Connect with Purpose

THE ARIZONA DEPARTMENT OF

CORRECTIONS, REHABILITATION

AND REENTRY

RFP #BPM005375 Electronic Payment Transaction Processing Services

Closing Date: October 6, 2023

Presented to:

Arizona Department of Administration State Procurement Office 100 N 15th Avenue Phoenix AZ 85007

Presented by:

Nikki Calhoun Payment Specialist Telephone: 602-614-5480 Email: nikki.calhoun@viapath.com or RFP@viapath.com

Deposits to an inmate's trust account, as well as probation, community corrections, and background check payments are provided by TouchPay Holdings, LLC wholly owned by Global Tel*Link Corporation d/b/a ViaPath Technologies. The following are registered trademarks of ViaPath: Global Tel*Link®, ViaPath Technologies, ConnectNetwork®, Inspire®, Flex®, Flex® Link, Voice IQ®, Phone IQ®, Call IQ®, Called Party IQ®, Data IQ™ (DEX), AdvancePay®, Request2Call®, ViaPath Virtual Receptionist®, and Telmate Guardian®.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | Table of Contents | i

| Table of Contents | Table of Contents ............................................................................................................ i | Scope of Work

| Required Form Attachments and Addendum 1 Acknowledgement

Attachment 1: Offer and Acceptance Attachment 2: Boycott of Israel Disclosure Attachment 3: Rules for Non-Employees of ADCRR in Arizona State Prisons Form 63 Attachment 4: Confidential Information Form Attachment 5: Conformance Statements and Deviations and Exceptions Attachment 6: Subcontractors Attachment 7: References Attachment 8: Forced Labor of Ethnic Uyghurs Ban Form Attachment 9: Accepted Payments Form Attachment 10: Letter of Insurability Amendment 1 Acknowledgement

Confidential Response Supplement File Uploads:

• Confidential – Supplement -ViaPath NIST 800 53 Cybersecurity Framework Command System Compliance Report.

• Confidential – Supplement – ViaPath PCI DSS Certification

• Confidential – Supplement – ViaPath System and Organization Controls SOC 2

Type 2 Report

3120 Fairview Park Dr. / Suite 300 Falls Church, VA 22042

October 5, 2023

Arizona Department of Corrections, Rehabilitation and Reentry Mr. David Brackney, Procurement Officer State Procurement Office 100 N 15th Avenue Phoenix, AZ 85007

RE: Arizona Department of Corrections, Rehabilitation and Reentry

Dear Mr. Brackney, ViaPath Technologies (ViaPath), is pleased to present our response to Arizona Department of Corrections, Rehabilitation and Reentry (“ADCRR”) Request for Proposal (“RFP”) for electronic payment transaction processing services. Throughout our response, ViaPath will demonstrate why ADCRR should continue with your partnership with ViaPath as a payment solution provider. As evidenced through our ten-year partnership with the ADCRR, ViaPath is the right partner for you as you continue to keep pace with today’s evolving corrections industry. Based on our understanding of your needs, our knowledge of your facilities, and our experience in the corrections industry, ViaPath will continue to deliver the technology, financial value, and service that ADCRR has come to expect from us.

In the many years ADCRR has received ViaPath’s Financial Services, we have become extremely familiar with your needs and desires as a corrections department. We understand that safety and connectivity is extremely important to you and through our payment solutions, ViaPath is one piece of the extensive puzzle which makes ADCRR an effective correctional environment.

We believe after reviewing all bids, you will reach the conclusion that our comprehensive proposal is the best in terms of innovation, flexibility, and value. By continuing to partner with ViaPath as one of your payment services providers, ADCRR will continue to receive the following:

• ZERO CHANGE to the payment and deposit services offered by ViaPath, ensuring friends and family members will not have the pain of changing accounts, inmates won’t have the hassle of closing out/emptying trust accounts, and your facility staff won’t have to change one thing about how payment services are currently operating. ViaPath will continue to put your staff, your inmates, and their friends and family first. Payment Services are provided by TouchPay Holdings, LLC (TouchPay) NMLS #967396 d/b/a GTL Financial Services, a wholly owned subsidiary of Global Tel*Link Corporation d/b/a ViaPath Technologies (ViaPath). ViaPath is an all-in-one Corrections Technology vendor with a three-decade track record of successful partnerships.

ViaPath.

• Excellent service backed by a trusted, proven, and experienced vendor. ViaPath is the industry leader in automated payment services, providing fully integrated and automated electronic payment and deposit services for Department of Corrections and county correctional customers since 2004. Our web payment system was developed in 2005, which gives us 18 years’ worth of experience processing payments online. ViaPath was the first company to deploy and manage a fully integrated and automated payment channel system including kiosks, web and IVR portals for a State DOC, generating over $30 million in automated payment transactions in one year.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | Cover Letter | ii

3120 Fairview Park Dr. / Suite 300 Falls Church, VA 22042

• The highest level of financial and data security by holding Money Transmitter Licenses or are approved to process money transmissions in every state; being certified as compliant with PCI DSS Level 1; securely storing all transactional data with redundant off-site backup; encrypting all transmissions with 128-bit encryption technology.

In closing, I want to thank the Arizona Department of Corrections, Rehabilitation and Reentry for the opportunity afforded ViaPath over the last couple of decades. We look forward to continuing our high priority service under the new contract Please feel free to contact Nikki Calhoun, Payment Services Specialists at 602.614.5480 or Nikki.Calhoun@viapath.com with any questions.

Sincerely, Jonathan Walker Chief Growth Officer

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | Cover Letter | iii

| Scope of Work Arizona Department of Corrections, Rehabilitation & Reentry

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 3

4. Scope of Services

4.1. PURPOSE: ADCRR intends to establish a term contract with a firm(s) to provide Electronic Payment Transaction Processing (EPTP) services as a convenience for use by the general public in conducting transactions for or on behalf of persons under the care, custody and/or supervision of ADCRR. Any resulting contract(s) shall be issued on a fixed-price basis, for a three (3) year period, with options to extend the term up to an additional two (2) years.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.1 Purpose.

4.2. BACKGROUND: ADCRR conducts monetary transactions to 1) service inmate trust accounts of approximately 35,000 individuals in State custody, 2) collect fees for visitor background check processing, and 3) collect a variety of Community Supervision payments and fees associated with approximately 5,300 individuals under community supervision.

The table below represents activity processed through the current EPTP services over a recent twelve (12) month period:

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.2 Background.

4.3. SCHEDULE: All equipment and services are to be installed, operational, and ready for final integration testing with ADCRR’s system no later than Thursday, November 30, 2023. All payment transaction services for public use are to begin no sooner than Sunday, December 31, 2023, and no later than Monday, January 1, 2024 (which will be the Effective Date of any resultant contract); more precise schedule requirements will be communicated to Contractor(s) at a later date. Offeror should clearly state whether it can meet this schedule. Any Offeror unable or unwilling to accept this schedule may be determined not susceptible for award.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.3 Schedule.

Weekly Transactions

Weekly Volume

Annual Transactions

Annual Volume

Inmate Trust Accounts: 12,749 $962,738 662,934 $50,062,397 Community Corrections Fees: 267 $22,747 13,863 $1,182,853 Background Check Fees:

$6,496

13,512

$337,785

Totals: 13,276 $991,981 690,309 $51,583,035

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 4

ViaPath financial services are currently installed and operating within ADCRR facilities. This means that there is a ZERO change factor in the proposed items.

For any new items being proposed, ViaPath will meet the schedule deadline requirements.

4.4. UTILIZATION OF CONTRACTOR’S SERVICES: Use of Contractor’s services is at the discretion of the public at large. ADCRR makes no representation or guarantee of any kind concerning the public’s use of Contractor’s payment transaction services, and Contractor shall have no recourse against ADCRR regardless of the extent to which actual public usage may deviate from what Contractor may have contemplated or expected. Any presumptions or plans made by Contractor regarding the amount and/or timing of transaction fees it will collect from the public under any resultant contract are made solely at Contractor’s risk. Offeror should acknowledge it has read and agrees with this Section 4.4. Any Offeror unable or unwilling to accept these terms shall be determined not susceptible for award.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.4 Utilization of Contractor’s Services.

4.5. DELIVERY OF SERVICES:

4.5.1. Costs and Revenue. The awarded Contractor(s) is required to bear all of its costs to provide the Services. Contractor’s sole compensation and/or revenue shall be its transaction fees collected from the public. No ADCRR or State funds shall be paid to Contractor at any time as payment, compensation, and/or reimbursement, etc., for any part of Contractor’s Services. Offeror should acknowledge it has read and agrees with this Section 4.5.1. Any Offeror unable or unwilling to accept these terms shall be determined not susceptible for award.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.1 costs and Revenue.

4.5.2. Minimum Requirements. Contractor shall meet the following minimum requirements:

4.5.2.1. As applicable, Contractor agrees to make all necessary changes to its system (hardware, software, interfaces, etc.), at no cost to ADCRR, to accommodate any future changes to Keefe’s KeepTrak Inmate Banking System, or any future system replacing it, including an option (to be implemented upon request by ADCRR) for real-time or near real-time (at ADCRR’s sole discretion) interaction/processing. Any such changes shall be made in a timely manner on a schedule to be approved by ADCRR.

of Services, 4.5.2 Minimum Requirements, 4.5.2.1.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 5

4.5.2.2. As applicable, Contractor agrees to make all necessary changes to its system (hardware, software, interfaces, etc.), at no cost to ADCRR, to accommodate a request by ADCRR to set a daily/hourly schedule for when transactions shall be authorized to be sent to ADCRR’s inmate trust account system. Any such changes shall be made in a timely manner on a schedule to be approved by ADCRR.

of Services, 4.5.2 Minimum Requirements, 4.5.2.2.

4.5.2.3. Provide a system which:

4.5.2.3.1. Includes all items/components (including all hardware, software, electronic interfaces, etc.) needed for Contractor’s system to successfully interface and work with ADCRR’s systems, and

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.3 & 4.5.2.3.1.

ViaPath financial services are currently implemented and operational within ADCRR facilities, with the necessary interfaces already established and functional throughout our 10-year partnership with ADCRR. For any additional items being proposed that are not already installed within ADCRR facilities, ViaPath will ensure that all item/components necessary to interface and work with ADCRR components will be provided.

4.5.2.3.2. Includes services for ADCRR’s Central Office; Community Corrections Division; Constituent Services Office; and all Arizona prison facilities, whether existing or future, and whether publicly or privately operated (existing ADCRR locations are shown in Exhibit A); and

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.3.2.

ViaPath’s solution includes services for ADCRR’s Central Office; Community Corrections Division;

Constituent Services Office; and all Arizona prison facilities, public or privately operated. As a dedicated partner, ViaPath will work with the State and ADCRR to ensure all facilities, currently or in the future, can receive our services.

4.5.2.3.3. Accommodates ADCRR’s use of Keefe’s KeepTrak Inmate Banking system Contractor is required to integrate its system with KeepTrak; and of Services, 4.5.2 Minimum Requirements, 4.5.2.3.3.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 6

4.5.2.3.4. Provides reports compatible with ADCRR’s Arizona Correctional Information System (ACIS); and of Services, 4.5.2 Minimum Requirements, 4.5.2.3.4.

4.5.2.3.5. Includes any future changes in ADCRR’s financial/accounting and/or computer/information technology system (including changes in technology which may occur over the duration of the Contract); and

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.3.5.

ViaPath will support any future changes in ADCRR’s technology system which may occur over the duration of the contract.

4.5.2.3.6. Includes an option (to be implemented upon ADCRR’s request), for real-time or near real-time (at ADCRR’s sole discretion) interaction/processing with ADCRR’s system, now or in the future, including transactions involving inmate trust account deposits, visitation background check fees, and Community Corrections payments and fees; and

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.3.6.

ViaPath’s financial services have been installed and operational in ADCRR’s facilities for 10 years. Our solution currently interacts and processes transactions in real time to inmate’s accounts, background check fees, and community corrections fees. This means NO ADDITIONAL interfaces will be needed for ViaPath to meet this requirement.

4.5.2.3.7. Will only accept inmate trust account deposits for active inmates as of the date of deposit (based upon information provided by ADCRR); and of Services, 4.5.2 Minimum Requirements, 4.5.2.3.7.

4.5.2.3.8. Will only accept Community Corrections payments and/or fees for offenders under community supervision and for offenders released from community supervision that owe payments and/or fees (based upon information provided by ADCRR); and of Services, 4.5.2 Minimum Requirements, 4.5.2.3.8.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 7

4.5.2.3.9. Will only accept a visitation background check fee for an active visitation application which requires the fee to be paid (based upon information provided by ADCRR); and of Services, 4.5.2 Minimum Requirements, 4.5.2.3.9.

4.5.2.3.10. Accepts payments from the public via Internet Website/Portal, Telephone, Walk-in Storefront, and Mobile Payment Platform/Application (see section 4.5.5 for more information); and

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.3.10.

ViaPath understands the importance of many payment collection options for friends and family, which is why we will continue to meet the above requirements.

ViaPath’s payment network provides turnkey services, so that there is NO COST or hassle to the facility, and processes payments submitted by phone, online, mobile app, and received at retail outlets. Ours is the most robust and reliable automated payment system in the industry. It is also the most comprehensive. We offer a complete range of options so payers have the flexibility to make deposits and payments when, where, and how they would like, and there is no cost to the ADCRR nor, in most cases, the offender population.

Our commitment to maximizing convenience for payers has led to developing multiple points of access for payers. These include Web/Portal, Phone IVR, Mobile App, and Walk-In Retail. Our goal is to accommodate the needs of payers by accepting payments using cash or with credit/debit cards, and money orders. All our payment channels are in English and Spanish and so are our marketing materials. Other languages can be accommodated as required.

Payments to an inmate's trust account are provided by TouchPay Holdings, LLC (NMLS #967396) d/b/a GTL Financial Services, which is also the owner and manager of ConnectNetwork.com.

TouchPay Holdings, LLC d/b/a GTL Financial Services is wholly owned by Global Tel*Link Corporation d/b/a ViaPath Technologies (ViaPath).

4.5.2.3.11. Performs daily verification test(s) to confirm all persons (along with all associated information) included in ADCRR’s daily update to Contractor has been accurately incorporated into Contractor’s system. Verification of successful completion of these daily tests shall be immediately sent to ADCRR upon request;

and of Services, 4.5.2 Minimum Requirements, 4.5.2.3.11.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 8

4.5.2.3.12. Provides each transaction payer with a transaction receipt; and for inmate trust account transactions, provides to ADCRR an electronic payee receipt for conveyance to the inmate. Record of all receipts shall be available to ADCRR at all times in the event account research is necessary; and

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.3.12.

ViaPath provides each payer with a transaction receipt as described below. At any time, ADCRR may request a record of all receipts in the event of account research. To convey payment to the inmate, the ADCRR, at any time, can go into the ConnectNetwork portal and batch out reports of deposits. ADCRR can then decide the best way to deliver this information to the inmates.

Website Transaction Receipt At the time of a deposit, the ConnectNetwork website displays final transaction information for the purposes of user verification and receipt documentation. When the payment transaction is complete, all receipts for the selected account are displayed in the account’s Recent Activity list.

IVR Transaction Receipt A person depositing funds through the telephone IVR system is provided with a transaction (receipt) number. After the credit/debit card has been processed, the depositor will hear:

• Your credit card deposit has been accepted. The offender will have access to the funds within 24 hours.

• The receipt number for this transaction is: XXXXXXX.

• Your deposit is now complete. If you would like the receipt number repeated, please press 1 otherwise you may hang up now.

Should the depositor have questions about the transaction, he or she may call the ConnectNetwork service center 1-800 number. Referencing the transaction number ensures that the deposit record can be quickly and accurately located in the transaction database.

Walk-In Transaction Receipt The Walk-In user is always issued a paper receipt that includes the date and time of the deposit, a receipt number, account name and ID number, and payment type.

4.5.2.3.13. Includes programmable parameters for automatically notifying ADCRR of electronic corrections. Programmable parameters are parameters that may be used to trigger a notification to ADCRR that something previously reported or recorded has changed; and of Services, 4.5.2 Minimum Requirements, 4.5.2.3.13.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 9

4.5.2.3.14. Includes a toll-free customer service telephone number adequately staffed year-round for a minimum of Mon-Fri 9:00 a.m. to 5:00 p.m. MST (Arizona Time).

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.3.14.

ViaPath provides toll-free access to live customer service to meet the above needs in both English and Spanish, seven days a week, 24 hours a day. Our service representatives respond to customer questions and help resolve issues related to the processing of payments, transaction fees, and other payment issues. Each ViaPath Customer Service representative has access to up-to-date account information that includes current account status, records, and billing and payment histories.

Customers may also go to the ConnectNetwork website (www.connectnetwork.com) and browse our Frequently Asked Questions, which are written in clear, easy to understand language. Email support is available at www.connectnetwork.com ‘Contact US’.

In addition to providing easy account set up and deposit options, the site gives intuitive and simple access to Customer Service through Contact Us and Help links (find FAQ’s under Help).

ViaPath has added a dynamic social media component to ConnectNetwork, providing interactive Twitter accounts to deliver helpful information for offender friends and family members and respond to specific customer inquiries. There is also a ConnectNetwork blog section focused on providing interesting, educational, insightful content related to the corrections market overall. These blogs provide valuable and relevant information to friends and family conducting business with ViaPath.

In addition to being provided online, Customer Service Contact Information is included in marketing materials posted at the facility, and handouts made available to visitors.

https://twitter.com/GTLconnect

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 10

4.5.2.4. Ensure that all electronic data is stored on a secure network and encrypted both in transit and at rest. The electronic information relating to each transaction shall be made available to ADCRR via a secure online interface provided by Contractor. This interface will allow ADCRR to look up transactions, print receipts for delivery to inmate(s), add/delete users and change user access privileges through centralized administrative access, and provide an intelligence feature (ability to perform custom searches) that allows ADCRR to track all incoming transactions. All transactions shall remain available to ADCRR for review, whether via the online interface or an archive retrieval process. ADCRR requires a minimum of one (1) years’ worth of data to be provided via the online interface, with a requirement for archived or older data to be made available immediately upon request.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.4.

ViaPath has a structured Information Security program at multiple layers within the company encompassing our employees, our processes, and tools/technology used in the delivery of our services. ViaPath Operations, including business practices, system development, deployment, and functionality; and data acquisition, handling, and storage are subject to stringent, detailed security policies and procedures.

As evidence of our commitment to security, ViaPath was one of the first organizations in the country with employees certified by the Payment Card Industry (PCI) Security Standards Council as Internal Security Assessors (ISA). This ensures our PCI compliance is held to the highest standard. ViaPath is a level 1 merchant - the highest level attainable - meaning it must complete the most comprehensive annual audit report required by the Payment Card Industry Data Security Standard (PCI-DSS). ViaPath’s handling of sensitive cardholder data is fully compliant with the PCI-DSS.

ViaPath uses these security best practices as its foundation across all ViaPath’s technology infrastructure. ViaPath has been PCI compliant since 2018.

As a testament to the strength and security of our credit card processing infrastructure, ViaPath processed 35.9 million credit card transactions in 2021.

ViaPath backs its expanding automated payment services profile with the most stringent data security achievable. Through TouchPay Holdings, LLC, wholly owned by Global Tel*Link Corporation d/b/a ViaPath Technologies, we are approved or licensed for money transmission in all 50 states. With comprehensive OFAC and AML/BSA policies in place, we are fully compliant with FinCEN and state money transfer regulations.

Our systems and deposit service systems are rich in fraud prevention features. If desirable, ViaPath’s Chief Security Officer will be pleased to set up a meeting with ADCRR for an in-depth review of our security methodologies.

Data Breach Policy ViaPath encrypts all data transmitted and/or stored. In addition, we do not store credit card account information, so that information is not available in the event of a security breach on our servers.

ViaPath’s credit card processing gateway provider would contact us immediately in the event of a breach. We would then notify our merchant processor who would immediately contact Visa and MasterCard to take appropriate action.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 11

ViaPath’s Information Technology Department’s designated security manager and ViaPath’s risk manager investigate all alleged breaches that involve personal information. As standard procedure, in the event of a breach to the security of computerized personal information, ViaPath would notify the Arizona Department of Economic Security (ADES) Division of Technology Services, Information Risk Management (IRM), of all security incidents by phone to inform ADCRR that information is believed to have been compromised by unauthorized persons. Security breach notifications must:

• Be done as quickly as possible.

• Can only be delayed if a law enforcement agency determines that notification will impede a criminal investigation and the agency has made a written request that the notification be delayed. Notification shall be made after the law enforcement agency determines that the disclosure of the breach will not compromise the investigation.

• The preferred method of notification is in writing. However, electronic notification can be used if that is the primary means of communication with that consumer.

All Personally Identifiable Information (PII) transmitted between ADCRR and ViaPath, both in transit and while in the possession of ViaPath, will be encrypted to meet or exceed The National Institute of Standards and Technology (NIST) 800-53, Rev 4s. “Personally identifiable information’’ includes information likely to disclose the location of a victim of domestic violence, dating violence, sexual assault, or stalking, including:

• a first and last name,

• a home or other physical address,

• contact information, including a postal, e-mail or Internet protocol address or a telephone or facsimile number,

• a social security number, or

• any other information, including date of birth, racial or ethnic background, or religious affiliation that in combination would serve to identify any individual.

Access to all Personally Identifiable Information will be restricted to authorized users who need it to perform their official duties. This information will always be stored in a manner which is physically and electronically secure from access by unauthorized persons. When Personally Identifiable information is processed, it will be done under the immediate supervision and control of ViaPath personnel who have obtained security screening training. The latest physical and technological safeguards will be used so unauthorized personnel cannot retrieve PII by means of a computer, remote terminal, or other means.

ConnectNetwork Services ViaPath accomplished the above requirements via the secured ConnectNetwork services website.

The system can be configured to transmit transaction records to ViaPath applications in batches at intervals ranging from every five (5) minutes to daily.

ViaPath’s ConnectNetwork Services will record and track all deposits and generate reports of activity by individual inmate and totals by facility. ViaPath has the capability of using ConnectNetwork transaction records to report to ViaPath deposits made to inmate accounts through the various payment channels; enabling authorized ViaPath staff to view all EFT transactions. Reports will compile the number of transactions and related dollar values for the selected time frames. The system offers the ability to view all transactions by facility as well as transactions based on ViaPath -specified criteria, such as individual inmate.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 12

To support ViaPath’s reconciliation of accounts, ViaPath’s payment systems will send an automated email daily that states the total amount of money ACH’d and a listing of the individual transactions.

The email can be formatted to present the information as desired by ViaPath, e.g., segregated by deposit source or by facility. The email provides transactions in HTML format and includes an Excel attachment of the transaction records.

ConnectNetwork.com is a secure website where authorized ViaPath staff may access, review, and generate reports of all transactions, grouped according to user preference.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 13

One of the available reports is the Deposit Transaction History which can be customized to include the following information:

• Service Type – select the desired inmate service type: Trust, PIN Debit, or Phone

• Start Date – (required) defaults to one day before the current date. Click the Calendar icon to change the start date.

• End Date – (required) defaults to current date. Click the Calendar icon to change the End

Date.

• Facility – select a facility from the drop-down list. (Not available when PIN Debit or Phone service type is selected).

• Cash/Credit – select the type of payment for this transaction: Cash, Credit, or All.

• Deposit Method – select the deposit method: All, Intake, IVR, Money Order, Walk In, Web.

• Deposit GUID –refers to the ID number generated for every deposit. The Deposit GUID is commonly used by the ViaPath support team.

• Transaction Number – enter the receipt ID number to search by a specific transaction.

• Depositor Account Number – enter the depositor’s ConnectNetwork account number.

• Inmate Last Name – enter the inmate’s last name. (Not available when PIN Debit or Phone service type is selected).

• Phone Number – enter the depositor’s phone number. (Not available when Trust or PIN

Debit service type is selected).

• Inmate ID – enter the inmate’s ID number. (Not available when Phone service type is selected).

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 14

After you click the Search button, the Transaction History Search Results are displayed at the bottom of the screen.

If desired, the Transaction History can be exported as an Excel spreadsheet as well.

4.5.2.5. Acknowledge and agree that ADCRR is, and/or shall be considered, the owner of all data provided by ADCRR and/or its Constituents (unless prohibited by law), and that ADCRR shall have access to all such data, as well as all transaction data, in Contractor’s system and/or records at all times and/or immediately upon request.

of Services, 4.5.2 Minimum Requirements, 4.5.2.5.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 15

ViaPath acknowledges and agrees that ADCRR is the owner of all data provided by ADCRR and/or its Constituents (unless prohibited by law). ADCRR shall have access to all such data, as well as all transaction data, in Contractor’s system and/or records at all times and/or immediately upon request.

4.5.2.6. Guarantee maintenance of service at all times.

of Services, 4.5.2 Minimum Requirements, 4.5.2.6.

All payment channels are monitored remotely and updated frequently to maximize operability.

ViaPath provides optimal backup restoration capabilities for all ViaPath hardware and software, so service can be maintained at the highest possible level in the event of an external disruption. Our business operations provide redundancy within multiple data centers. All data centers have a 48-hour battery backup and diesel generator backup for extended outages. If there should be a disaster and the main data center and ViaPath’s payment applications are disabled, we have a fully developed Disaster Recovery Plan to rapidly restore data processing capabilities.

4.5.2.7. Guarantee funds for all transactions and be responsible for reconciling any transaction(s) back to the original payer.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.7.

Any funds that are accepted by cash, credit cards, or debit cards are guaranteed by ViaPath. We use several processes to ensure that the payer is authorized to use the funds and that there are sufficient funds available to cover the deposit. If for any reason reconciliation is necessary, ViaPath assumes full responsibility. As a licensed money transmitter, we always meet all the required oversight standards and fully comply with all regulations regarding cash management and fund transmissions.

Credit/Debit Card Acceptance ViaPath utilizes in-house systems and third-party card processors to ensure the validity of the cards before the funds are accepted. This process is seamless to the depositor and occurs in a few seconds so that it does not impact the depositor’s experience. ViaPath works hard to ensure that there are no issues with payments processed via our technology but occasionally a deposit is declined. This may be the result of card merchant restrictions or financial services rules set by the government to protect against fraud or money laundering. In these instances, ViaPath’s Customer Service Representatives can help the depositor.

Cash Acceptance With any cash deposit at our Walk-In retail locations, ViaPath guarantees all funds once accepted by the storefront location.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 16

4.5.2.8. Acknowledge and agree that, as applicable, source codes for software developed or modified by Contractor specifically for use with the Department’s system shall become the property of the Department and shall be immediately provided to the Department upon request. Software provided by the Contractor to the Department shall contain a provision for perpetual licensing with all upgrade options. The Department may decide to maintain the software in escrow; therefore the licensing agreement(s) shall also contain a provision for maintaining a version of the software in escrow in the event the Contractor is unable to continue service for financial or other business reasons.

of Services, 4.5.2 Minimum Requirements, 4.5.2.8.

4.5.2.9. Comply with Payment Card Industry Data Security Standard (PCI DSS) throughout the Contract term (Offeror is to provide a copy of its current PCI DSS validation/certification with Offeror’s proposal).

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.9.

ViaPath’s online payment system Connect Network is easy to use, simple for users to navigate, registering new users, checking transaction history and making payments. Connect Network is a fully secure, encrypted system that meets or exceeds all industry standards in cyber security and Credit Card Processing.

ViaPath obtained a SOC2 Type I certification and a SOC2 Type II certification. A SOC2 Type I is a report on the fairness of presentation of ViaPath’s systems and suitability of the design of security controls. A SOC2 Type II is a report on the fairness of presentation of the ViaPath’s systems and the suitability of the design and operating effectiveness of our security controls. ViaPath successfully passed both assessments.

In addition, ViaPath was one of the first organizations in the country to be certified by the Payment Card Industry (PCI) Security Standards Council as Internal Security Assessors (ISA). This ensures our PCI compliance is held to the highest standard. ViaPath is a level 1 merchant – the highest level attainable – meaning it must complete the most comprehensive annual audit report required by the Payment Card Industry Data Security Standard (PCI-DSS). ViaPath’s handling of sensitive cardholder data is fully compliant with PCI-DSS. ViaPath uses these security best practices as its foundation across all of ViaPath’s technology infrastructure.

ViaPath has included our PCI, NIST and SOC compliance documentation in the separate supporting information and confidential file upload as directed in Section 4.4 Confidential Information in the Standard Instructions to Offerors. ViaPath considers our IT Security information to be confidential.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 17

4.5.2.10. Hold a valid Arizona Money Transmitter License at all times during the term of any resultant contract. Offeror must submit a copy of its valid Arizona Money Transmitter License with its proposal if it has one, or within thirty (30) days of its proposal submission if it does not currently have one. Contractor shall keep and maintain such license throughout the term of any resultant contract.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.10.

Please find our Arizona Money Transmitter License on the following page.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 18

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 19

4.5.2.11. Provide for funds for the electronic transactions to be transferred daily via wire transfer to an Arizona State Treasury account (under ADCRR’s current practices, Sundays and certain holidays are excluded from this requirement, however, this practice is subject to change).

of Services, 4.5.2 Minimum Requirements, 4.5.2.11.

4.5.2.12. Ensure that each day the funds transfer amount(s) exactly matches the total balance(s) shown on the transactions report(s) for that day.

of Services, 4.5.2 Minimum Requirements, 4.5.2.12.

4.5.2.13. Ensure that each of its Subcontractors are obligated, by written contract, to comply with the requirements, terms, and conditions of this RFP and any resultant contract which are related to the Subcontractor’s services provided to Contractor, including the following:

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.13.

No subcontractors will be used in support of this contract.

4.5.2.13.1. Subcontractors shall meet the same licensing requirements and standards required of the Contractor.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.13, 4.5.2.13.1.

4.5.2.13.2. Subcontractors shall meet all Scope of Work requirements related to their work.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.13.2.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 20

4.5.2.13.3. Subcontractors shall comply with all ADCRR written instructions related to their work.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.13.3.

4.5.2.13.4. Subcontractors shall be required to maintain the insurance requirements specified in the Special Terms and Conditions.

Within twenty-four (24) hours of request, Contractor shall provide to ADCRR a copy of any such Subcontractor contract (Contractor may redact its fees/payments).

ADCRR reserves the right to deny any employee of the Contractor, or of any Subcontractor, access to its facilities, information, or Constituent information as a result of confidential information obtained during the course of an ADCRR security clearance process or for violation of an ADCRR policy.

If, after Contract award, Contractor wishes to use a Subcontractor not identified in Attachment 6, such Subcontractor shall be subject to review and a written determination by ADCRR whether it may participate in the Services; such determination shall be at ADCRR’s sole discretion, but Subcontractor’s participation will not be unreasonably denied.

Offeror should confirm in its proposal that it will comply with all provisions of this Section 4.5.2 Minimum Requirements; however, any provisions that Offeror does not agree to comply with are to be listed and described in Offeror’s completed Attachment 5 Supplement, Deviations and Exceptions included with Offeror’s submission.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.2 Minimum Requirements, 4.5.2.13.4.

No subcontractors will be used in support of this contract.

As ADCRR already knows and has become accustomed to, ViaPath’s Financial Services has extensive reporting capabilities. Our system has a wide variety of standard reports that can be generated on-demand..

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 21

4.5.3. Transaction Reporting. Offeror should describe how its system will comply with the following guidelines:

4.5.3.1. Provide for Electronic Funds Transfer (EFT) Reports to include:

4.5.3.1.1. Daily Transaction Summary Report

4.5.3.1.2. Monthly Reconciliation Report

4.5.3.1.3. Activity Report Detailing:

4.5.3.1.3.1. Location

4.5.3.1.3.2. Number of Transactions

4.5.3.1.3.3. Status successful or rejected

4.5.3.1.3.4. Dollar Amounts

4.5.3.1.3.5. Type of payment

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.3 Transaction Reporting, 4.5.3.1, 4.5.3.1.1, 4.5.3.1.2, 4.5.3.1.3, 4.5.3.1.3.1, 4.5.3.1.3.2, 4.5.3.1.3.3, 4.5.3.1.3.4, 4.5.3.1.3.5.

ViaPath has the capability to report on daily transaction summaries and monthly reconciliations. To support ViaPath’s reconciliation of accounts, ViaPath’s payment systems will be configured to send an automated daily and monthly email that states the total amount of money ACH’d for inmate accounts and a listing of the individual transactions. The emailed information can be formatted to best suit ViaPath’s purposes. For example, transactions and totals can be segregated by deposit source or by facility/institution. The email provides transactions in HTML format and includes an Excel attachment to allow easy importing of the transaction records into other software applications.

In addition to setting up regular transaction reports, ViaPath’s ConnectNetwork reporting platform can provide all the same information on demand to authorized users.

ViaPath’s ConnectNetwork® Services will record and track all deposits and generate reports of activity by individual inmate and totals by facility. ViaPath has the capability of using ConnectNetwork transaction records to report to ADCRR the deposits made to inmate accounts through the various payment channels (e.g., website, mobile app, phone IVR); enabling authorized ADCRR staff to view all EFT transactions. Reports will compile the number of transactions and related dollar values for the selected time frames. The system offers the ability to view all transactions by facility as well as transactions based on the ADCRR-specified criteria, such as individual inmate.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 22

To support ADCRR’s reconciliation of accounts, ViaPath’s payment systems will send an automated email daily that states the total amount of money ACH’d and a listing of the individual transactions. The email can be formatted to present the information as desired by ADCRR, e.g., segregated by deposit source or by facility. The email provides transactions in HTML format and includes an Excel attachment of the transaction records.

One of the available reports is the Deposit Transaction History which can be customized to include the following information:

• Service Type – select the desired inmate service type: Trust, PIN Debit, or Phone

• Start Date – (required) defaults to one day before the current date. Click the Calendar icon to change the start date.

• End Date – (required) defaults to current date. Click the Calendar icon to change the End

Date.

• Facility – select a facility from the drop-down list. (Not available when PIN Debit or Phone service type is selected).

• Cash/Credit – select the type of payment for this transaction: Cash, Credit, or All.

• Deposit Method – select the deposit method: All, Intake, IVR, Money Order, Walk In, Web, WU (Western Union).

• Deposit GUID –refers to the ID number generated for every deposit. The Deposit GUID is commonly used by the ViaPath support team.

• Transaction Number – enter the receipt ID number to search by a specific transaction.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 23

• Depositor Account Number – enter the depositor’s ConnectNetwork account number.

• Account Number – enter the depositor’s ConnectNetwork account number

• Inmate Last Name – enter the inmate’s last name. (Not available when PIN Debit or Phone service type is selected).

• Phone Number – enter the depositor’s phone number. (Not available when Trust or PIN

Debit service type is selected).

• Inmate ID – enter the inmate’s ID number. (Not available when Phone service type is selected).

After you click the Search button, the Transaction History Search Results are displayed at the bottom of the screen.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 24

If desired, the Transaction History can be exported as an Excel spreadsheet as well.

The other available reports look very similar to these. ViaPath’s goal is to make it easy for ADCRR to generate reports in real time and customize them to accommodate their reporting needs. ViaPath is also happy to schedule reports to respond to the needs determined by the ADCRR. The electronic file will also include information on funds received by mail from money orders if that is among the services we provide, along with the transactions processed online, by phone, and Walk- In Retail.

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 25

Daily ACH Report The ViaPath Command interface allows access to ACH statistics and a record of transactions included. This data can be exported for storage. Automated email can also be configured.

Activity Intelligence ViaPath’s ConnectNetwork client interface enables authorized personnel from ADCRR to generate reports that will enable staff to see who is sending money and who the recipients are. Search capabilities enable ADCRR authorized staff to select specific inmates or senders and isolate by payment channel, date range, or other criteria.

ViaPath Data IQ software is the optimal solution for providing ADCRR investigators all linkages involving transactions, including inmate, sender, and any other activity (e.g., telephone calls) associated with these parties to these transactions. The linkages are displayed in easy to

© 2023 ViaPath Technologies ADCRR RFP # BPM005375 | 26 comprehend graphical format, with the ability for investigators to drill down on specific linkage details.

ViaPath Data IQ also can provide the additional advantage of incorporating data for any other ADCRR partner agency enabled via data sharing agreements, whether ViaPath or other vendor.

4.5.3.2. Provide a methodology to audit transaction history reports on an hourly basis. Data format criteria will be provided upon award. Reporting shall include the ability to generate “Payment by day” summary reports, and allow for custom reporting where flexible search criteria are given. All transactions are required to capture the information listed below and then be transmitted electronically as part of the financial transaction. No funds shall be accepted without the verified Name, Address and Telephone Number of the individual sending the funds. Gift Cards, “burner cards” and prepaid/preloaded credit/debit cards will not be accepted.

4.5.3.2.1. Sender Name

4.5.3.2.2. Sender Address

4.5.3.2.3. Sender Phone #

4.5.3.2.4. Payee Name (ADCRR Number supplied by the customer)

4.5.3.2.5. Money Transfer Control Number (MTCN)

4.5.3.2.6. Sequence Number or any unique transaction identification number

4.5.3.2.7. Identification Code

4.5.3.2.8. Transaction Date

4.5.3.2.9. Period (Same Day? Week? Month?)

4.5.3.2.10. Processing time

4.5.3.2.11. Credit/Debit card information

4.5.3.2.12. Account Number

4.5.3.2.13. Method of payment (credit/debit card, cash, mobile app, etc.)

4.5.3.2.14. Transaction Amount

4.5.3.2.15. Currency

4.5.3.2.16. Agent City

4.5.3.2.17. Country

4.5.3.2.18. Transaction Status (Valid, NSF, etc.)

4.5.3.2.19. Transaction Description (identify fee being paid)

4.5.3.2.20. Delivery Status (Pending, Delivered, etc.)

4.5.3.2.21. Delivery Method (Online, Storefront, Telephone, Mobile) Any provisions shown above that Offeror does not agree to comply with are to be listed and described on the Deviations and Exceptions form (Attachment 5 Supplement) and included with Offeror’s submission.

ViaPath has read, understands, and shall comply with section 4 Scope of Services, 4.5 Delivery of Services, 4.5.3 Transaction Reporting, 4.5.3.2, 4.5.3.2.1 through 4.5.3.2.21.

As ADCRR already knows and has become accustomed to, ViaPath has extensive reporting capabilities. Our system has a wide variety of standard reports that can be generated on-demand.

Transaction Auditing At any point in time, whether it be every half hour, every hour, or daily, authorized users can login to the secure ConnectNetwork portal to run and audit reports.