The certified payment engine that every Tapped product runs on.

What you're actually buying when you buy Tap Core

"Payment processing" is a fig leaf over six distinct specialist builds: a certified EMV kernel that talks to the chip, a cryptography stack that signs every transaction against a scheme-provisioned key, scheme membership that gets your BIN ranges assigned, a clearing-and-settlement layer that reconciles against issuer netting files, a dispute pipeline that handles chargebacks within scheme SLAs, and a PCI-DSS environment that keeps all of the above audited. Each takes a year and a team of specialists. Tap Core is all six, as a single managed product.

You consume Tap Core as HTTP. One endpoint per transaction, one webhook per state change. Everything above, cryptogram verification, cardholder verification method (CVM) selection, clearing-file generation, scheme reporting, is handled for you and audited on your behalf.

Certifications we hold so you don't have to

• EMVCo Level 1 & Level 2. Contactless interface and kernel, re-certified on every major kernel version.
• EMVCo Level 3. End-to-end payment application certified per acquirer, per scheme, per market, nineteen live L3 certificates today, another twenty-three in the pipeline through 2027.
• PCI MPoC v1.1. Mobile Payments on COTS, the successor framework to PCI CPoC and PCI SPoC. Authorises contactless and PIN-on-Glass on off-the-shelf phones.
• PCI-DSS Level 1. Annual on-site audit, quarterly ASV scans, continuous control monitoring.
• PCI PIN Security. Key management, HSM operations, and PIN handling across the key lifecycle.
• SOC 2 Type II. Security, availability, and confidentiality, report shared under NDA.
• ISO 27001 & ISO 22301. Information security management and business continuity.

Schemes and domestic networks

Tap Core holds direct principal-member relationships with the international schemes and partners with the domestic networks that actually move the money in Asia. We’re not wrapping someone else’s wrap.

Cryptography, keys, and the HSM

Every transaction Tap Core clears is signed inside a FIPS 140-2 Level 3 HSM. Keys are ceremony-generated, dual-controlled, and scope-restricted, your platform never sees a scheme key and never touches PAN data in the clear. We run redundant HSMs in each region for high availability and run an annual key-rotation ceremony with an independent QSA witness.

• DUKPT derived unique keys for every terminal and every transaction.
• P2PE architecture, PAN encrypted at the secure element, only decrypted inside the HSM for authorisation.
• 3DS 2.x for the rare card-not-present flow that co-exists with in-person taps.
• Tokenisation for stored credentials, customer tokens the merchant can charge against without re-collecting card data.

The numbers we hold ourselves to

Tap Core is measured in four places: latency, availability, authorisation rate, and dispute win rate. These numbers are posted on our status page in rolling 30-day windows and are part of every SLA we sign.

// Tap Core · 30-day rolling · as of 2026-04-18
authorisation_latency_p50      = 612 ms
authorisation_latency_p99      = 1.14 s
availability                   = 99.993 %  // SLA 99.99%
scheme_authorisation_rate      = 97.8 %
dispute_win_rate (2025 F&B)    = 71 %
key_rotation_last_ceremony     = 2026-03-04 (witnessed)

Standalone licensing

Tap Core is a standalone product. Acquirers, PSPs, and processors in APAC license the kernel, the HSM layer, and the scheme-submission engine directly, without using Tapped Onboard or Tapped Terminal. If you already have merchant relationships and BINs but want to skip the EMVCo re-cert treadmill, this is the build you’re replacing. Talk to sales for the architecture doc.