Purpose

This article outlines the recommendations for Network connectivity for Amazon Just Walk Out (JWO) locations.
 

Process

365 Retail Markets recommends that Amazon Just Walk Out deployments utilize a shared Internet service with dedicated network segmentation for payment processing. Under this architecture, a single Internet service is provided to the location. 

Immediately after the Internet handoff, the connection is divided into two independent network paths:

Corporate Network – Used exclusively for Amazon/client business systems and other non-payment-related devices.

365 Retail Markets Network – A dedicated network used exclusively for 365 Retail Markets payment devices and supporting infrastructure. 

The 365 Retail Markets network should connect directly to a 365 Retail Markets Pronto router. The Pronto router serves as the security boundary for all payment-related communications and establishes a managed, encrypted connection between the payment devices and the payment processor. 

No client-owned firewalls, routers, switches performing Layer 3 routing, VLANs, or other network security devices should exist between the Pronto router and the Internet service unless specifically reviewed and approved by 365 Retail Markets.
 

Assumptions

This recommendation assumes the following:

• A single Internet service is available at the deployment location.
• The Internet connection can be segmented into separate corporate and 365 Retail Markets network paths immediately after the ISP handoff.
• All payment-related communications traverse the 365 Retail Markets Pronto router.
• The proposed architecture will be reviewed and validated with the Amazon Just Walk Out engineering team to ensure compatibility with JWO operational requirements. 

If these assumptions cannot be met, alternative deployment architectures should be evaluated jointly by Amazon and 365 Retail Markets during the solution design phase.
 

Benefits 

Simplified Deployment: A single Internet service supports both the corporate environment and the 365 Retail Markets payment environment while maintaining complete network separation.

Reduced PCI Scope: Payment card data is encrypted at the payment device and transmitted through an encrypted tunnel directly to the payment processor. Because payment traffic remains on the dedicated 365-managed network, the client's corporate network is not part of the payment environment.

Operational Independence: Changes to the client's corporate network—including firewall changes, VLAN modifications, wireless updates, or security policy changes—do not impact payment processing.

365 Managed Infrastructure: The Pronto router enables 365 Retail Markets to maintain visibility into payment-related communications, deploy approved security configurations, perform remote diagnostics, and manage the payment environment without requiring access to the client's corporate network.
 

Network Connectivity 

The recommended architecture is transport-agnostic. The final connection between the 365 Retail Markets network and supported devices may utilize Ethernet, Wi-Fi, or other approved connection methods as defined in the implementation guide. Regardless of the transport method, all payment-related communications should traverse the dedicated 365 Retail Markets managed network through the Pronto router. 

This architecture minimizes dependencies on the client's IT infrastructure while providing a consistent, supportable, and secure payment environment.