Security
Certified, monitored and open to researchers.
Switchio, operated by MONET+, keeps its platform certified to the payment industry standards and welcomes responsible security research.
Certifications
Audited by the standards that matter.
The certifications cover the platform, the payment application and SoftPOS.
- PCI DSS
- Certified every year
- PCI PTS
- Certified every two years
- PCI P2PE
- Point to point encryption, for P2PE solutions and P2PE components
- PCI MPoC
- Certified SoftPOS solution
- ISO 27001
- Information security management
Operations
Security is also how we run it.
- Monitored in real timeEvery component, from applications to networks, is monitored continuously, so issues are found and fixed before they reach payments.
- A secure development lifecycleSegregated environments, code reviews and testing before every deployment, on thirty years of MONET+ experience with payment security.
- Keys kept away from merchantsPoint to point encryption and key shielding protect card data from the terminal to the host.
Security and vulnerability disclosure
Switchio, operated by MONET+, is committed to maintaining the highest level of security for the Switchio platform and related services. We welcome responsible security research and encourage the reporting of potential vulnerabilities.
Reporting a security vulnerability
If you believe you have identified a security vulnerability affecting the Switchio platform, services, APIs or websites, please report it to security@switchio.com with the subject Security Vulnerability Report. To help us investigate efficiently, please write the report in English and include:
- a description of the vulnerability
- the affected component and version
- steps to reproduce the issue, including a proof of concept if available
- the potential impact
- your contact information
We aim to acknowledge receipt of your report within 3 business days.
Our commitment
All reports are handled in accordance with our internal vulnerability management procedures. Switchio will not initiate legal action against individuals who report vulnerabilities in good faith and in compliance with this policy.
Responsible disclosure guidelines
- Do not publicly disclose the vulnerability before it has been investigated and resolved.
- Do not exploit the vulnerability beyond what is necessary to demonstrate its existence.
- Do not access, modify or delete data that does not belong to you.
Reward policy
Switchio currently does not operate a bug bounty programme and does not provide financial rewards or compensation for vulnerability reports.
Scope
This policy applies to:
- Switchio platform backend services and APIs
- the Switchio SoftPOS solution
- the official switchio.com websites
Out of scope:
- standard software bugs, functional defects, usability issues and feature requests, which go to the Switchio support portal
- third party services integrated with Switchio