Overview
A North India–based payment startup engaged Mobintix to build a certified SoftPOS application that runs on commercial Android phones. The product targets micro-merchants who could not justify dedicated POS hardware but needed to accept RuPay, Visa, and Mastercard contactless payments during daily collections.
We scoped the engagement across three phases: SDK integration and attestation, EMV kernel certification support with the acquirer, and a pilot rollout with fifty merchants in tier-2 cities. The Mobintix team owned Android engineering, secure key storage, transaction logging, and the merchant onboarding admin console.
The architecture separates the payment kernel in an isolated process, routes authorization through a Node.js gateway on AWS, and stores settlement batches in PostgreSQL with immutable audit rows for finance reconciliation.
Post-launch, Mobintix provided L2 support during acquirer audits and trained the client engineering team on key rotation and incident response.
Challenge
Merchants relied on cash because traditional terminals cost ₹8,000–₹15,000 upfront plus monthly rental. Field agents could not verify whether a store actually accepted digital payments, and chargeback disputes lacked digital proof of tap events. The acquirer required PCI MPoC-aligned controls while the client needed a white-label app that could ship under different merchant brands within six months.
Approach
We implemented NFC card reading with HCE fallbacks, encrypted PIN entry where required, and device binding so keys could not be cloned across handsets. Offline store-and-forward queues transactions when connectivity drops on shop floors, syncing when 4G returns. Admin APIs let operations teams provision merchants, set MDR tiers, and download settlement CSVs matched to acquirer files. Release trains included staged APK distribution through MDM for pilot stores, automated instrumentation tests on five OEM devices common in India, and a runbook for certificate rotation without forcing merchant downtime.
Outcomes
- Pilot merchants processed contactless payments with median authorization time under three seconds on mid-range Android devices.
- Hardware spend dropped roughly sixty percent versus dedicated terminals in the pilot cohort.
- Finance teams reconciled daily batches through the admin export instead of manual SMS logs.
- The client proceeded to a wider rollout across two acquirer programs.
Lessons learned
Certification timelines dominate SoftPOS delivery — start acquirer conversations before UI polish. Test on real low-end devices early; NFC antenna quality varies widely across OEMs. Treat offline sync as a first-class feature for Indian retail, not an edge case. Keep merchant onboarding flows under five minutes or adoption stalls regardless of technology quality.
Schedule quarterly security reviews with the acquirer because MPoC requirements evolve. Budget training time for store staff who confuse voids with refunds — clear in-app copy reduces support load more than engineering optimizations.