Surfboard Payments' P2PE Solution Listed by the PCI Security Standards Council, Covering Nine Terminals
The Surfboard Payments P2PE Solution has been validated against PCI P2PE v3.2 and is now on the PCI SSC list of validated solutions, with nine payment terminals included from the start.
STOCKHOLM, Sweden – November 12, 2026 – Surfboard Payments’ point-to-point encryption solution has been validated against the PCI P2PE v3.2 standard and is now listed by the PCI Security Standards Council under reference 2026-01713.001.
The listing covers nine PCI-approved payment terminals. Among them are the devices behind SurfPrint Pro, SurfPrint Pro K, SurfTouch Pro, SurfTouch Pro Retail, SurfPad Pro, SurfMini and the unattended SurfAlone. Handheld, countertop, PIN pad, compact and unattended terminals are all in the same validated solution.
Point-to-point encryption means card data is encrypted inside the terminal at the moment of tap, insert or swipe, and stays encrypted until it reaches a secure decryption environment. The merchant’s network and point-of-sale systems never see card data in the clear. A PCI listing confirms that an independent assessor has reviewed the whole chain: the devices, the payment application, key management, the decryption environment and the way the solution is managed.
P2PE is a common requirement in enterprise and public-sector tenders, where large merchants use it to keep stores and point-of-sale systems out of the scope of their own PCI assessment. Surfboard now offers the listed solution for enterprise deployments, and software companies and financial institutions building on Surfboard can take it into those discussions with the same API and the full terminal range.
Terminals deployed under P2PE are kept in Surfboard-designated secure storage and shipped directly to the merchant’s locations, as the standard’s chain-of-custody rules require. Existing deployments continue unchanged.
“We took the whole range through in one assessment rather than one terminal at a time.”
Neal Hindocha, CIO of Surfboard Payments, commented: “We took the whole range through in one assessment rather than one terminal at a time, so partners do not have to pick hardware based on which device happens to be certified.”
Aakash Yadav, Head of Compliance at Surfboard Payments, added: “This took a little under a year and touched every team, from the terminal application to key management and logistics. It builds directly on our PCI DSS and PCI PIN work.”
Surfboard Payments’ processing environment is PCI DSS 4.0 certified across Google Cloud, Amazon Web Services and Microsoft Azure. The P2PE solution uses key management and key injection services from NewlandNPT and decryption management on AWS Payment Cryptography, each a PCI-listed P2PE component.
The listing can be verified on the PCI Security Standards Council website by searching for Surfboard.