Compliance

The Paze component follows Paze's digital wallet guidelines for mobile implementation. This page outlines key requirements for compliance with Paze branding, security, and data handling standards on Android.

Your app must meet these platform requirements:

• Android API 24+: Set your minSdk to 24 or later.
• Jetpack Compose: The Paze button renders as a Compose component via component.Content(modifier).
• Custom Tab checkout: Paze checkout opens in a Chrome Custom Tab. Ensure a Custom Tabs-compatible browser is available on target devices.
• Checkout redirect: The SDK merges PazeSdkRedirectActivity for pxpcheckout://callback and pxpcheckout://paze, so you don't need your own intent filter for these default schemes. Create PxpCheckout with an Activity Context, implement onNewIntent, and call deliverPazeCheckoutResult. See Implementation.
• HTTPS only: API calls to PXP and Paze use HTTPS. Don't disable network security configuration for production builds.

Session and credential handling must follow these rules:

• Backend session creation: Create sessions on your backend with HMAC authentication. Never embed hmacKey, encryptionKey, API tokens, or Paze credentials in your app binary.
• Environment matching: Use UAT credentials with Environment.TEST and production credentials with Environment.LIVE.

Paze transactions are subject to these currency and region constraints:

• USD only: Paze currently supports USD transactions exclusively. The SDK validates currency at presentment and throws SDK1213 for other currencies.
• E-commerce entry type: Set transactionData.entryType to EntryType.Ecom when initialising the SDK. Paze expects an e-commerce entry type on the authorisation request. The standalone button doesn't validate entry type at presentment.
• Shopper identity: When provided, emailAddress must be a valid RFC 5322-style email and phoneNumber must be in US E.164 format without the + prefix (11 digits starting with 1, for example 15551234567). Both fields are optional but validated when set.
• Card networks: Visa, Mastercard, and Discover are supported.

Your Unity Portal Paze account must include:

• Client ID: Valid Paze client ID configured in the Unity Portal and present in the session response. Missing values throw SDK1202 at presentment.
• Profile ID: Optional profile ID if provided by Paze.
• Merchant category code: Required in the session for payment completion (merchantCategoryCode). Missing values throw SDK1202A when the SDK builds the complete request.

The component renders official Paze button artwork. Use only the supported PazeButtonStyleConfig values:

Follow these security requirements:

• Never store raw card numbers, cryptograms, or network tokens in app storage (SharedPreferences, files, or logs).
• Validate all decrypted token data on your secure server before fulfilling orders.
• Implement proper error handling and logging without exposing sensitive payment data.
• Use HMAC authentication for all backend API calls.
• Deliver checkout redirects only through deliverPazeCheckoutResult. Don't parse Paze callback URLs manually in production unless using a custom scheme integration.

Handle shopper and payment data as follows:

• Only collect identity data required for checkout (emailAddress, phoneNumber on the component). When set, these fields are validated and forwarded to the Paze create-session request.
• Comply with applicable privacy regulations (CCPA, state privacy laws, Google Play data safety requirements, and so on).
• Handle securedPayload and decrypted token data only on your backend when using manual decryption.
• Verify transaction results on your backend before order fulfilment.
• Don't log full securedPayload values or network tokens in production.

After a successful payment, verify the transaction on your backend:

1. Retrieve the transaction status from the PXP API using the systemTransactionId.
2. Confirm the amount and currency match your order.
3. Only then fulfil the order or grant access to digital goods.

See Implementation.

Paze checkout uses Chrome Custom Tabs and redirects to pxpcheckout://callback or pxpcheckout://paze. Ensure that:

• Your host Activity implements onNewIntent and calls deliverPazeCheckoutResult.
• You create PxpCheckout with an Activity Context so the SDK can register the host for redirect forwarding.
• You don't log or expose callback URLs containing checkout response data in production.
• For custom callback schemes, register intent filters only for schemes unique to your application.

When performAVS = true, the SDK automatically adds billing address data from the decrypted payload to the addressVerification field of the transaction request when available. Set billingPreference to ALL so the Paze wallet returns a billing address.

Keep these AVS rules in mind:

• AVS is applied only when performAVS is explicitly true.
• AVS results should inform rather than replace your broader fraud strategy.

If you handle decryption on your backend (onPreDecryption returns false), add addressVerification to your server-side transaction request using billing data from the decrypt response.

When integrating Kount risk screening:

• Pass device and session data through onPreAuthorisation using PazePreAuthorisationResult.TransactionInitData(...).
• Set kountDisabled = true on PxpSdkConfig only if your fraud strategy doesn't require Kount device fingerprinting.
• Review Kount screening results before fulfilling high-value orders.

We recommend the following implementation practices:

• Use PazeButtonStyleConfig with approved colour, shape, and label values.
• Present the Paze button with equal prominence to other payment methods.
• Provide emailAddress and phoneNumber when you have verified shopper identity. Both are optional but validated when provided and forwarded to create-session when set.
• Implement onGetShopper on PxpSdkConfig with a stable shopper id for authorisation.
• Implement comprehensive error handling with clear, user-friendly messages.
• Test thoroughly in UAT on physical devices with Chrome installed before switching to live credentials.

Apply these security practices:

• Never log or store raw card numbers, cryptograms, or network tokens.
• Fetch session data from your backend at runtime; don't hardcode credentials.
• Validate decrypted token data and verify transaction results on your backend before order fulfilment.

Monitor your Paze integration with these checks:

• Track payment success and failure rates using analytics events.
• Monitor Custom Tab availability with onPresentmentResolved and button presentment with PazeButtonRendered.
• Test checkout flows after Android OS and SDK updates, including redirect handling after app reinstall.