Security at Aera

🚧
Work in progress- not complete documentation
This section is being created. Contact Aera for a full overview.

Aera protects every product on one secure platform. In store, the terminals and the link to your ECR add their own protection. A few things depend on you.

The platform behind all products

Platform and data security

Infrastructure, how your data is protected when stored and sent, and how Aera prevents attacks.

In-store payments

Terminal security

PCI PTS, what happens if someone tampers with a terminal, and the security lock.

Check the terminal's serial number

For ECR developers: make sure the ECR talks to the right terminal.

Security checks and cleaning

For store staff: protect PIN entry and check terminals for tampering.

Install terminals

For merchants: only accept installation from the authorised technician you expect.

Online payments and APIs

Authentication

API keys and access tokens for every request.

Signatures and security

Check that responses and webhooks come from Aera.

Your responsibilities

You	Why
Protect cardholder data in your own equipment, under PCI DSS	For terminals: protect them from tampering and from being swapped
Check terminals regularly and keep a list of them	So you notice a manipulated or swapped terminal
Keep API keys, client secrets and technician passwords secret	Anyone who has them can act as you
Check signatures on responses and webhooks	So you only trust data that comes from Aera

Report a security issue

Found a vulnerability in Aera's services? Email [email protected]. Suspect that a terminal has been tampered with? Contact Aera support at once. Email [email protected].