Payment providers looking to launch phone-based card acceptance now have three PCI-validated routes to market through Castles Technology, a company focused on Android payment acceptance. The firm has completed validation under the PCI Mobile Payments on COTS (MPoC) standard for its Attestation and Monitoring (A&M) Service and its end-to-end MPoC Solution, which join its previously validated MPoC Software. With all three elements now certified, acquirers, payment service providers, gateways, and independent software vendors can choose how much of the SoftPOS stack they build, outsource, or deploy ready-made.
PCI MPoC sets security requirements for software-based acceptance on commercial off-the-shelf devices such as smartphones and tablets. Beyond the transaction itself, the standard focuses on the ongoing protection of the device environment, including attestation and monitoring. Castles Technology’s isolated MPoC SDK can be embedded into existing merchant or business applications, letting partners keep control over branding, user experience, and workflows. Its A&M Service, hosted and operated by the company, supplies device attestation, security monitoring, and risk assessment, reducing the need to develop and run that capability in-house.
Complete solution and wider acceptance strategy
For organisations wanting a full deployment model, the validated end-to-end MPoC Solution lowers engineering and integration requirements and can shorten the path to commercial rollout. The CastlesPay MPoC Solution runs on Android devices and supports contactless acceptance alongside PIN entry directly on the handset. Jean-Philippe Niedergang, CEO at Castles Technology, said the question for many payment providers has shifted from whether to offer SoftPOS to how, noting that some prefer owning the entire experience while others prioritise speed to market or want to avoid constructing complex security infrastructure.
SoftPOS is becoming an established part of the payments landscape as businesses seek flexible ways to take cards in varied settings. Use cases include table service, queue-busting, deliveries, field sales, and pop-up retail, while smaller merchants gain an entry point into card acceptance without conventional point-of-sale equipment. Castles Technology positions the portfolio alongside its Android payment terminals and CaSERV managed payment services, viewing phone-based acceptance as an extension of dedicated hardware rather than a replacement. As many firms operate across both formats, consistent security, reliability, and support at every point of interaction become a practical requirement.
