Partnering to empower payments in the cloud

Such has been the case for CLAI Payments Technologies. For more than 30 years, the company has provided payment systems to financial institutions and retail organizations spanning the Americas.

“We believe we provide the most secure, complete and profitable solution for our customers,” says Fernando Carmona, CEO of CLAI Payments. “We run all of our software on IBM Power Systems with built-in encryption using the integrated IBM i operating system. Part of our success with so many banks in the region is because we have that kind of integration.” Currently, CLAI Payments has a customer base of 130 sites in financial services using its encrypted solution on premises.

In 2019, the company began exploring ways to offer its payment platform, called AZ7, in a cloud environment. By offering its payment platform as a software as a service (SaaS) offering, CLAI Payments could enable customers to offload the cost and effort of buying, housing and maintaining the underlying hardware and software, while paying only for the services they consumed.

“Every financial institution, every bank processor is struggling with a lot of different systems infrastructures and software providers,” says Carmona. “Everyone wants to move to the cloud, and they are looking at the major players in the market, including IBM Cloud, to help simplify their IT environments.”

In moving to a cloud environment, CLAI Payments wanted to continue to run its software on the IBM^® i operating system, which it was very happy with, using IBM Power Virtual Server. However, there were some major hurdles to overcome. “We work with banks and processors. They are, by necessity, very conservative,” says Carmona. “A bank payment platform can’t be out of service for a single second, because every minute of an outage can mean millions of dollars in losses.”

Financial institutions also face strict security, privacy and compliance regulations. To adhere to those regulations and protect customer’s sensitive data, systems and transactions need to be highly secure in all situations, running on encrypted systems. However, most cloud platforms, including IBM Cloud^®, don’t have built-in encryption capabilities for IBM i. The company met with IBM to explore how it could add encryption to the IBM i environment.

IBM brought in IBM Business Partner First National Technology Solutions (FNTS) to help resolve the cryptography issue. “We have a history of working with IBM dating back 25-plus years and have done several outsourcing projects around IBM infrastructure as a service,” says Keith Zblewski, Business Development Manager at FNTS. “Plus, we’re owned by one of the largest privately held financial institutions, so we understand the financial services industry and how to provide secure solutions within it.”

IBM had a cryptographic card—the Hardware Security Module—in its portfolio for its on-premises systems, but it wasn’t available for use on IBM Cloud. “What Fernando wanted was a very specialized solution with very specific requirements for handling critical workloads,” says Zblewski. “IBM didn’t build out these cryptographic processors in their cloud infrastructure because they weren’t needed as a common element to the cloud.”

CLAI Payments worked with FNTS and IBM to determine the best way to incorporate cryptography into the cloud-based solution. “Our teams met multiple times a week,” says Zblewski. “At first, we were just trying to make sure we could put a solution in place that met CLAI’s needs and IBM’s expectations.”

The solution they came up with incorporated elements from all three companies. “Working with IBM, we installed our payment platform, AZ7, on IBM Power Virtual Server running in IBM Cloud datacenters in Washington, D.C. and Montreal,” says Carmona. “FNTS deployed IBM i with integrated IBM crypto cards on dedicated infrastructure in its Chicago and Omaha data centers. We then connected the IBM Cloud and FNTS servers, so our AZ7 platform on IBM Cloud could remotely consume cryptography from the FNTS infrastructure. The overall solution provided us with very good security and communications.”

The solution launched in January 2023. Since that time, FNTS, CLAI Payments and IBM continue to hold weekly meetings to make sure they are operating according to the expectations of all three companies, fulfilling requirements and addressing new challenges as they arise.

CLAI Payments now has several customers running its encrypted AZ7 solution on IBM Cloud, with plans in the works for bringing on many more—including customers currently running the platform on premises.

“We are going to our installed customer base and letting them know we can now offer them test and quality assurance environments in the cloud,” says Carmona. “Once they experience the stability and benefits of running workloads on the IBM Power Virtual Server on IBM Cloud, we will approach them about moving to a hybrid cloud environment, in which they can run some workloads on the cloud and some on premises.”

The company has a large customer base in South and Central America. Recently, a major customer in Chile put this remote configuration under a stress test. “The customer is very sensitive and is located thousands of miles away from the IBM Cloud and FNTS computer centers,” says Carmona. “We were nervous, but once we started the stress test, everything ran smoothly—and even at a faster rate the customer was targeting.”

The development of the encryption capability for the CLAI Payments AZ7 solution has spawned an entirely new standalone offering: encryption as a service (EaaS). FNTS manages the service, which is available to customers on any platform on IBM Cloud.

It has the potential to have profound impact on the industry—and CLAI Payments recognizes the possibilities. “At the beginning of this year, we slowed down our marketing efforts to increase our focus on serving our current customers’ needs. Our encryption as a service was the exception—we are moving as fast as possible in that area. In fact, we have created a new business unit dedicated to the service.”

Both CLAI Payments and FNTS appreciate the unusual nature of their relationship—and the powerful synchronicities it affords them. “I’ve been working in the IBM ecosystem for my entire career and have built partnerships—but this is really unique,” says Zblewski. “It’s not often that you find someone in Omaha working with someone in Costa Rica and find common reasons to collaborate and build real solutions that can impact large companies. This was a unique opportunity where we saw a need to help a client who could really create a new business. And that’s exciting to us.”

Carmona agrees: “Now any IBM i customer who wants to run on IBM Power Virtual Server on IBM Cloud using cryptography can do so. And we’ve structured the solution so that we can provide a pay-as-you-go service for any company—whether they are running software on Oracle on Windows, in another cloud or on prem. Our solution is currently the only one in the world that can run a complete payment platform without the need for external hardware or software. And we are very happy with that.”

Founded in 1991, IBM Business Partner CLAI Payments (link resides outside of ibm.com) provides payment solutions for the financial and retail industries. The company’s solutions cover the entire transactional payment process, as well as cryptography, administration, payment methods and continuous platform optimization. Headquartered in Houston, Texas, CLAI Payments has regional offices spanning South and North America.

Founded in 1995, IBM Business Partner FNTS (link resides outside of ibm.com) is a managed IT services provider with a focus on multicloud, hybrid cloud, mainframe and hosted IT environments. It is a wholly owned subsidiary of First National of Nebraska, a USD  30 billion multi-state holding company headquartered in Omaha, Nebraska, and specializes in partnering with customers in highly regulated industries.