Security Overview

Security is probably one of the most significant concerns for both the shopper and the retailer during an online transaction. In reality an online transaction is probably more secure than a card transaction in a shop or conducted over the telephone or by fax, as the information transmitted online is highly encrypted using complicated logarithm combinations.

The WorldPay payment system uses a combination of both established and innovative techniques to ensure the security and integrity of all sensitive data. Furthermore, our public web servers are certified by Thawte, a public Certificate Authority, ensuring that both the shopper and retailer can have confidence that nobody can impersonate WorldPay to obtain confidential information.

Transaction Encryption

The transfer of the purchase details from the retailers site to Worldpay are encapsulated using our own encrypted and digitally-signed protocol. This uses a combination of standard methods such as PGP, RSA and MD5 to ensure that the information passed is secure and tamper-proof.

Security for the Shopper

Any communication between the shopper and WorldPay is also encrypted to the maximum strength supported by the shopper's browser using TLS or 128 Bit SSL. Shoppers are also protected from fraudulent use of their card in a "card not present" environment, by their card issuers. The card issuers provides the right for shopper to dispute a transaction if the goods/services did not arrive or if the card was used fraudulently.

Data Storage

Data storage on WorldPay systems, and the communication between WorldPay and the worldwide banking networks, is regularly audited by the banking authorities to ensure a secure transaction environment. We also ensure that we stay up-to-date with the latest versions of any third-party code we use, and continually review our own proprietary code.

Security FAQs

How secure is WorldPay?

WorldPay uses state of the art security tools and techniques, both proprietary and unique, to ensure that you and your shopper are protected against what is nowadays a virtually non-existent risk. Our systems also have inbuilt system redundancy and fault tolerance, to provide you with a virtually uninterrupted service 24 hours a day, seven days a week. Our systems have evolved over many years and throughout our history we have continuously sought and gained bank approval for our systems.

If the shopper keys in their card details at home or in the office, surely they are not encrypted until after they arrive at the WorldPay system?

Using industry standard SSL, Thawte and WorldPay unique encryption systems, this is not actually the case. When the shopper fills in the payment form and clicks the submit button, their details are not sent straight away. What actually happens is that a secure link is set up between the shopper's browser and WorldPay and an encryption code is requested and received, which then wraps the order and transaction details before leaving the shoppers premises. To see a fuller example of this in action, please click here.

Will I need to arrange secure server facilities for my web site?

No, WorldPay provides all the facilities you need to pass transactions securely over the internet.

What security measures must we undertake for our systems to be acceptable to a processing bank?

By working with WorldPay, who will authorise you for use of payment processing facilities online, which includes a QA check of your site, no further bank approval is necessary.

Can I FTP to the secure server?

No, to protect our systems and customers peace of mind, FTP is not allowed to the secure server.

What level of encryption do you have on the WorldPay server?

WorldPay use Thawte 2048 bit encryption systems. At the browser 128 Bit SSL is used.

Do WorldPay use SET?

WorldPay does not use SET as it is not an international standard. However, we do utilise our own variant of this to ensure our clients peace of mind.

What is a digital certificate?

A digital certificate is an electronic document that is passed between a browser and a server, in order to verify the identity of the senders identity.

[ Back to Buying: FAQ ] .......... Buy Now?