> ## Documentation Index > Fetch the complete documentation index at: https://docs.fexco.com/llms.txt > Use this file to discover all available pages before exploring further. # Security setup > Set up TLS, IP whitelisting, SFTP, and PGP/GPG encryption for your DCC integration Before your first request or file transfer, set up the security layers that Fexco requires for your integration. Which layers apply depends on your integration method, which could either be: * [Transport Layer Security (TLS)](https://www.rfc-editor.org/rfc/rfc8446) * [OAuth (Open Authorization)](https://docs.fexco.com/dcc/api-reference/authentication/oauth.md) * IP whitelisting over a virtual private network (VPN) * Secure File Transfer Protocol (SFTP) access * Pretty Good Privacy (PGP) or GNU Privacy Guard (GPG) file encryption Complete this setup during the connectivity stage of your [integration journey](https://docs.fexco.com/dcc/guides/getting-started/integration-journey.md), before System Integration Test (SIT) begins. ## Security setup requirements by integration method Not every integration needs every layer. Check the table below for which of these apply to you, then follow the setup steps for each | Integration method | TLS | OAuth | Client certificate (JWT) | IP whitelisting (VPN) | SFTP access | PGP/GPG encryption | | :- | :- | :- | :- | :- | :- | :- | | Boarding API | Required | Required | Not required | Not required | Not required | Not required | | Rate Service Classic | Required | Not required | Not required | Not required | Not required | Not required | | Rate Service Connect | Required | Not required | Required | Not required | Not required | Not required | | Merchant boarding (Boarding File Upload) | Required | Not required | Not required | Required | Required | Not required | | Transaction import files (XML I-file, V-file) | Required | Not required | Not required | Required | Required | Required | | Transaction import files (I-file) | Required | Not required | Not required | Required | Required | Optional | | TCOM reports | Required | Not required | Not required | Required | Required | Not required | | Legacy ISO | Required | Not required | Not required | Required | Not required | Not required | ## Why these security requirements exist Fexco processes payment and merchant data, which means every connection method must meet the Payment Card Industry Data Security Standard (PCI DSS). These security requirements exist to satisfy that standard: * Encryption in transit protects data while it moves between your systems and Fexco's, over both API and file-transfer connections. * IP whitelisting ensures only known, agreed hosts can reach Fexco's file-transfer and legacy connections. * File encryption protects transaction data while it sits in a transfer folder, on top of an already-encrypted transport channel. ## Transport encryption (TLS) All connections to Fexco, whether to a REST API or an SFTP server, must use TLS 1.2 or higher. ## IP whitelisting Fexco restricts access to its file-transfer servers and legacy ISO connections to a list of pre-agreed IP addresses. These connections must be made over a VPN, Fexco provides a VPN peering document that defines the parameters for establishing that tunnel. To set up whitelisting, follow these steps: 1. Ask your Fexco project manager for the VPN peering document. This defines the VPN configuration and the IP addresses each side needs to whitelist. 2. Share your outbound IP address with Fexco, and add the IP addresses Fexco provides to your inbound firewall rules. 3. Confirm with your network team that both sides have whitelisted the agreed addresses and that the VPN tunnel is established before you attempt to connect. > [!NOTE] > > REST API integrations (Boarding API, Rate Service Classic, and Rate Service Connect) do not require IP whitelisting or a VPN. TLS and API authentication secure the connection instead. ## Secure file transfer (SFTP) If your integration submits or receives files (merchant boarding XML, transaction import files, TCOM reports), Fexco provides a dedicated SFTP location for your account. Your Fexco project manager coordinates the setup end to end. To set it up, follow these steps: 1. Provide your Fexco project manager with your outbound IP address and your SSH public key. 2. Your project manager shares this information with Fexco Tech Ops and provides you with the SFTP peering document, which contains all the connection details you need. 3. Submit files to the `Incoming` folder by the agreed cutoff time. 4. Retrieve confirmation and response files from the `Outgoing` folder. ## File encryption (PGP/GPG) Transaction import files (XML I-file and V-file) must be encrypted before you submit them over SFTP. Encryption is optional for I-file partners. Fexco accepts both [Pretty Good Privacy (PGP)](https://www.openpgp.org/) and [GNU Privacy Guard (GPG)](https://gnupg.org/), and either format works on Fexco's side. Fexco maintains separate public keys for the certification (UAT) and production environments. See [Environments and URLs](https://docs.fexco.com/dcc/api-reference/environments.md) for details on each environment. To set up file encryption, follow these steps: 1. Generate your own key pair, and share your public key with Fexco. Keep your private key secret. 2. Get Fexco's public key for the relevant environment (cert or production) from your Fexco project manager, and use it to encrypt each file before you submit it. 3. Name the encrypted file with a lowercase `.gpg` suffix, keeping the rest of the filename unchanged, for example `IJLB20100319000217.DAT.gpg`. > [!NOTE] > > Merchant boarding files do not require file encryption, only SFTP over a whitelisted connection. Fexco does not encrypt all confirmation files it sends back, only those covered by a specific agreement. ## Next steps With your security setup complete, you are ready to start integrating. The guides below cover the most common next steps. * [Your first DCC transaction](https://docs.fexco.com/dcc/guides/getting-started/first-transaction.md): walk through an end-to-end integration using your security setup. * [OAuth authentication](https://docs.fexco.com/dcc/api-reference/authentication/oauth.md): configure OAuth for Boarding API. * [JWT/PKI authentication](https://docs.fexco.com/dcc/api-reference/authentication/jwt-pki.md): set up a client certificate for Rate Service Connect. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.