Unlike most SaaS platforms, Miva does not force upgrades on its customers, but instead gives its customers the freedom to install updates when they are ready. However, running out-of-date software, in this day and age, is not a wise, safe, or prudent choice, particularly when it comes to payment data security.
In order to combat criminal attempts to access credit card data, the PCI Security Council requires that merchants secure their digital infrastructure by keeping software up-to-date. Accordingly, general Miva Merchant platform updates must be installed within 90 days of release, and security-related updates must be installed within 30 days of release.
To encourage compliance with these important guidelines, a monthly Non-Compliance Fee (NCF) of $75 will be charged for each instance of outdated Miva Merchant software running 90 days following the release of a standard Software update, or 30 days following the release of a security-related Software update. If the software is also considered End of Life (EOL), an additional $75 per month will be charged, for a total NCF of $150 per month, per domain.
Miva Merchant software is considered End of Life (EOL) when either of these 2 circumstances is met:
1. Software has been officially Non-Compliant, due to normal software releases (from the perspective of PCI software updates), for more than 12 months. In other words, 15 months after the release of an update, software will officially be considered EOL.
or
2. Software that is Non-Compliant, due to a security release (from the perspective of PCI software updates), for more than 3 months. In other words, if we mark an update as security-focused, per the terms of PCI compliance, older software will be considered EOL 4 months after the security update is released.
No further releases, patches, upgrades, or updates will be released for EOL versions of Miva Merchant, and technical support for EOL versions of the software cannot be guaranteed.
This policy applies to all instances of Miva Merchant software, whether hosted on Miva's servers or with another hosting company.
