What we hold, and how to check it.
DexProtector and the Licel vTEE hold EMVCo Security Evaluation Certificates under the SBMP and SBMP TEE categories respectively. Both are listed publicly, and both are renewed annually.
What is EMVCo?
EMVCo is a global technical body responsible for the secure integration of card-based payment products worldwide. It is collectively owned by American Express, Discover, JCB, Mastercard, UnionPay, and Visa.
Its specifications set out how mobile payment solutions should be protected, and other programs build on them. PCI MPoC, for example, references EMVCo SBMP for its software-protected cryptography requirements. So an EMVCo evaluation is often relevant well beyond payments acceptance itself.
Our EMVCo-evaluated products
EMVCo evaluates products against its security guidelines for mobile payments. Two apply to what we build at Licel.
A NOTE FROM EMVCo
EMVCo issuance of a certificate for the Product shall mean only that the Product has been evaluated in accordance and for sufficient conformance with the EMV Security Guidelines for SBMP and TEE-based Mobile Payment as of the date of evaluation.
EMVCo's certificate is not in any way an endorsement or warranty regarding the completeness of the security evaluation process or the security, functionality, quality or performance of any particular product or service. EMVCo does not warrant any products or services provided by third parties, including, but not limited to, the producer or provider of the Product and EMVCo approval does not under any circumstances include or imply any product warranties from EMVCo, including, without limitation, any implied warranties of merchantability, fitness for purpose, or non-infringement, all of which are expressly disclaimed by EMVCo.
All rights and remedies regarding products and services which have received EMVCo approval shall be provided by the party providing such products or services, and not by EMVCo and EMVCo accepts no liability whatsoever in connection therewith.
Security Guidelines for Software-based Mobile Payments (SBMP)
Covers mobile payment solutions, including mobile wallets. Within it, the Software Protection Tools (SPT) category evaluates the mechanisms that protect the application itself: code and resource hardening, integrity control, runtime protection, and secure communication.
DexProtector is approved under SBMP SPT.
Security Guidelines for TEE-based Mobile Payments
Covers the use of Trusted Execution Environments to protect applications handling sensitive transactions, including the cryptographic protections those operations require.
The Licel vTEE is approved under SBMP TEE.
DexProtector
Approved under SBMP SPT for six consecutive years, and the first software protection tool evaluated for both Android and iOS.
Approval SECN0030.06 · Evaluated by Applus+ Laboratories
Licel vTEE
Approved under SBMP TEE for Android and iOS for three consecutive cycles.
Approvals SECN0117.02 and SECN0113.02 · Evaluated by Applus+ Laboratories
Our approvals, on EMVCo’s own list
EMVCo publishes every current approval, with evaluation data and annual review date attached. On the Evaluated Products list, set Product Status to Active Products and SBMP Components to Software Protection Tools to find DexProtector, or to TEE to find the Licel vTEE.
Approvals carry an annual review date and lapse if they aren't renewed. DexProtector has been renewed every year since December 2020.
What EMVCo evaluation means
EMVCo evaluation and approval means the protection mechanisms in DexProtector and the Licel vTEE have been assessed by an accredited independent laboratory — in our case Applus+ Laboratories — to a published specification.
When your own solution is assessed, whether under PCI MPoC or EMVCO SBMP directly, the software protection components are already evaluated, and the evidence for them already exists. That reduces what your assessor has to establish from scratch.
Our commitment to continuous security.
The best security is continuous, because attackers are constantly evolving their methods and looking for gaps.
Security reviews, work with security researchers, and feedback from DexProtector and Licel vTEE users all feed into that. Annual EMVCo evaluation is how we hold ourselves to this commitment: each year the current version of the product goes back in front of an independent laboratory, not the version that was approved last time.