---
title: "Security of the Android Mobile solutions"
description: "Learn about the security of the solutions, security best practices, and compliance with security standards."
url: "https://docs.adyen.com/point-of-sale/mobile-android/security"
source_url: "https://docs.adyen.com/point-of-sale/mobile-android/security.md"
canonical: "https://docs.adyen.com/point-of-sale/mobile-android/security"
last_modified: "2026-04-10T11:25:00+02:00"
language: "en"
---

# Security of the Android Mobile solutions

Learn about the security of the solutions, security best practices, and compliance with security standards.

[View source](/point-of-sale/mobile-android/security.md)

This page discusses various topics related to the security of the Mobile solutions, such as:

* Built-in security of the solutions.
* Security practices you should follow.
* Your role with regard to compliance with security standards.

## Security of the solution

Payments using the Mobile SDK are fully secure:

* Payment details that are read from the customer's payment method (card or digital wallet) are not kept locally on the phone or other mobile device.
* The Mobile SDK sends and receives only encrypted payment messages.
* In addition to encryption, the solutions are secured in multiple other ways, such as code obfuscation and monitoring and attestation of the OS, device, application, and SDK.
* The card reader is a PCI PTS-approved Secure Card Reader (SCR). When using the card reader as the payment interface, the payment details are encrypted immediately.

## Security best practices

To keep the solution secure, you must:

* Keep your Adyen API keys secret and save them securely in your server.
* Never make requests to Adyen APIs directly from the POS app that is installed on the mobile device.
* Set a device passcode on the devices used in your mobile solution.

In addition, you should adhere to the following best practices:

* Follow the guidelines in our [Integration security guide](/development-resources/integration-security-guide).
* Establish secure communication between your server and your POS app, using mutual authentication like mTLS.\
  It is vital to prevent bad actors from modifying Terminal API transaction requests sent from your server to your app.
* Implement user authentication in your POS app, such as a login feature, to ensure only trusted users can operate the app.
* Keep the Mobile SDK updated to the latest version. After a short grace period, we do not accept transaction requests made using an older SDK version.
* Keep the Mobile SDK files secure: only get SDK files directly from trusted Adyen sources; when possible, validate the integrity of the SDK files; do not share SDK files with third parties.
* Keep the operating system on your mobile device updated to the latest version and the latest security patch.
* For internal development and testing only use the **TEST** version of the SDK.

## Wi-Fi security best practices

The security settings of the Wi-Fi network define the type of authentication and encryption used by your router or access point, and the level of privacy protection for data transmitted over its network.

To help ensure that your devices can connect securely and reliably to your network, apply the following security settings to each Wi-Fi router and access point:

* Set to WPA3, WPA2/WPA3, or WPA 2.
* Set a strong password for joining the network.

### Insecure Wi-Fi settings

Do not use our Mobile SDK when connected to a network that uses older, deprecated security protocols. The SDK shows a security warning and cancels the transaction when using insecure settings such as:

* WPA/WPA2 mixed modes
* WPA Personal
* WEP, including WEP Open, WEP Shared, WEP Transitional Security Network, or Dynamic WEP (WEP with 802.1X)
* TKIP, including any security setting with TKIP in the name
* Settings that turn off security, such as None, Open, or Unsecured. Turning off security disables authentication and encryption. This is a risk even if security is turned off temporarily or for a guest network.

## Device passcode

To enhance security and protect against unauthorized refunds, we strongly recommend setting a screen lock passcode on your Android devices.

## PCI MPoC compliance requirements

Payment Card Industry Mobile Payments on COTS (PCI MPoC) is a global standard and program created by the Payment Card Industry Security Standards Council (PCI SSC) to define the security requirements for commercial off-the-shelf (COTS) mobile devices to support payment acceptance channels and consumer verification methods.

Adyen has successfully achieved [PCI MPoC certification for its Tap to Pay on Android SDK](https://listings.pcisecuritystandards.org/popups/mpoc_software.php?reference=2025-01213.001) and its [Adyen Payments app on Android](https://listings.pcisecuritystandards.org/popups/mpoc_solution.php?reference=2026-01213.003). Adyen is also listed as a certified MPoC software vendor. As a certified vendor, Adyen reduces the PCI scope for you at no additional cost.

The Adyen Payments app is fully certified, it carries no additional PCI compliance obligations for you.

To use the Adyen Android SDK for a Tap to Pay or Card reader Mobile solution, PCI requires that you complete a vendor verification assessment. Adyen will submit this assessment to PCI SSC to validate the entire combined solution of your integration with Adyen’s MPoC certified Android SDK.

Reach out to your Adyen contact for more information on completing the assessment.

### Assessment guidelines

To successfully complete the assessment:

* We recommend you use wildcards in your app version, for example v5.x.x or v5xx. The version number provided in the assessment will be published to PCI's website. Using wildcards extends certification across a range of versions. Providing a single version number means only that specific version is certified.

* The assessment must be completed by the company integrating with Adyen's Android mobile SDK. If you integrate with the SDK and then sell the solution to merchants, you are still required to complete the **Physical and Operational Requirements** section, even if you do not physically possess the devices. We recommend:

  * A shared responsibility approach with your merchants, allowing you to fulfill your defined role and complete the assessment successfully. You meet the requirements by pushing recommended security policies and providing an implementation guide to your merchants. We advise providing merchants with the security requirements through your Terms and Conditions or contracts.
  * Inform your merchants that they need to maintain an inventory of devices, which they must be able to provide to Adyen or you upon request.

## See also

* [Manage your Android Mobile integration](/point-of-sale/mobile-android/manage)
* [Integration security guide](/development-resources/integration-security-guide)
