Security Handling Requirements

This secure-data flow protects sensitive card data in transit, but it does not by itself authenticate the device or verify the identity of the cardholder.

• Apply device trust checks before allowing secure-data access.
• Authenticate the cardholder before initiating the secure-data flow.
• Authorize the requested secure-data action before sending the request.
• When operating outside PCI DSS scope, key generation, encryption, and decryption should happen on the cardholder device or secure client application.
• Only encrypted data should be sent to backend systems. Backend services should never receive or process clear sensitive card data in this model.