Poynt – Smart payment terminal

http://www.getpoynt.com/

by valanto • 12 years ago

128 72 12 years ago

glifchits• 12 years ago

It seems like a good time for this product. Payments feel like the wild west right now. A reader that can potentially handle all protocols is a safe investment in the future.

freehunter• 12 years ago

Poynt already exists. Can I use Poynt to find retailers who are using Poynt?

https://play.google.com/store/apps/details?id=com.poynt.andr...

ppalavilli5• 12 years ago

Hi - they are not related to each other in any way. Poynt.co or GetPoynt.com is the new Smart Payment Terminal that was announced today.

https://getpoynt.com/about

Plough_Jogger• 12 years ago

No wifi?

el_benhameen• 12 years ago

https://getpoynt.com/specs

Yes wifi.

ents• 12 years ago

Go to the 19th second of the video.

deweller• 12 years ago

Apple Pay is supported.

Does the Smart Terminal accept payments by Apple Pay?
Yes, the terminal accepts Apple Pay since the iPhone securely communicates with the terminal through NFC. We here at Poynt made our first Apple Pay payment with our Smart Terminal on the morning the software was released to the world. It was a very exciting moment for us!

johladam• 12 years ago

If someone from Poynt is on, what are the features that make this better than competing products? I've used Shopify for doing some PoS setups, but I'm having a hard time looking at where Poynt fits in. Other than being cheaper, it lacks some of the things that make Shopify great, namely cash handling and connecting to a back office system.

ppalavilli5• 12 years ago

Hi, I work for Poynt on the PoyntOS and applications. First thing first, Poynt Smart Terminal is a Secure Payment Terminal at the core that provides credit card payment processing functionality to any merchant that needs to accept payments in their stores. This is analogous to the traditional payment terminals that you might probably notice every day at a lot of merchant stores (cafes, salons, grocery stores, etc.). Poynt Smart Terminal enhances the credit card payment processing functionality by supporting more payment methods (MSR/NFC/EMV/QR Code/etc.) so the merchant doesn't need to worry about carrying multiple devices in the store and be able to serve more customers. In addition to that, Poynt Smart Terminal runs on Secure PoyntOS (powered by Android) to provide an application platform and framework for developers to build apps and solutions for the merchants and distribute through Poynt. Developers can take advantage of the PoyntOS to build unified solutions for the merchants that run on the same device where they are used to process payments (unlike various solutions today in the market that require additional hardware like ipads, dongles, etc.). Shopify is an online platform that allows developers to build solutions for their merchants hosted online or on devices. Now with Poynt Smart Terminal, developers can build PoS apps using Shopify platform that run on Poynt Smart Terminal too. So I would probably say they are complementary, not competing.

Cheers!

johns• 12 years ago

Congrats on the launch and new gig! You should update your HN bio ;)

mrmch• 12 years ago

Should definitely highlight (at least to the HN crowd) that this is an Android device and you're exposing some APIs that can be built on. This is really cool.

mpalmer• 12 years ago

I do not work for Poynt, but it seems more like they've forked Android and created a hardware/payment platform for different POS solutions - note that they've already partnered with Vend and Intuit, and offer an SDK out of the gate.

flashahhahh• 12 years ago

From my prospective a competing product does not exist that fits into the targeted market. Price point, simple integration, agnostic platform... we use a blend of Vend (Brick) & Shopify (Online) and the transition to integrate something like this is simple, straightforward and cheap.

Traditional carriers like Verifone or NCR, your costs are high (typically for enterprise) and implementation is anything but straightforward.

What other payment product that is not a dongle solves these varied payment problems for hosted solutions like vend, lightspeed, shopkeep, etc and is plug and play?

ctz• 12 years ago

This is the first EMV payments terminal I've seen that allows PIN entry using a touch screen. Is that really allowed by EMV, as a tamper-evident PIN pad?

caissy• 12 years ago

I've seen a few merchants using a touch screen, including a few Gap stores in Montreal.

notatoad2• 12 years ago

Yeah, the touchscreen terminal that GAP uses is pretty common. Canada Post uses it too, and i know i've seen it in some other places.

robbiet480• 12 years ago

Best Buy has PIN entry via touch screen

Pushpak• 12 years ago

Exactly what i was wondering. RBI (Reserve Bank of india) does not allow entering PIN's on touch screen. Infact they (RBI) go to such a length that a card processing terminal should be ONLY just the terminal and the hardware should be approved by the RBI which might take months.

polemic• 12 years ago

Pretty common here (New Zealand).

ThrustVectoring2• 12 years ago

The requirements are that the consumer must have some way of concealing pin entry. That, and some stuff about how hitting different numbers can't make a different sound, or have easily picked-up electrical signatures, etc. I believe the EMV specs are publicly available, too.

Tamper-evident is likely baked into the device, instead. Make a circuit that trips when you open the thing up, wire that up to wipe the keys and brick the device until it goes back to factory.

tylercubell• 12 years ago

What's to stop somebody from stealing this right off the counter and gaining access to customers' data?

efiftythree3• 12 years ago

Most places I've traveled to outside of the US have devices similar to this that staff carry around a restaurant to complete the payment process table side. They've all been PIN+Chip devices as well.

Aside from that one would hope that they aren't storing PII or financial data on the device itself.

iancarroll• 12 years ago

You can do the same thing with, well, any credit card machine... Go into any SMB and there's a good chance the credit card reader is independent of the POS system.

rtanaka8• 12 years ago

A very valid concern.

To begin with, while our terminal is Android based we have taken numerous steps to lock this device down. Side loading apks is not possible nor is arbitrary access via adb. On top of that, we take great lengths to protect consumer data. In addition to full PCI compliance data is fully encrypted on the device. And if that's not enough, there are several anti-tamper mechanisms that will trigger and lock down the device even further upon physical instrusion.

In terms of physical theft we are actively looking into an option to physically secure the device (think kensington). Our plan is to have a good solution for this before our merchants go live.

luisbebop4• 12 years ago

You are not PA-DSS or PCI certified. Where are the links to your letters of approval?

efiftythree3• 12 years ago

Assuming that someone managed to not only walk off with the device from a retailer but were also able to gain access to the device itself. What kind of data could be harvested from the device?

bravo227• 12 years ago

Well, here is my big question: WHY ARE YOU STORING CARD DATA AT ALL? (sorry for the caps). You are a pass-through entity, merchant terminals do not store card data. They keep the authorization number from upstream provider to allow void/refunds but there is no need for them to store the number.

With respect to anti-tamper mechanism, are you FIPS-140-2 certified or plan to be?

tubbs• 12 years ago

I was wondering this too. Somebody could swipe the system straight from the counter and cripple sales for a while. Surprised to not see a Kensington lock on there.

cbhl3• 12 years ago

I'm unable to watch the video from my Android phone.

fenguin• 12 years ago

Hi, thanks for letting us know -- are you still having problems? We enabled the embedded video on mobile devices a little while ago.

cbhl3• 12 years ago

It works fine when I open the page with my phone held vertically. When I hold the phone horizontally the button doesn't seem to work though.

Opening the video with the phone held vertically and then rotating the phone once the video loads works fine, however.

cbhl3• 12 years ago

One of my concerns is that it appears the door to change the receipt roll is on the bottom of the device. Does this mean I have to shut the device off and flip it over if it runs out of receipt paper to print a receipt for a customer?

ppalavilli5• 12 years ago

it's actually in the front of the device as you see on the website (https://getpoynt.com/) and the button to open the printer door is on the side. The door opens forward and you can load the paper from the front (no need to turn it upside down). We will try to post videos of the paper loading as soon as we can.

rtanaka8• 12 years ago

poynt employee here. you can open the device and insert a new roll of paper without flipping it over or turning off the device.

headgasket3• 12 years ago

Anything to keep the mass from ditching the plastic, cause when that happens, VISA, MC and co are in jeopardy.

saosebastiao2• 12 years ago

The credit card processors do far more than just issue magic pieces of plastic. The plastic itself is probably the least significant aspect of their business model.

headgasket3• 12 years ago

The business model relies on a monopoly, an information monopoly. If the mass's interaction at POS is with a software or a hardware that potentially allows id-ing the patron, preferential pricing becomes possible, security is anon issue -- it seriously damages the value of the middleman.

So that the secure element(yeah right) that's on your plastic or your phone only communicates with OSes and HW that limits the ID-ing of the cx and provides the strict minimum of info to your POS is the critical part, in my view.

otuutti• 12 years ago

fwiw Visa and MC have both been interested/open in discussions with us and our product is doing exactly that (removing the plastic).

bravo227• 12 years ago

Interesting merchant terminal -- but it seems to be little more than a pretty rendering and physical mock-up right now.

I like how the first guy puts his card in, takes it out AND THEN punches in his PIN, which is exactly how PIN & Chip doesn't work. I would have hoped they'd at least be familiar with the process.

It looks to me like a mobile computer strapped to a terminal. I'm not sure why this is better than having a terminal + iPad or something similar but I'm not the target demographic.

I see many other issues with it:

- Hardware development is hard and long. This looks to be little more than a physical mock-up. For example datasheet lists "Ethernet" is connectivity options but there is no ethernet port visible on the body.

- BLE & GSM antennas are exactly where you wouldn't put either of those. Here is tip: You can't put an antenna behind an LCD. They have metal backings.

- Shouldn't QR & Barcode Scanner be pointing UP? You have very limited field of view when it is pointing down.

- Getting EMV and FIPS certified are going to take a long long time. Granted they could buy that firmware off the shelf to accelerate the process.

Siecje• 12 years ago

Some ATMs require you to take your card out before entering your PIN. Or are they using the magnetic strip?

toomuchtodo• 12 years ago

They're caching the magnetic strip data.

pbreit• 12 years ago

In the USA you always key in the PIN after swiping/inserting/removing the card.

bravo227• 12 years ago

If you are using magnetic strip you're correct. For PIN & chip the PIN is sent to the card and verified by the card and the resulting "signature" is sent to the bank. The card has to be in for PIN entry.

An employee, above, said that it is for entering tip. Which would make more sense, but then the card would have to be inserted after the total amount I imagine but I can see how they would have a slightly different flow. Personally, I would want any terminal that I use to show me the final amount that I am going to pay before I put in my card. Lest I pay, walk away and the cashier adds her own tip.

rtanaka8• 12 years ago

Okay, I'll bite. I'm an employee so you'll have to take what I say with a grain of salt.

The video was produced with a cosmetic device and with actors. You're right that the card has to be in the device during PIN entry. The scene you're referring to, however, is depicting tip entry.

The device does not have an ethernet port but we will be shipping with a separate charging dock that will provide wired connectivity.

I can assure you that all of our antennas are not behind LCDs. While compact, the device does have a number of non-LCD surfaces.

The customer facing camera is pointing horizontal. We'll continue to refine the angle (if needed) as we continue testing with our early adopters.

We did in-person demos with over a dozen news agencies. If you have any doubts about the existence of the device, please feel free to reach out to them for confirmation.

bravo227• 12 years ago

I appreciate you posting!

I am not doubting that you are building the product.

You/The company should probably put more effort in correcting the datasheet and the information you put out there. We can only judge by what is being presented. Your datasheet says Ethernet. It doesn't say Ethernet would be on a separate dock. It probably should.

If you are placing the antennas behind plastic surfaces, that is great. You should correct the diagrams.

Further to your point about tip entry, tip should be entered before the transaction is authorized right? So one would assume you'd enter tip then put in the card, and optionally enter a PIN or sign the screen.

I can appreciate that it may be just a video demo, but when you post it to a place like YN people are going to point out errors. Funny enough, that error was pointed out by a friend who was watching over my shoulder. She is not a technical person in any way and it jumped out at her.

BillinghamJ• 12 years ago

The expected way to handle Chip + PIN transactions is that the final price is set before you enter your PIN. It is never changed after you put the PIN in - because at that point, it becomes a card-not-present transaction.

sitnik• 12 years ago

Looks cool to me.

luisbebop4• 12 years ago

This device is insecure. It is going to take a long time to get the PCI/EMV certifications. Besides that how do you handle the certification of new applications running side by side with your payment application? Everytime you deploy a new application you should re certificate the entire stack, by the PCI standards. Nice concept, but you have a long road ahead before competing with VeriFone, Ingenico, PAX, Miura shuttle and others.

ppalavilli5• 12 years ago

Hi - I work for Poynt on the PoyntOS and Payment interfaces - so maybe I can provide some clarity without going into too much of our IP. As mentioned on our site (https://getpoynt.com/specs), we have two separate subsystems - one for Android and the other for secure payment processing.

All the payments (EMV/NFC/MSR), secure key (including acquirer keys) management, P2PE encryption, EMV/PCI, etc. are handled by the secure processor. There are no other applications that can run on this secure processor other than the signed and certified applications.

On the Android side, Poynt's Secure service is the only service that's capable of communicating with the Payment Processor to initiate card reading (EMV/NFC/MSR/others) and pass through the encrypted data it receives to the merchant's acquirer. All the 3rd party applications run independent of the Poynt's Secure Service and when they need to collect a payment, they do so through our Poynt Payment Fragments to facilitate the Payment flows. (See here for information on how it works: https://getpoynt.com/developers/terminal#2.3 Poynt Payment Fragments).

So as you can see, we are able to keep the security domains separate and thereby able to handle PCI certification in a much more graceful way. Obviously they are some complexities but choosing a certifiable payment processor board was one of many ways we are able to deliver a secure solution.

Cheers!

notatoad2• 12 years ago

How are you securing the PIN entry? It looks like that happens on the same screen as the random 3rd-party apps get to run on, leaving open the potential for an app to intercept the PIN. As i understand the PCI stuff, anything that the PIN hits is fully in-scope.

Dwolb• 12 years ago

Are any team members from automotive? This sounds similar to automotive head unit designs. Consumer-facing processor + OS and secure processor (or core) with separate OS.

I'm nervous about the Android part of this product. I've seen some poor implementations of devices that want to use Android because it's 'easy' to get a lot of features up and running but then struggle with the quality of the middleware layers or Android-specific UI patterns that they try to strip out.

Otherwise, I think the dual screen and industrial design looks good! I hope the LCD looks as good as the renderings.

bravo227• 12 years ago

Interesting to see Osama Bedier listed as one of the people. He is the guy who ran PayPal's merchant terminal integration efforts, left for Google Wallet, and then left Wallet.

I think there was a lawsuit filed against him and Google by PayPal the day of Wallet's launch, claiming Google stole their secrets. No idea how that turned out; though I imagine it was a PR move on PayPal's part.

Mikeb85• 12 years ago

And here I thought the other Poynt was pivoting or reinventing itself. http://www.poynt.com/

Probably not the best idea to launch with a name identical to another start-up that also has apps on all major platforms...

tomheg• 12 years ago

Is Poynt classified as a 'handheld' terminal to address the privacy shield requirement in PCI PTS?

shayanbahal• 12 years ago

I would love to have one to code a nice bitcoin payment gateway on it :) anyone interested to collaborate?

fayez3• 12 years ago

If you decide to build something on our platform, please fill out the form at http://goo.gl/forms/dgwMwDysAv to start a conversation with us. Good luck!

Poynt – Smart payment terminal

Related Stories