---
title: "Security of the iOS Mobile solutions"
description: "Learn about the security of the solutions, security best practices, and compliance with security standards."
url: "https://docs.adyen.com/point-of-sale/mobile-ios/security"
source_url: "https://docs.adyen.com/point-of-sale/mobile-ios/security.md"
canonical: "https://docs.adyen.com/point-of-sale/mobile-ios/security"
last_modified: "2026-06-01T15:33:14+02:00"
language: "en"
---

# Security of the iOS Mobile solutions

Learn about the security of the solutions, security best practices, and compliance with security standards.

[View source](/point-of-sale/mobile-ios/security.md)

This page discusses various topics related to the security of the Mobile solutions, such as:

* Built-in security of the solutions.
* Security practices you should follow.
* Your role with regard to compliance with security standards.

## PCI approval of Tap to Pay on iPhone

Tap to Pay on iPhone has been [approved](https://listings.pcisecuritystandards.org/popups/mpoc_solution.php?reference=2025-01597.001) by the Payment Card Industry (PCI) Security Standards Council as a validated Mobile Payments on COTS (MPoC) solution for iOS 18.4 and later.

To ensure ongoing MPoC compliance, Tap to Pay on iPhone supports iOS versions up to a year after the release date of a major, minor, or patch iOS version. For example, iOS 18.4 and iOS 18.4.1 have different release dates and will be supported for Tap to Pay on iPhone until 31 March 2026 and 16 April 2026 respectively.

Apple continues to support Tap to Pay on iPhone on iOS versions earlier than 18.4 as approved by Adyen. However, the same yearly deprecation applies.

What this means for you:

* To benefit from the security of MPoC compliance and optimal Tap to Pay on iPhone performance, your mobile devices need to run iOS 18.4 or later.
* Update the iOS version on your mobile devices within one year of the release date of the major, minor, or patch iOS version that you are using. Establishing a communication session only works within one year of the release date of the iOS version.
* If you are building a new Adyen Mobile solution, target the latest major iOS release.

## Security of the solution

Payments using the Mobile SDK are fully secure:

* Payment details that are read from the customer's payment method (card or digital wallet) are not kept locally on the phone or other mobile device.
* The Mobile SDK sends and receives only encrypted payment messages.
* In addition to encryption, the solutions are secured in multiple other ways, such as code obfuscation and monitoring and attestation of the OS, device, application, and SDK.
* When using an iPhone as the payment interface for Tap to Pay on iPhone, transactions are encrypted and handled using Apple's Secure Element.
* The card reader is a PCI PTS-approved Secure Card Reader (SCR). When using the card reader as the payment interface, the payment details are encrypted immediately.

## Security best practices

To keep the solution secure, you must:

* Keep your Adyen API keys secret and save them securely in your server.
* Never make requests to Adyen APIs directly from the POS app that is installed on the mobile device.
* Set a device passcode on the devices used in your mobile solution.

In addition, you should adhere to the following best practices:

* Follow the guidelines in our [Integration security guide](/development-resources/integration-security-guide).
* Establish secure communication between your server and your POS app, using mutual authentication like mTLS.\
  It is vital to prevent bad actors from modifying Terminal API transaction requests sent from your server to your app.
* Implement user authentication in your POS app, such as a login feature, to ensure only trusted users can operate the app.
* Keep the Mobile SDK updated to the latest version. After a short grace period, we do not accept transaction requests made using an older SDK version.
* Keep the Mobile SDK files secure: only get SDK files directly from trusted Adyen sources; when possible, validate the integrity of the SDK files; do not share SDK files with third parties.
* Keep the operating system on your mobile device updated to the latest version and the latest security patch.
* For internal development and testing only use the **TEST** version of the SDK.

### Setting a device passcode

To maintain the highest degree of security, the iOS SDK uses the iOS keychain in its core functionality. For this reason, you must ensure that a passcode is set on the iOS mobile devices used in your Mobile solution.

Changing the device passcode is not a problem. However, removing the device passcode has negative consequences:

* The device where the passcode was removed can no longer make transactions.
* Store and forward offline payments that were made while a passcode was still set can no longer be recovered.

If for some reason setting a passcode is not ideal in your situation, you can use the following workarounds:

* In the iOS settings, set the display lock to **Never** so that the mobile device does not go to sleep.
* Set a simple passcode that is easy for your staff to remember.

## See also

* [Manage your iOS Mobile integration](/point-of-sale/mobile-ios/manage)
* [Integration security guide](/development-resources/integration-security-guide)
