July 12, 2023
Hey! First post.
Recently I had to purchase an item for the upcoming school year. My school district uses the SchoolPay storefront, and for this particular item, it repeatedly crashed or errored out at the checkout page. The homepage is more or less what you would expect:
During the purchasing process, I took a little break in case we students had all DDoSed the server, and went browsing through the links at the bottom of the SchoolPay page. The footer of the homepage is fairly simple:
"Security" creates a little popup window assuring you of SchoolPay's security, nothing special:
"Terms of Service" links to a AWS-hosted PDF file. Good job self-hosting your own legal documents, SchoolPay. Notably, the footer of this PDF links to https://mypaynet.com, the payment service that SchoolPay appears to use.
Most interesting, however, is the Privacy Policy link. This brings you to https://www.i3verticals.com/privacy-policy/. This page has clearly barely been updated from the original template (see "The Company" in the "Ethics & Compliance" section) but the interesting part is the footer:
Wow, that's a lot of banks.
In the Privacy Policy PDF, on the first page, under section 2, they link to Entities.pdf. This is a list of every associated business partner/company/website that works with i3Verticals. There are a lot, let's dig in.
This is https://payschools.com. It's strange that i3Verticals would have a competitor to SchoolPay with an almost identical name. Their "About Us" page claims that PaySchools systems are used by "over 8,000 schools, in 43 states, and we service over six million students". They also advertise systems like "PaySchools Mobile" and the "Pay at School System (PASS)". Just average crappy school software.
The 2000s called, they want their Frutiger Aero design language back. (Also, nice carefully-edited-in "2023" copyright date). The "Terms and Conditions" link is dead, as is "www.866myezpay.com", but the Privacy Policy link takes you to the February 2017 edition of the PaySchools Privacy Policy.
Impressive. This looks like an old administrative tool for EZpay, which appears to not have a actual homepage. If you're curious: https://spsezpayadmintools.com
This is https://locallevelevents.com. They create online ticketing systems for local level events. Interestingly, the "About Us" page says that the company was created in 2011, and was then bought by i3Verticals in 2015.
PlacePay is some long-lost McDonald's promotion, but rather a system for residential and commercial payments, like rent. Their "About Us" page goes straight to a nginx 404 page. Unlike the other companies, this one seems to be quite proud of the fact that it's part of i3Verticals.
Nice. Keep in mind, this is the link that i3Verticals proudly placed in the Entities PDF.
iGovSolutions offers licensing systems for healthcare, real estate, contractors, and the like. That's all.
That background is a looping video, where the keys come onto the keyboard and start typing. Court Solutions also advertises their benefits on their front page:
Can we not advertise the use of a security protocol deprecated in 2015? Obviously they mean TLS, but still...also, several of the other sites also claim to use SSL for security.
Plus, be aware: if you commit a crime that results in a fee, you may end up paying some amount to Court Solutions.
I'm not writing about every single one of these companies. They're all kind of the same thing, either payment systems or management solutions or some kind of combination. Put simply (I'm skipping over "Corporate", which is just i3verticals.com, and "i3 Point of Sale - Hospitality", which is the same as the Retail one below):
To start with, SSI offers license plate recognition, which appears to be outsourced to Vigilant Solutions. On their Solutions page, they list some solutions they sell (the brownish texts are actually links):
Let's break these down:
That's the public safety suite. It appears to be mostly drop-in software for law enforcement. However, there's more.
"Other Solutions" takes you to this page:
SSI doesn't actually make license plate recognition software. Instead, they resell Vigilant Solutions LPR software. According to Wikipedia, citing bizjournals.com, Motorola Solutions acquired VaaS International Holdings, which owned Vigilant Solutions as a subsidiary, for $445 million in January 2019. Motorola Solutions also owns many other security companies. I wouldn't be surprised if SSI doesn't actually resell Vigilant software anymore, since the Motorola acquisition.
i3Verticals is a company ("Independent Sales Organization, to be exact") of 7 different banks. They own many brands and companies that make products for use in the public sector. The range of products they make is quite large, and you might be using an i3Verticals product all the time without knowing it. Their product range is almost humorous, from school payment systems to medical records management software to law enforcement spyware.
Now you know all that. I hope you feel enlightened.