Skip to main content
This page describes the security requirements applicable to the integration and the precautions relating to the processing of personal data and card data.

​
Transport

All requests must be made over HTTPS. Notification endpoints must likewise use HTTPS, since notifications carry personal data of the payer.

​
Custody of credentials

The API key grants full access to the operations of the account, including the transfer of balance. The following practices are recommended:
  • keep the key secret in a credential vault, with restricted and audited access
  • do not record the key or the access token in logs, error messages or monitoring tools
  • restrict the origin of requests to servers under the integrator’s control
  • replace the key upon any suspicion of exposure

​
Card data

The card number and the security code must be sent exclusively to the tokenization operation (POST /card-token). The token returned replaces the card data in subsequent operations, so that the integration does not need to store them. The Payment Card Industry Data Security Standard (PCI DSS) prohibits storage of the security code after authorization and imposes controls on storage of the card number. The extent of the integrator’s obligations depends on how card data passes through its systems and must be assessed by its security function.

​
Personal data

Charge operations and notifications involve personal data of the payer, including name, CPF number, email address and phone number. The processing of such data is subject to Law No. 13,709 of 14 August 2018 (Brazilian General Data Protection Law, LGPD). It is recommended that the integrator:
  • collect and transmit only the data necessary for the purpose of the payment
  • restrict internal access to the notifications received and to the records derived from them
  • define a retention period compatible with its legal and regulatory obligations
  • suppress or mask personal data in application logs

​
Authenticity of notifications

The authenticity of a notification must be confirmed by retrieving the transaction from the API, through GET /transactions/{transactionId}, before performing any irreversible act, such as delivering goods or releasing a service. Retrieval is the reference source on the status of the payment. It is further recommended that the notification endpoint URL not be disclosed and that it contain an unpredictable component.

​
Fraud prevention

Accurate identification of the payer contributes to the risk analysis of transactions. It is recommended to send the payer’s complete data and, when available, the billing address. The handling of disputes over Pix transactions is described in Infractions and MED.