Security
Reporting vulnerabilities
If you believe GOV.UK Pay security has been breached, contact us immediately at govuk-pay-support@digital.cabinet-office.gov.uk. If you are a live user and the suspected breach is severe, consider using the urgent contact details provided to your service manager.
Do not disclose the details of a suspected breach publicly until it has been fixed. GOV.UK Pay can work with you on any communication and reporting needs.
Securing your developer keys
GOV.UK Pay lets you create as many API keys as you want.
We recommend letting all your developers experiment with their own test keys in the test environment, but keys for real integrations should only be shared with the minimum number of people necessary.
This is because these keys can be used to create and manipulate payments. You must not commit these keys to public source code repositories.
Follow these steps to revoke your API key immediately if you believe it has been accidentally shared or compromised:
Sign in to the GOV.UK Pay admin tool.
Select the correct accounts in the My services section.
Select API keys.
Revoke all compromised API keys.
To further secure your live developer keys:
periodically rotate the keys that are used for live payments
you should consider rotating keys that are used for live payments after staff members leave that had access to those keys
avoid embedding your developer keys in any of your code - this only increases the risk that they will be discovered (instead store your keys inside your configuration files)
avoid storing your API keys in your application source tree (even when you’re not making your source code publicly available)
revoke your developer keys when they’re no longer needed (this limits the number of entry points into your account)
have a leavers’ process, so that a developer’s API key is revoked when they leave
We’re investigating ways to make sure that publicly exposed keys are revoked quickly.
Securing your integration with GOV.UK Pay
Make sure you’ve fully tested your integration with GOV.UK Pay. When doing so, take care not to use any real card numbers. Read more about testing.
Securing your users’ information
GOV.UK Pay does not store full card numbers or CVV data for security reasons. This means you will not be able to search for transactions using card numbers. You can, however, search for the first six digits and the last four digits of a card.
Preventing fraudulent payments
If you think you’re receiving fraudulent payments, you can:
- block users from paying with prepaid cards
- delay capture of payments if you need time to do your own anti-fraud checks
- check your payment service provider’s (PSP’s) security settings, or contact us if your PSP is Stripe
You can also set up your account to make risk management fraud checks if your PSP is Worldpay
If you make risk management fraud checks, you must contact us and ask us to send your user’s IP address to your PSP during each payment, or your payments may stop working.
Cloud security principles
GOV.UK Pay has implemented the Cloud Security Principles. Read the National Cyber Security Centre guidance on implementing the Cloud Security Principles for more information.
How GOV.UK Pay handles transaction data
We only collect the data necessary to run GOV.UK Pay.
We will not retain data any longer than we need it, and definitely no longer than 7 years. After 7 years, you can generate reports that show transaction volume and values, but you will not be able to get information about specific transactions.
We’ll only share transaction data if it’s necessary to run GOV.UK Pay or if required by law.
GOV.UK Pay is the data processor and your service is the data controller. The data protection/data processing agreement is in schedule 4 of the memorandum of understanding and schedule 5 of the contract. Both documents are available from the GOV.UK Pay admin tool.
Payment Card Industry (PCI) compliance
Anyone involved with the processing, transmission, or storage of cardholder data must comply with the Payment Card Industry Data Security Standards (PCI DSS).
GOV.UK Pay is certified as fully compliant as a Level 1 Service Provider with PCI DSS version 4.0.
All GOV.UK Pay partners and any services that take MOTO payments through GOV.UK Pay must comply with PCI DSS v4.0 by 31 March 2025.
If your service takes MOTO payments, you should familiarise yourself with the the changes from PCI DSS v3.2.1 to v4.0.
You may be asked to provide certain information from GOV.UK Pay as part of your own PCI DSS compliance process. You can see our PCI DSS Attestation of Compliance by signing into the GOV.UK Pay admin tool and selecting Attestation of Compliance for PCI in the footer.
Use your Merchant ID to report PCI DSS compliance
A merchant ID is a unique number that identifies you to your payment processor and acquiring bank. The recommended approach is to report PCI DSS compliance by MID by:
agreeing with your acquiring bank to allocate an unique MID for each separate payment channel you have in place
reporting your PCI DSS compliance status for each of these unique MIDs to your acquiring bank
If you have one MID that encompasses multiple payment channels, the compliance requirements will be more complex for that MID. You should check the PCI DSS for more information.
Determine your PCI DSS compliance requirements
Your requirements depend on the number of transactions that you process as a merchant per scheme (Visa, MasterCard) per year.
For example, if you process 4 million transactions with Visa and 3 million with MasterCard, the ’Fewer than 6 million transactions per year’ category still applies despite the fact that the total number of transactions is larger than 6 million.
Confirm your merchant level with your acquiring bank.
Assessing your compliance requirements
Process fewer than 6 million transactions per year
If you process fewer than 6 million transactions per scheme per year, you may be able to self-assess by completing one of the PCI DSS Self-Assessment Questionnaires (SAQs). This is a self-assessment tool to assess security for cardholder data.
For most services using GOV.UK Pay, SAQ A should apply. If your service uses MOTO payments, you may need to choose a different SAQ.
To make sure you complete the appropriate SAQ, follow the decision tree on the final page of the PCI SAQ guidance.
Process more than 6 million transactions per year
If you process more than 6 million transactions per scheme per year, you will need to complete a formal on-site security assessment by a PCI DSS Qualified Security Assessor (QSA).
It may be possible to be assessed against only the SAQ A requirements but this should be discussed with your own PCI DSS compliance team and your acquiring bank.
More information on this can be found at the PCI Security Standards Council website.
Your service manager may also be asked to supply extra evidence on your internal security protocols, and you may have to complete security awareness training to make sure you are qualified to handle credit card data.
HTTPS
GOV.UK Pay follows government HTTPS security guidelines. The Hypertext Transfer Protocol Secure (HTTPS), which involves the Transport Layer Security (TLS) protocol is used by the platform to authenticate servers / clients and to provide secure connections.
You must use HTTPS for all direct communication between your service and GOV.UK Pay.
You must use a current TLS cipher. We recommend TLS 1.3.
Return URLs for live services using GOV.UK Pay must use HTTPS, but you can use HTTP for return URLs with test accounts.