Secrets Retention Service
As of 1 November 2012, VASCO changes its policy regarding the storage of the DIGIPASS seacrets that are embedded inside our products. The new policy states that DIGIPASS secrets will be destroyed by VASCO, unless the customer opts for the DIGIPASS Secrets Retention service. This Service is provided for a certain fee and is currently only available for banking customers.
What Are DIGIPASS Secrets?
The security of VASCO’s DIGIPASS products relies on so-called DIGIPASS secrets. These are cryptographic keys that are used to generate and verify one-time passwords and electronic signatures. The DIGIPASS secrets are usually embedded in the client-side products when VASCO delivers them to the customer. They are provided to the server-side via file formats, such as DPX and PSKC.
DIGIPASS Secret Retention Service
VASCO offers a Secrets Retention Service for each order placed. This paid service entails that VASCO will destroy the DIGIPASS secrets of its customers after delivery of the order. Only if explicitly asked, will VASCO store DIGIPASS secrets. Once DIGIPASS secrets of a certain order have been destroyed, they cannot be redelivered. The service currently applies to all DIGIPASS hardware devices (excluding card readers, DIGIPASS KEY PKI devices and DIGIPASS Nano). The storage and retention service for VASCO’s software devices will become available in 2013. The DIGIPASS Secrets Retention Service is currently only offered to financial institutions. The service will be extended to all VASCO customers in the future.
You can ensure that DIGIPASS secrets of a certain order are retained by closing a DIGIPASS Secrets Retention Contract for the defined order. You can choose between different storage and retention periods ranging from 2 to 5 years. If you do not order the DIGIPASS Secret Retention service, VASCO will by default destroy the DIGIPASS secrets of an order 6 months after generation of the DPX or PSKC files.
Renewal of the Retention Service Contract
When the DIGIPASS Secrets Retention contract is about to expire, VASCO will inform you 3 months and 1 month prior to the expiration of the contract. You then have the option to renew the contract should you wish to do so. Possible retention periods from which you can choose are the same as for a new contract. The new contract becomes effective upon termination of the previous contract.
To sign up for this service or to get pricing, please contact your VASCO Sales Manager.