Skip to main content

Keys

Each customer has an RSA-2048 key pair:
  • Private key: kept in the device’s secure hardware (iOS Secure Enclave or Android KeyStore), behind the customer’s biometrics or PIN. It is the only key that can decrypt their receipts.
  • Public key: registered with Vero and looked up by merchants and POS systems to encrypt receipts for that customer. It can lock a receipt but can’t open one.
Keys have a status of active, rotated or revoked, so a lost or compromised key can be retired and replaced. See Generate keys and Register user.

Encryption

Receipts use hybrid encryption:
  1. A random content key encrypts the receipt with AES-256-GCM.
  2. The content key is wrapped with the customer’s public key using RSA-OAEP-SHA256.
  3. Only the customer’s private key can unwrap the content key and decrypt the receipt.
The receipt stays encrypted in transit and at rest. Merchants, issuers and Vero handle only the encrypted copy.

Customers without keys yet

If a customer hasn’t set up keys when they buy something, the receipt is encrypted to an escrow key instead (isEscrowed: true), so it isn’t lost. See Encrypt receipt.

Signatures

Every receipt carries two signatures:
  • Merchant signature: added when the receipt is created, proving it came from that merchant.
  • Issuer signature: added by the card issuer, confirming the transaction took place.
Changing any field breaks the signatures, so the customer’s app shows the receipt as unverified.

Opening a receipt

When the customer taps a purchase, the banking app requests a decrypt token with Grant decrypt access. Tokens:
  • Expire after 2-3 minutes
  • Are limited to 5 active tokens per customer
  • Log the source IP for audit
The app then decrypts the receipt on the device with Decrypt receipt.

Lost devices

If the customer’s banking app backs up its keys, a new phone restores them and old receipts open as before. Without a backup, old receipts can’t be decrypted, by design. The issuer registers a new key pair and new receipts work from then on.

Compliance notes

  • GDPR: the customer controls their personal data through their key.
  • PCI DSS (Payment Card Industry Data Security Standard): receipt data is designed to sit outside the cardholder data scope.
  • Audit: decrypt tokens and signatures leave a cryptographic audit trail.
Check jurisdiction-specific requirements with your compliance team.