Several security vulnerability assessment tools and external vendors are used to test and verify compliance. The full code base is scanned with these tools on a periodic basis. Customers are notified of security patches via direct emails, notifications in the application, and in the Commerce Security Center, and must ensure that these patches are applied to their customized application within 30 days of release according to the PCI guidelines.