Security and Stability Considerations for iOS apps

Under default configuration, the SDK already incorporates the following security measures:
  • Prevention of automatically generated screenshots to avoid sensitive card details from being captured on the device.
  • Jailbreak detection, to disable the SDK functionalities due to the security concerns that can arise from a jailbroken system.

However, when developing your app, you are responsible for reviewing and implementing the following security considerations:


App Transport Security (ATS)

You must configure your app properly for App Transport Security (ATS).
Click here to learn how.


Third-Party Keyboard Support

By default, iOS allows third-party apps to override the built-in keyboard. This may pose a risk to the security and compliance of your app, as keystrokes or words may be leaked to untrusted parties. For these reasons, you must disable third-party keyboard support on your payment form. The following example demonstrates this in Swift:

func application(_ application: UIApplication, shouldAllowExtensionPointIdentifier extensionPointIdentifier: UIApplicationExtensionPointIdentifier) -> Bool {
if extensionPointIdentifier == UIApplicationExtensionPointIdentifier.keyboard {
return false
return true


OWASP Top 10

The Open Web Application Security Project (OWASP) maintains a regularly-updated list of the most pressing web application security concerns. We strongly recommend you follow their latest guidelines. Click here to learn more.



PCI Compliance

When processing payments and handling transaction data, you need to ensure your solution is fully compliant with the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS aims to protect customer data from unauthorised access and ultimately to reduce the risk of fraud when processing payments online. Click here to learn more.



Minimising app during payment session

There is currently no way for the Mobile SDK to store the current state of the payment session. Therefore if your app is minimized for a prolonged period (e.g. a few hours), the phone’s OS may close the browser session to better optimise memory usage for other apps and the state of the transaction may potentially be lost.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request