Application Review and Signing for Axium SmartPOS
If you are building your own Android application to run on Axium SmartPOS devices (the all-in-one integration type), your application must be reviewed by NMI and securely signed before it can be deployed to production devices. This page explains how that works, from first access to deployment across your fleet.
Note: This applies to all-in-one applications that run directly on the device. If you are using the semi-integrated integration type, where your POS drives the device over Bluetooth using the NMI Payment Device SDK for Android, you do not need to sign an application for the device.
Why applications are reviewed and signed
Axium SmartPOS runs on Ingenico Axium hardware and is delivered as a PCI P2PE solution. To keep that protection intact:
- Any application intended to run on a production Axium device must be signed. Unsigned applications cannot be deployed to production devices.
- Under PCI P2PE requirements, third-party applications must be reviewed before they are approved to run alongside the payment application on a P2PE device.
- Each partner's applications are signed against a signing credential unique to that partner. This keeps your applications and activity visible only to you, and allows access to be revoked if a security concern arises.
How it works
| Step | Who | What happens |
|---|---|---|
| You and NMI Support | Enable Estate Manager and receive your partner code |
| You and NMI devices team | Contact [email protected] to request the security attestation questionnaire, and return it when completed. |
| You and NMI devices team | Send the APK and questionnaire to the NMI devices team at [email protected] |
| NMI devices team | Static review of the APK |
| NMI devices team | Approved APKs are signed and returned to you |
| You | Upload the signed APK to Estate Manager and roll it out |
1. Get access
- Enable Encrypted Devices on your gateway account, as you would for any other device product.
- Request Estate Manager access through NMI Support. NMI will issue a unique partner code, which ties your devices to your estate.
Estate Manager is organised as a hierarchy of Region, Sponsor and Estate. Region is reserved for NMI. Each partner is allocated their own Sponsor, and the Estate beneath it is yours to manage. Users you create can only see your Sponsor.
2. Complete the security attestation questionnaire
The questionnaire is a set of Yes/No attestation questions. Where an answer requires context, you will be asked to add a short explanation. There are no long-form essay questions.
Complete the questionnaire accurately. Your answers are part of the review record for your application.
3. Submit your application
Submit the following to the NMI devices team via [submission channel: TBC]:
| Item | Required |
|---|---|
| Application package (APK) | Yes |
| Completed security attestation questionnaire | Yes |
| Supporting documentation (for example, architecture notes or third-party library details) | Optional |
The APK is the only required attachment. Supporting items are optional but can speed up review if your application uses features that are likely to prompt questions.
4. Review
The NMI devices team reviews your APK using static analysis only. Your application is not executed or dynamically tested as part of this review.
5. Signing
- Approved: the devices team signs your APK and returns the signed package to you.
- Not approved: you will receive feedback on what needs to change. Update your application and resubmit.
A signature applies to the specific APK that was reviewed. Any new build of your application must be submitted for review and signed again before it is deployed.
Please allow 5 business days for review and application signing process.
6. Deploy with Estate Manager
Once you have a signed APK:
- Sign in to Estate Manager.
- Open the Software Library and select + Software Package to upload your signed APK.
- Open Campaigns and select + New Campaign to choose which devices receive the application and when.
Estate Manager also provides diagnostic data, geolocation tracking and management of all applications deployed to your devices.
Frequently asked questions
Do I need to sign anything for the semi-integrated integration type?
No. Signing applies to applications that run on the device itself.
Can I deploy an unsigned APK to a production device?
No. Production Axium devices only accept signed applications.
Do I need to resubmit when I release a new version?
Yes. Each new APK must be submitted for review and signed before deployment.
Who can see my applications?
Only you and NMI. Signing credentials are unique to each partner.
Who do I contact with questions?
Contact NMI Support, who will route your request to the devices team.
Updated 4 days ago