Overview The Business Control platform by Verestro enables digital card issuing and expense management for modern companies. By adapting to the changing needs of the current small, medium companies and big corporations and business customers digital, Business Controls enables companies to create and deliver instantly a temporary business Mastercard card to employee, simplify invoice collections and settlements of expenses.  If you are a bank or fintech you can offer a new product for your business customers and increase revenues. The platform consists of web portal and mobile application or SDK. The simplest white label solution can be delivered in 3 months from start of the project.  Purpose and scope This product guide provides a high-level overview of Business Control. This document covers the following topics: •    description of possible configurations,  •    granting access,  •    description of main processes as: login, reset password, cards import, redemption of card, •    additional and optional functionalities. Terminology This section explains a number of key terms used in this document. Name Description Operator/portal user The user working using web portal. End-user/mobile user A corporate employee who received a card and uses a mobile app. Payment history It’s possible that transaction history will be stored on Verestro wallet server for infinite time (this setting can be specified during onboarding with Mastercard). If these options are enabled, MPA can retrieve transaction history for given card and payment instrument ID. Transactions are returned in corresponding parts for better user experience. Particular transaction may appear on the list with delay – depending on integrated external components. Session token Access to the system by a application user is secured using a session token to uniquely associate the session with the user. It is required to perform any action. sFPANs (Subordinate Funding Pan) Valid card numbers supplied by the Issuer. All payment messages will be delivered to the Issuer with this card number in Data Element 02. Funding Card Alias A name given to the ultimate funding account to which payments will flow. This name is assigned by the Issuer and should be recognisable to the Corporate who owns the account. E.g. “JoeCorp HR USDollar”. CSV Comma Separated Values. Digital Tokens This is the surrogate card number that is inserted into the NFC chip in the Mobile phone. For tap payments, this is the number shared with the Point of sale device. On all message flows; it is mapped by Mastercard to its parent sFPAN. The Issuer will then map the sFPAN to the Funding Account. Virtual Card This is the optional card number for eCommerce payments - number entered at the eCommerce checkout page. On all message flows; it is mapped by Mastercard to its parent sFPAN. The Issuer will then map the sFPAN to the Funding Account. Approval In the context of Business Control, this is the assignment of a specific card for a certain period of time to a defined user. Reapproval By reapproval is meant the process of changing the data of a specific card assignment. Limits or date range can be changed. Mobile reapproval The process of changing a specific assignment initiated by the end user - which means through the use of a mobile application. Group limit This limit determines the maximum amount with which anyone in the group can assign a card to a user and the maximum amount on a card that can be accepted in a given group if an assignment confirmation request comes in from a group with a lower limit. Key Use Cases Below we present a list of key use cases enabled on Business Control platform. We are constantly working on new functionalities that are adding value to the product: issue virtual card for employee, setup card limits (time, date, transaction limits etc.), manage groups in companies (departments or teams), scan invoices, present reports for accounting purposes, and many more. Security   The systems offered by Verestro are fully secure, which is confirmed by current third-party certificates. As we store card and payment data we are obliged to comply with strict legal requirements. Card data are stored in a specially designed environment - Data Core. This environment is PCI DSS certified. The PCI-DSS standard guarantees the security of payment card data. It ensures that sensitive information is properly guarded and provides maximum security in the payment process. We achieve high security standards by, among other things : 1.    Building and maintaining network security - the need to build and maintain a firewall configuration that protects cardholder data, not using manufacturers' default passwords and settings. 2.    Protecting cardholder data - protecting stored cardholder data, encrypting data transmissions when using public networks. 3.    Maintaining a payment management program - using regularly updated anti-virus systems, developing secure systems and applications. 4.    Implementing strong access control methods - limiting access to cardholder data to only those with a business need, assigning each user a unique ID, limiting physical access to cardholder data. 5.    Regular network monitoring and testing - testing security systems and processes, controlling access to network resources and cardholder data. 6.    Maintaining information security policies - relying on security policies for employees and vendors. Architecture Business Control uses Verestro's distributed systems to provide the highest quality of service. It is practically the best architectural solution these days. As mentioned in the previous chapter, the communication between services is completely secure, maintaining the highest security standards. This kind of system guarantees not only high efficiency, due to the division of responsibilities between the components, but also allows for easy and fast scaling of the system according to the customer's requirements. Acc ess and Configuration Access solutions The access to Admin Portal in available in 3 ways: direct traffic through VPN - requires VPN reconfiguration on both sides, block access to the domain and allow access from a particular IP address (specific IP addresses or a range of addresses) - configuration required on Verestro side, free access for everyone, who have an account in Admin Portal (no matter if VPN configuration or IP address are set. Admin Portal is available on two environments: test environment (dev/UAT environment), production environment. Sample of test environment (URL):  https://corporate-panel-nameofclient.verestro.dev/ Sample of production environment (URL): https:// corporate-panel-nameofclient.verestro.com/ Configuration  Time settings for individual functionalities Business Control has a several default parameters related to the time of each action. Table below describes particular action and time related to the action.  Functionality Description Default time on beta environment Default  time on production environment Operator session time. Session after successful login to the panel. 60 minutes 15 minutes Session reminder popup. Time after which a popup appears asking to extend or end the session. 55 minutes 10 minutes Mobile session time. Session after successful login to the beta mobile application. 15 minutes 15 minutes SMS lock time. Determines the time after sms count will be erased and sms resend will be available. 24h 24h Reset password OTP. Validity of OTP during password reset process. 900s 900s Automatic job configuration of Business Control Functionality Description Default start time Expiring outdated approvals. The time when cards whose assignment has expired are removed from enduser. Every full hour Generating transaction reports. Time when mechanism of generating reports for pending reports is starting. Every 15th minute Requirements for password Functionality Description Mobile password length. 8-250 chars. Portal password length. 8-30 chars. Password (both mobile & portal) requirements  . upper-case letter, lower-case letter, special character and digit. Mobile apps configuration Completion of product configuration (T&C regulations, imported cards, created limits and user structures) is required to test mobile applications. For beta environment testing, it is necessary to provide the project manager with information about the type of device and the data for which test cards are to be assigned. This is related to separate app delivery solutions for each platform. In the case of a production environment, the application is provided by authorized and official application stores dedicated to that environment. Beta environment In the initial stages of the project, the mobile application can be delivered as an APK file to be installed manually on the device. It is also possible to set up an automatic distribution center for test versions, in which case it is enough to provide Verestro with a list of email addresses to which invitations to the test system will be sent. Each user will receive an individual registration link and AppTester software (a fully secure component of the Google Firebase system) or TestFlight software (Apple's standard way to distribute test applications that meet the latest functional and security requirements). Both of the distribution ways allow to download each version of the application and deliver new versions in real time to testers. Production environment Once the testing phase is complete, Verestro generates applications that must be signed with the appropriate set of keys and then, using procedures appropriate to the specific distribution site (Apple AppStore or Google Play), added to the app stores. Once the application is in the store, any user can easily and quickly install the application and update it automatically. Roles in the System Issuer Administrator Created in the new Issuer setup process after legal and contractual issues are completed. Associated with the flow of configuring corporations related to the Issuer. Could see the corporations associated in the system and their cards along with limits. Corporate level The following section provides information about the actions that vary according to the level of authority in the corporate structure and key capabilities common to the roles contained in the corporation. Functionality Corporate Administrator Corporate Manager Accountant Add new corporate operator (administrator, manager, user). Yes X X Create new group. Yes X X View all groups. Yes Yes X View own group and groups below, view group members. Yes Yes X Reset password group members. Yes X X View, lock/unlock, remove from the EndUser, assigned cards from own and group below. Yes Yes X Assign cards. Yes Yes X View approvals history from own group or group below. Yes Yes Yes View awaiting card assignment from group below. Yes Yes Yes Accept/decline approval from group below. Yes Yes X Edit existing approval from own group. Yes Yes X View all assigned cards and approvals. Yes Yes X View assigned cards and approvals for own group and groups below. Yes Yes Yes As may be seen from the table above, the main differences between admin and manager concern adding new operators to the corporation. In contrast, the context of a user is usually narrowed down to its own group or actions directly related to particular user-level operator. The manager and user roles are fully configurable. It can contain decreasing privileges in comparison to Admin or completely different functionalities. Corporate Administrator This is a role that guarantees full authority in the corporate context. It has access to manage the hierarchy of groups and portal operators. Corporate Administrator has a privilege to assign cards and has access to all the details of the corporation. Corporate Manager The role of manager in a corporation almost exactly matches with the administrator's capabilities. The difference is the inability to add new portal users and manage groups. Accountant The basic role in the corporation, should be assigned to a lower level user. Capabilities are limited to displaying cards from their own group and below and transactions. That means Accountant cannot view approvals from groups higher in the hierarchy and group section. Mobile user - Enduser Flow of creating the mobile user account doesn’t depends on portal. End-user could install application and register without any invitation. Until the card is received from the system, it can use the mobile application capabilities. Only the assignment of the card binds him strongly to the system. Importantly, the code necessary to assign the card is sent to the phone number and e-mail address given by the portal operator on the assignment form, but the end user can redeem the code on any account (so on an account registered with different data than the one provided in the form). In such case it is required to provide the OTP code sent to the number from the form. As a result, the user can use one account for both private and corporate cards (but the authentication sent to the corporate data is required). Notifications This section contains all push messages and email messages that are sent in the system. The following breakdown was used: emails regarding the basic functionality of the portal and sent to the operator, emails concerning the business processes of the product and sent to the operator, emails regarding the product's business processes and sent from the end-user, push notifications sent to the end-user. Emails from Admin Panel to operator Process Topic Details Comment Invitation to the system Set password to administration panel Hello! You are receiving this e-mail because an account was created for you, and you need to set a new password.