Protect Sensitive Information with PGP Encryption

This page explains how you or your current payment provider can encrypt your PCI sensitive token data for when you import data from another payment provider.

Before encrypting your data, make sure it is in the required format.

Before you begin

Install GnuPG or other PGP software that lets you encrypt and decrypt files.

1. Obtain your PGP key

To encrypt your PCI sensitive data, you need a public key provided by Adyen. For improved security, we generate a merchant-specific PGP public key for you.

Reach out to our Support Team, and we will generate your key.

If your merchant-specific PGP public key doesn't work for you, consult your Adyen contact. As a last resort, we offer a generic public key.

2. Verify your PGP key

Your merchant-specific PGP public key is signed with our signing key. Before using the public key, check its signature to verify the authenticity.

Step 1: Download the signing key

You can use the signing key to verify the signature of your merchant-specific key.

Key ID: 5DAAC8AC

Download live signing key

Or copy the key below:

Step 2: Verify the signature of your public key

Verify whether your merchant-specific public key was signed with the relevant Adyen signing key.

Here's how to do so using the GnuPG command-line interface:

Place your merchant-specific public key (MerchantEncryptionKey.asc) and the relevant signing key (for example AdyenSigningKey.asc) in the same directory.

From the directory that contains both keys, create a temporary keychain and import both keys:

gpg --no-default-keyring --keyring ./tempPubKeyRing.gpg --import ./AdyenSigningKey.asc ./MerchantEncryptionKey.asc

Check that both keys are present in the keychain:
```
gpg --no-default-keyring  --keyring ./tempPubKeyRing.gpg --list-keys --keyid-format SHORT
```
The output should list both keys. For each, the following properties are listed:
- pub: the public key ID, used for encrypting messages.
- uid: the user ID.
- sub: the 'subkey' ID, used for signing or encryption.
Verify the signature of your public key, using its public key ID (pub):
```
gpg --no-default-keyring  --keyring ./tempPubKeyRing.gpg --keyid-format SHORT --check-sigs <your public key's pub ID, e.g. "34B82244">
```
The output lists your public key's properties. Check that the first line that starts with sig! references the subkey (sub) value of the signing key. If it does, your public key is authentic and safe to use.

3. Encrypt sensitive information

Use your verified public key to encrypt PCI sensitive files that you send to Adyen.

Here's how to do so using the GnuPG command-line interface:

If you haven't already, create a keychain and import your merchant-specific public key (./MerchantEncryptionKey.asc):
```
gpg --keyring <keychain-filename> --no-default-keyring --import ./MerchantEncryptionKey.asc
```
Replace <keyring-filename> with the desired filename for your keychain.
Encrypt the file using your merchant-specific public key:
```
gpg --encrypt --recipient <your-merchant-specific-public-key-id> --keyring /path/to/your/<keyring-filename> <file-to-encrypt>
```
- Replace <your-merchant-specific-public-key-id> with the ID of your public key.
- Replace /path/to/your/<keyring-filename> with the path to your keyring filename.
- Replace <file-to-encrypt> with the path to the file you want to encrypt.

Generic public key

The generic public key is used only as a fallback. Consult your Adyen contact before using it.

Name: Adyen Product Security Key 2023
Email: product_security_key (at) adyen.com
Comment: For CHD and other critically secret data
Created: 2023-11-08
Expires: 2027-11-07

Key ID: 2F5E0351
Length: 4096
Algorithm: RSA
Fingerprint: 868A EBB2 E284 5CAC E9EB B75E 20FB 37AE 2F5E 0351

Download Public Key