PapeX, Inc. — Card-data scope
PCI DSS Scoping Statement
PapeX Receipt Delivery Hardware (RDH)
For presentation during PCI DSS compliance reviews and assessments.
Purpose of This Document
This document is provided by PapeX, Inc. to merchants who have installed the PapeX Receipt Delivery Hardware (RDH) at their point of sale. It is intended to be presented to Qualified Security Assessors (QSAs), Internal Security Assessors (ISAs), or any party conducting a PCI DSS compliance review of the merchant’s environment.
This statement explains what the RDH device is, how it connects to the merchant’s POS system and network, what data it handles, and how it should be treated when the merchant’s Cardholder Data Environment (CDE) and PCI DSS scope are determined.
What Is the PapeX RDH?
The PapeX Receipt Delivery Hardware is a peripheral module that connects to a merchant’s POS system the same way a receipt printer does (USB, or network printing over the merchant’s Wi-Fi). It serves one function: capturing the receipt print data stream, uploading it to PapeX over HTTPS, and letting the customer retrieve it with an NFC tap.
The RDH is installed in one of two configurations:
- Printer Replacement: The RDH replaces the existing receipt printer and connects to the same peripheral port the printer previously occupied.
- Parallel Install: The RDH is installed alongside the existing receipt printer as an additional peripheral. The existing printer keeps its own direct connection to the POS and continues to function normally. The RDH is not placed in the cable path between the POS terminal and the printer or any other device.
In both configurations the RDH joins the merchant’s local Wi-Fi network. It uses that connection to send completed receipt records and device health diagnostics to PapeX (api.papex.app) over outbound HTTPS. Where the POS prints to the RDH over the network rather than USB, it also uses that connection to receive the receipt print data stream on TCP port 9100 (printer status on 9101), so the RDH must be reachable on the same network as the POS system that sends it print jobs.
Device Technical Specifications
| Device Name | PapeX Receipt Delivery Hardware (RDH) |
|---|---|
| Manufacturer | PapeX, Inc. |
| Connection Interface | Connects to the POS as a receipt printer: USB, or network printing over the merchant's Wi-Fi (raw ESC/POS on TCP port 9100, printer status on TCP port 9101) |
| Data Received | Receipt print data stream (ESC/POS or equivalent print commands) |
| Data Output | Receipt print data uploaded to PapeX servers (api.papex.app) over HTTPS; the customer retrieves the digital receipt by tapping their phone to the device (NFC) |
| Cardholder Data Stored | None |
| Cardholder Data Processed | None |
| Cardholder Data Transmitted | None |
| PAN Handling | Device receives only masked/truncated PAN (last 4 digits) as printed on standard receipts per card network rules |
| PIN / CVV / Track Data | Never received, stored, or transmitted |
| Terminal Modification Required | None. No seals broken, no enclosure opened, no firmware altered. |
| Network Connectivity | Wi-Fi (2.4 GHz) on a network provided by the merchant. Outbound traffic is HTTPS to api.papex.app only, limited to receipt records and device health diagnostics. In network-print mode the RDH must be reachable from the POS on TCP ports 9100/9101. NFC for customer receipt pickup. It does not connect to the payment terminal, payment gateway, or processor, and does not carry payment traffic. |
PCI DSS Scope Analysis
Under PCI DSS v4.0.1, a system component is in scope for PCI DSS if it stores, processes, or transmits cardholder data (CHD) or sensitive authentication data (SAD), or if it is connected to or could affect the security of the Cardholder Data Environment (CDE).
The RDH does not store, process, or transmit CHD or SAD.
The RDH receives only the receipt print data stream. Per card network operating regulations (Visa, Mastercard, American Express, Discover), printed receipts must not contain the full PAN. Receipts display only the last four digits of the card number, the card brand, and the transaction amount. The RDH never receives, and has no mechanism to receive, full PAN, CVV/CVC, PIN, or magnetic stripe/chip track data.
The RDH connects to the merchant’s local network.
The RDH is not an isolated device. It joins the merchant’s Wi-Fi and, in network-print mode, must be reachable from the POS system in order to receive print jobs. Where the merchant’s POS network is part of, or connected to, the Cardholder Data Environment, the RDH should be treated as a connected-to system component and assessed accordingly. PapeX does not represent that the RDH is network-isolated. What the RDH does not do is store, process, or transmit cardholder data: the only payload it receives is the receipt print stream described above, and the only data it sends to PapeX is that receipt record and device health diagnostics. Where a merchant places the RDH on a network segment separated from the payment environment, and that segmentation is validated, the RDH falls outside the assessed scope on the same basis as any other segmented system.
The RDH does not modify the payment terminal.
Installation does not require opening the payment terminal enclosure, breaking tamper-evident seals, altering firmware, or modifying any Point of Interaction (POI) device. The RDH connects to the same external port that any receipt printer or POS peripheral would use. PCI DSS Requirement 9.5 (protection of POI devices from tampering and unauthorized substitution) is not implicated because the payment terminal is not altered.
Device Classification
The PapeX RDH is classified as a POS Peripheral Device: a device adding functionality to a POS system (comparable to a receipt printer, barcode scanner, cash drawer, or customer-facing display) that connects via standard peripheral interfaces and does not interact with cardholder data or sensitive authentication data.
The RDH does not store, process, or transmit cardholder data or sensitive authentication data, and it is not part of the Cardholder Data Environment. It is not a Point of Interaction device and has no card-reading capability. Because the RDH connects to the merchant’s local network, whether it falls inside the assessed scope as a connected-to system depends on that merchant’s network segmentation, and is a determination for the merchant and their assessor. This document is provided to give that assessment the technical facts it requires.
Guidance for Assessors
During a PCI DSS assessment or inspection, assessors may verify the following about the PapeX RDH installation:
- The device receives only receipt print data (ESC/POS or equivalent print commands) and has no mechanism to receive full PAN, CVV/CVC, PIN, or track data.
- The device connects to the POS system only as a receipt printer would: by USB, or as a network printer on TCP port 9100 (status on 9101).
- The device connects to the merchant's local Wi-Fi network. Its only internet connection is outbound HTTPS to api.papex.app, carrying receipt records and device health diagnostics. Inbound access is limited to print traffic from the POS (TCP 9100/9101).
- Where the RDH is treated as outside the assessed scope, the Wi-Fi network it joins is segmented from any network segment carrying payment traffic, and that segmentation is validated.
- The payment terminal's tamper-evident seals, screws, and enclosure are intact and unmodified.
- The device is clearly labeled as 'PapeX Digital Receipt Module' or equivalent.
- The device does not have any card-reading capability (no magnetic stripe reader, chip reader, or contactless payment reader).
- The device's wireless interfaces are Wi-Fi (receipt upload to PapeX, and print jobs in network-print mode) and NFC. The only wireless output to a customer is NFC, used to deliver the receipt link to the customer's mobile device.
- The device is not interposed in the cable path between the payment terminal and any other device. In a parallel installation, the existing receipt printer retains its own direct connection to the POS.
Contact Information
For questions about this document or the PapeX RDH, please contact:
Merchants: for device help, status light meanings, and troubleshooting, visit papex.app/support.
PapeX, Inc. — Provided to merchants for their PCI DSS review.