent.
- The device does not have any card-reading capability (no magnetic stripe reader, chip reader, or contactless payment reader).
- The only wireless output is NFC to deliver the digital receipt to a customer's mobile device.
Contact Information
For questions about this document or the PapeX RDH, please contact:
Merchants: for device help, status light meanings, and troubleshooting, visit papex.app/support.