Mobile Security Guidelines

Security Best Practices

Essential security practices for mobile apps that handle payment card data. Follow these guidelines to protect your users and maintain PCI-DSS compliance.

Data Storage

Never store PANs in plaintext

Always encrypt or tokenize card numbers before storage.

Use platform-secure storage

iOS Keychain, Android EncryptedSharedPreferences, or hardware-backed keystores.

Minimize data retention

Only store what's absolutely necessary and purge data when no longer needed.

Avoid logging sensitive data

Never log card numbers, CVVs, or authentication credentials.

Network Security

Implement certificate pinning

Pin your server's certificate or public key to prevent MITM attacks.

Use TLS 1.2 or higher

Disable older protocols like SSLv3, TLS 1.0, and TLS 1.1.

Validate certificates properly

Never disable certificate validation, even in development.

Disable cleartext traffic

Configure your app to reject all HTTP connections.

Authentication

Implement strong authentication

Use biometrics, secure PINs, or multi-factor authentication.

Secure session management

Use short-lived tokens and implement proper session timeout.

Protect credentials in transit

Never send passwords in URL parameters or cleartext.

Rate limit authentication attempts

Prevent brute force attacks with exponential backoff.

Code Security

Remove debug code

Strip debug flags, test credentials, and verbose logging in production.

Obfuscate sensitive logic

Use code obfuscation to protect payment processing code.

Validate all inputs

Sanitize user inputs to prevent injection attacks.

Use secure random generation

Use cryptographically secure random number generators.

Runtime Protection

Detect rooted/jailbroken devices

Warn users or restrict functionality on compromised devices.

Implement anti-tampering

Detect app modification and respond appropriately.

Protect against screen capture

Prevent screenshots of sensitive payment screens.

Secure the keyboard

Use secure text entry for sensitive fields.

Cryptography

Use strong algorithms

AES-256 for encryption, SHA-256+ for hashing. Avoid MD5/SHA1.

Proper key management

Store keys in hardware-backed keystores, never in code.

Use authenticated encryption

Prefer AES-GCM over AES-CBC for encryption.

Secure key derivation

Use PBKDF2, Argon2, or scrypt for password-based keys.

Common Mistakes to Avoid

  • •Storing card data in UserDefaults, SharedPreferences, or local databases without encryption
  • •Disabling SSL/TLS certificate validation for "testing purposes" and forgetting to re-enable
  • •Hardcoding API keys, encryption keys, or credentials in the app binary
  • •Using deprecated cryptographic algorithms like MD5, SHA1, or DES
  • •Logging sensitive data that ends up in crash reports or analytics

Verify Your Security Implementation

Upload your app to automatically check against these best practices and 847 PCI-DSS requirements.

Cookie preferences

We use necessary storage for security and login. With your permission, we also use analytics to understand page journeys and marketing pixels to measure ad campaigns.