Security & Compliance

PCI DSS v4.0 — Level 1 Service Provider

Handpoint is certified as a PCI DSS v4.0 Level 1 Service Provider — the highest compliance tier, requiring an annual on-site assessment by a Qualified Security Assessor (QSA).

Verify the listing: search for "Handpoint" on the Visa Global Registry of Service Providers.

PCI-P2PE Validated Android SDK

The Handpoint Android SDK (used by the Handpoint App on all PAX devices) is PCI-P2PE validated, meaning card data is encrypted at the point of interaction before it can be read by any software layer, including the ISV application.

Verify the listing: search for "handpoint" on the PCI Security Standards Council solution search.

What this means for integrators

Integrating with a PCI-P2PE validated solution can significantly reduce your own PCI compliance scope. Because cardholder data is encrypted before it reaches your application, ISVs using Handpoint's validated SDK typically qualify for the SAQ P2PE questionnaire (~35 questions) rather than the full SAQ D (~300+ questions).

For more background: PCI SSC Point-to-Point Encryption solutions.