Transact 2026.9 - Session Controls, Agent Security, and Capture Refinements

Building on Transact 2026.8, this release tightens control over card‑capture sessions, adds agent access security, makes failed and cancelled payments clearer, and refines the agent CV2 capture experience — alongside continued integration and platform work.

Most of this release is about giving you more control and predictability: account‑level limits on how long a capture session can live, IP restrictions on who can sign in, and a capture flow that behaves sensibly even when the card type isn't known up front.

Highlights

• Configurable card‑capture session lifetimes, with a per‑account maximum and a five‑day request cap.
• Agent IP restriction on login, passwordless login, and service‑token exchange.
• Clearer payment results — the PSP error status is surfaced on failure, and a PSP response is synthesised on cancellation.
• Smarter CV2 (CSC) capture: correct auto‑termination length, a configurable CSC length, and manual stop‑to‑complete when the length can't be determined.
• VerifoneCommidea tokenisation improvements — card‑derived token expiry, masked PAN, and both gateway responses surfaced.
• The Data Protection service goes live, providing centralised, customer‑specific encryption and decryption for card data.

Card Capture and Session Control

Card‑capture sessions are now configurable and bounded, so a capture link can't outlive its intended window.

• Requests can specify a session time‑to‑live (minutes); when set it overrides the default cache expiry.
• The requested (or default) TTL is clamped to a per‑account maximum
• A default ceiling and a five‑day request cap apply when no account maximum is configured.
• Session updates now preserve the original TTL instead of sliding it forward, and Remote Card Capture records an absolute session expiry.
• On session timeout, the bootstrap page is hidden behind the cancellation screen, so it is no longer visible underneath.

Agent and Customer UI

The agent capture experience gains a smarter CV2 (CSC) flow and clearer payment results.

• A CSC‑only capture auto‑terminates at the correct CV2 length, derived from the supplied card type — three digits for most schemes, four for Amex.
• A configurable maximum CSC length lets a customer cap the CV2 at a fixed length without passing a card type on the query string.
• When the CV2 length can't be resolved, the agent can now manually stop (complete) the field rather than only reset it — and the capture chip's label and tooltip correctly reflect the Stop or Reset action.
• Failed payments now surface the PSP error status, and a PSP response is synthesised on cancellation, so payment results stay consistent.

Payments and PSP Integrations

Provider integrations continue to mature, with tokenisation and metadata correctness fixes.

• VerifoneCommidea (Commidea): token registration now uses a card‑derived expiry (the last day of the card's expiry month) instead of a hard‑coded five‑year expiry, surfaces tokenExpiryDate` as an ISO datetime, populates a masked PAN (first six and last four), and returns both the transaction and tokenisation raw responses.
• Adyen: the payment metadata key was shortened to respect Adyen's 20‑character metadata key limit.

For endpoint details, see the Verifone Commidea and Adyen references in the Transact API documentation.

Security and Compliance

Agent access is now restrictable by network, reducing exposure.

• IP restriction: logins, passwordless logins, and the service‑token exchange are gated by per‑account IP and geographic restrictions (CIDR matching), returning 403 when the caller's address isn't allowed.
• The check is null‑safe and non‑blocking when restrictions are unset, so unrestricted accounts are unaffected.
• Removed the deprecated GenerateServiceToken auth endpoint (use the Account API instead).
• Patched vulnerable dependencies.

Integrations and Configuration

A batch of integration and configuration refinements across capture and data delivery.

• Data delivery (datapost) now posts its message to the embedding parent window, so data is delivered correctly when Transact is embedded in an iframe.
• Dynamic field resolution (processDynamicFieldFunction) accepts either a single value or an array of parameters.
• Updated card BIN range data.
• ASR: capturing via ASR now stops the ASR session when a PAN, CV2, or expiry field is deleted.

Platform and Deployment

• The Data Protection service is now deployed to production, providing centralised, customer‑specific encryption and decryption for card data across the platform.
• Data Poster, Adyen, Trust, and Verifone added to the Shared UK production deployment pipeline.
• Continued dependency vulnerability patching.

For the full set of endpoints, see the Transact API reference.