ParentPay NRS/Civica TLS

[PureMatt]

Hi All,

 

Apologies if this isn't the right forum, i wasn't sure what it fitted into and after some searching a lot of parentpay stuff was here.

 

So we use parentpay and NRS (now Civica)

 

NRS/Civica sent out this email, stating we must update our server as TLS 1.0 / 1.1 is soon to be discontinued by parentpay.

 

[TABLE=width: 100%, align: center]

[TR]

[TD]"Reminder: action required to continue to accept ParentPay payments

[/TD]

[/TR]

[TR]

[TD]

Unless important changes are made to your cashless catering system (formerly NRS Trust-e), as of 30th October 2019 your ParentPay payments will no longer be processed into the system."

So I contacted NRS to arrange this upgrade, on the phone it sounded like everything would be fine, they just needed teamviweer access to the server, upon giving them the access, they then reply with this email:

 

"

Thankyou for your time earlier.

 

We have been advised by your 3rd Party provider, ParentPay, who as a payment service provider are required to be PCI complaint and their systems have to meet rigorous security controls. As a result of their recent audit it has been identified that your method of communication needs updating to our newer Sync2 software in order to maintain service.

 

See below quote for the installation to be completed remotely.

 

Sync 2 - £295 + VAT

 

To schedule this in, please could you forward a Purchase Order for the above amount, quoting reference 682053 and we will be able to book this in.

 

This work is not covered under Civica maintenance as the current communication method, Sync1, is unchanged and remains fit for purpose. The changes identified are due to updates with your third party provider, ParentPay, and not a result of changes to the Civica system which remains fully functional.

 

We have ensured that the cost of change has been kept to a minimum considering the work required and time frame to deliver.

"

Has anyone else paid this fee? i can't help but think that NRS should be up to the TLS 1.2 standard, and not charging us to adopt it. on the other hand, they are having to remote in and change stuff that isnt directly their fault... i dont know, what do you guys think?!

 

Cheers,

 

Matt[/TD]

[/TR]

[/TABLE]

[Orangescott]

I've found sQuid much more agreeable to work with

[MYK-IT]

Yes, we received the same email recently, and after enquiring further with them we were advised of the £295.00+VAT fee too, to update some client software etc...

 

It doesn't (and didn't) surprise me at all since it's Civica... after they quoted me approx. £1,300+VAT to migrate Corero 32000 to a new server, all remotely!.... (http://www.edugeek.net/forums/educational-software/198489-corero-resource-32000-migration.html)

 

I am not too sure what's so unique about their client update? To justify such a charge... Considering other agents (e.g. Wonde, MisApp etc) that communicate securely and exchange data from SIMS have all been updated by their respective companies, FOC!

 

Interested with their statement claiming "Sync 1, is unchanged and remains fit for purpose"... clearly not.

[PureMatt]

Interested with their statement claiming "Sync 1, is unchanged and remains fit for purpose"... clearly not.

 

Ha my thoughts exactly. I've emailed parent pay support for their opinion/advice. I'm sure this will go nowhere and i'll end up paying it, it's not like it's a massive amount of money, it just seems so unnecessary and makes me want to look at other cashless services.

[Cache]

Funny, I emailed last week but not had a response.

 

Perhaps because our bursar hasn't paid the support fee yet, however I'm a little miffed if we have to pay for this upgrade as well.

[robyholmes]

I'm also interested in this as we're out of support with NRS/Civica, mainly because they didn't invoice us correctly and we'd already paid one support fee. Nearly a year later we're still waiting on our quote for rejoining (with a fee of course). Now we have this to factor in.

[PureMatt]

Funny, I emailed last week but not had a response.

 

Perhaps because our bursar hasn't paid the support fee yet, however I'm a little miffed if we have to pay for this upgrade as well.

 

I'd phone them if i were you and confirm, they didn't email me back either. Apparently they have a massive backlog and are "working their way through a huge spreadsheet of schools". I'd phone and make sure you're on that spreadsheet and then try and book a time in with them... at that point you'll probably get a quote through for £295...

[mdrabble]

Same boat! - Had them remote in to take a look and they emailed be back saying due to age of our NRS system they have referring me back to the Referrals team

 

Straight away the little voice in my head instantly said NRS/Civica going to charge ££££ for upgrading something their maintenance should cover.

[MYK-IT]

"working their way through a huge spreadsheet of schools" x £295 =

[howartp]

I emailed Weds 6th March, had a reply Thursday 14th March.

 

We're already on Sync2 so nothing to do, but we never paid for the upgrade to sync2 when they did do it.

 

Peter

[AJWhite1970]

I'm on sync v3.7.15 which was upgraded at the end of January when we switched from ParentPay to WisePay.

 

AFAIK we didn't pay for that to happen, it was done under standard maintenance

[pete]

Hi All,

 

So we use parentpay and NRS (now Civica)

 

NRS/Civica sent out this email, stating we must update our server as TLS 1.0 / 1.1 is soon to be discontinued by parentpay.

 

 

Soon to be discontinued by everyone (https://arstechnica.com/gadgets/2018/10/browser-vendors-unite-to-end-support-for-20-year-old-tls-1-0/).

 

TLS 1.2 is 11 years old this August.

[Cache]

I'd phone them if i were you and confirm, they didn't email me back either. Apparently they have a massive backlog and are "working their way through a huge spreadsheet of schools". I'd phone and make sure you're on that spreadsheet and then try and book a time in with them... at that point you'll probably get a quote through for £295...

 

Got a reply to it today with..... a quote for £295.

 

Had already pre-warned our bursar, he wasn't happy.

[PureMatt]

Had a call with a manager at civica, as expected we'll end up paying. Apparently howartp and AJWhite1970 are both mistaken and they didn't get theirs for free at all.

 

I was told NRS don't have to be PCI compliant because they don't deal with sensitive card data (that's done at the other end between parent pay and the customer who is putting money on).

 

Also, NRS has had to work hammer and tong to get the sync2 in operation last minute because ParentPay didnt tell them until January they were making this change. When i told him that they've had the sync2 client since long before then and they certainly wouldn't have installed sync1 on a new site for some time he went quiet for a while as he realized i'd called him on BS... BUT it didn’t change anything. They're adamant they're going to charge customers this cost for "2 hours work".

 

I take their point, it is last minute work and they may have had to take on extra staff or make staff work overtime to meet this deadline HOWEVER, it would be more palatable if they charged us at cost for the extra administration fee rather than the £150 per hour they’ve actually charged us. They obviously don’t care about their reputation, when our multi academy trust starts looking at a single provider NRS will be bottom of the pile for sure. It seems like they’ve annoyed a lot of people for a comparatively small fee.

[howartp]

Apparently howartp and AJWhite1970 are both mistaken and they didn't get theirs for free at all.

Ok, let me check the finance system...

 

Nope, definitely no charges other than the annual maintainances...

[PureMatt]

Ok, let me check the finance system...

 

Nope, definitely no charges other than the annual maintainances...

 

ha, was hoping you'd say that.

[robyholmes]

@pete makes a good point as well. Surely we pay a maintainance fee to Civica so our software products are protected from security issues. NRS should know that they were using a very old version of TLS for encryption and shouldn't be surprised when ParentPay told them they were turning it off!

[PureMatt]

@pete makes a good point as well. Surely we pay a maintainance fee to Civica so our software products are protected from security issues. NRS should know that they were using a very old version of TLS for encryption and shouldn't be surprised when ParentPay told them they were turning it off!

 

Of course they know this... it was just like talking to a brick wall on the phone. They know exactly what they're doing and must know it's unreasonable, they just don't care and see it as a way to strong arm schools into giving them more money on top of their maintenance support.

[Anonimouse]

I was about to post the exact same topic!

 

Upon receiving the message regarding ParentPay no longer supporting TLS 1.0, I contacted Civica/NRS to confirm how best to proceed. Essentially, they suggested that we replace our entire cashless catering system at a cost of approximately £10,000! Granted, the system is almost 10 years old, uses 'Version 2' of Nationwide's till software and runs on an operating system that is some variant of Windows XP mobile. However the till system works really well and as usual, there is a shortage of cash to replace old hardware that continues to work.

 

Another company mentioned that this could be negated by simply upgrading the 'backroom server/computer' to Windows 10. Is that correct? Otherwise, I guess we may have to bite the bullet!

 

I also manage another secondary school, which has a 3 year old NRS cashless catering system running 'Version 6'. I imagine that this site could upgrade to Sync2 for c.£300 to allow future connections via TLS 1.2?

[johnabbots]

Does anyone know what Sync2 actually is? Is it on all of the tills or just the desktop/server that runs the Sync software? Our desktop/server has Sync software which talks to ParentPay to pull down the diners balances and that is on version 3.7 named SyncUNC so hopefully therefore is already on this Sync2 perhaps?

 

They are trying to get thousands out of us so any help regarding this would be useful. I love the way they are scare mongering people into updating from XP due to cryptolocker quotes from the NHS and engadget but has anyone seen them ever do an update on Windows XP anyway or even install antivirus!

 

Cheers

[howartp]

Screenshot of Sync2 attached.

 

Just on the server to pull down balances, send up menus, etc etc.

[johnabbots]

Thanks for the screenshot @howartp Even though we are on 3.7 it looks older than Sync2 as on your screenshot.

 

They have not given an option just to upgrade to Sync2 they want nearly £3500 to upgrade the tills to Windows 10 and to upgrade the Sync to version 2.

 

Has anyone stuck with Windows XP and got them to upgrade just the sync?

[pete]

I love the way they are scare mongering people into updating from XP due to cryptolocker quotes from the NHS and engadget but has anyone seen them ever do an update on Windows XP anyway or even install antivirus!

 

Has the school documented the steps taken to secure financial transactions being carried out on equipment that no longer receives security patches from the manufacturer (Microsoft)?

 

Is that included on the school's risk register?

 

If the tills are segregated so they can only talk to the cashless catering server (and only the cashless catering server can talk to them), that's one thing. If they're sat on the network along with everything else, the school has a problem waiting to happen, especially given the lax security posture from most cashless catering providers.