Case study
Building a PCI DSS Compliant Mobile Payment SDK for a Leading GCC Payment Platform
Plexteq developed native Android, iOS, and Flutter payment SDKs for Ottu, a payment management platform serving enterprise merchants across the GCC - and provides ongoing integration support to the merchants who embed them.
Project Highlights
Industry
FinTech, Payments, Mobile
Market
GCC region (Kuwait, Saudi Arabia, UAE, Bahrain, Qatar, Oman)
Compliance
PCI DSS
Cooperation
2023 – now
Technologies
Kotlin / Android, Swift / iOS, Flutter (Dart), JitPack (Gradle), Swift Package Manager, GitHub
Business Challenge
Ottu is a payment management platform serving enterprise merchants across the GCC and the wider MENA region. The platform connects merchants with digital wallets, card schemes, payment gateways, and Buy Now, Pay Later providers, letting businesses manage all of their online payments through a single integration.
As mobile commerce became the dominant channel in the region, Ottu's merchants increasingly needed to accept payments directly inside their own Android and iOS applications - not just on the web. Sending users out of the app to an external payment page hurts conversion, while building an in-app card checkout from scratch places every merchant inside PCI DSS scope, a burden most of them cannot carry.
Ottu needed a mobile payment SDK that merchants could drop into their apps to get a complete, branded, and secure checkout experience out of the box: a component that handles everything from card entry and tokenization to Apple Pay, Google Pay, Samsung Pay, and regional payment services such as STC Pay, while keeping cardholder data handling fully PCI DSS compliant on the SDK side.
Just as importantly, an SDK is only as good as its adoption. The product needed first-class developer documentation, working example applications, and hands-on support so that merchant development teams of any size could integrate it quickly and correctly.
Ottu partnered with Plexteq to design, build, and continuously evolve this SDK family - and to act as the support team for the merchant developers integrating it.
Key Challenges
Dual-Track Infrastructure: PCI and Non-PCI Environments
Deliver native Android and iOS SDKs plus a Flutter SDK wrapping them, providing an embeddable, fully customizable checkout UI and a consistent payment flow and callback model across all platforms.
Dual-Track Infrastructure: PCI and Non-PCI Environments
Support the complete range of payment types merchants need - hosted redirect payments, direct on-site card checkout, tokenized one-click payments, Apple Pay, Google Pay, Samsung Pay, regional services such as STC Pay, and Buy Now, Pay Later - each involving its own platform-specific APIs and edge cases.
Dual-Track Infrastructure: PCI and Non-PCI Environments
Guarantee secure handling of cardholder data on end-user devices that Ottu does not control: the SDK had to defend against rooted devices, screen capture, reverse engineering, man-in-the-middle attacks, clipboard sniffing, and keylogging.
Dual-Track Infrastructure: PCI and Non-PCI Environments
Make integration effortless for hundreds of independent merchant development teams through documentation, demo applications, streamlined distribution, and direct developer support.
Solution Delivered
Plexteq's dedicated mobile team owns the full lifecycle of the SDK: architecture, development, releases, documentation, and merchant-facing support.
Embeddable, native-first SDK architecture
The product consists of native Android and iOS libraries, plus a Flutter SDK implemented as a wrapper around the native ones — so Flutter merchants get the same battle-tested payment logic and security guarantees as native ones.
The SDK ships with its own checkout UI, delivered as a Fragment/View on Android and a ViewController on iOS, so it can be embedded into any part of the merchant's screen rather than taking over the whole app. A UI customization theme lets merchants adjust colors, fonts, margins, and other visual attributes so the checkout looks and feels like a native part of their application.
PCI DSS security hardening
Because the SDK runs on consumer devices, security had to be enforced within the SDK itself. We implemented a layered set of protections:
-
Root/jailbreak detection - the SDK refuses to operate on rooted or jailbroken devices
-
Screen capture prevention - screenshots and screen recording can be prohibited on screens containing sensitive data
-
Source code obfuscation - hardening the SDK against reverse engineering
-
SSL pinning - preventing man-in-the-middle (MITM) attacks on payment traffic
-
Clipboard attack prevention - sensitive fields are protected from clipboard-based data leaks
-
Custom CVV keyboard - a dedicated in-SDK keyboard eliminates the keylogging risk of third-party keyboards
Merchant support, documentation, and distribution
Beyond engineering, our team runs the merchant-facing side of the product:
-
User Documentation (Guidelines) describing the integration flow, SDK parameters, each payment form, and callback handling
-
Minimalistic public demo apps demonstrating real SDK usage - any merchant can inspect them on GitHub before or during integration, while the SDK source itself lives in private, access-restricted GitHub repositories
-
Direct developer support, including video calls with merchant development teams to help them through integration and troubleshooting
-
Streamlined releases via GitHub - distributed through JitPack as a Gradle dependency for Android and via Swift Package Manager for iOS, so merchants consume updates the same way they consume any other dependency
Key Results
A production mobile payment SDK live across the GCC
embedded in merchant apps on Android, iOS, and Flutter with a single consistent payment experience
Full PCI DSS compliant card checkout on mobile
protected by root/jailbreak detection, SSL pinning, obfuscation, screen capture and clipboard protections, and a custom CVV keyboard
Every major payment method in one component
hosted payments, direct card checkout, tokenized one-click payments, Apple Pay, Google Pay, Samsung Pay, STC Pay, and Buy Now, Pay Later
Fast, low-friction merchant onboarding
driven by clear documentation, public demo apps, standard dependency-based distribution, and hands-on support from our engineers
Business Outcome
With the SDK in place, Ottu extended its payment platform from the web into its merchants' native mobile applications - without asking those merchants to become payment or security experts.
↳ Higher conversion for merchants
Users complete payments inside the merchant's own app, in a checkout styled to match it, instead of being bounced to external pages - including one-click tokenized payments for returning customers.
↳ Compliance handled once, reused by all
The heavy lifting of PCI DSS compliant cardholder data handling is done inside the SDK, so every merchant that integrates it benefits from the same hardened security posture.
↳ A stronger regional offering
Support for Apple Pay, Google Pay, Samsung Pay, and regional services such as STC Pay lets Ottu serve GCC merchants with the payment methods their customers actually use - a decisive advantage in the region's fast-growing mobile commerce market.
↳ A partner, not just a vendor
Plexteq continues to maintain and evolve the SDK while directly supporting merchant developers, effectively operating as Ottu's mobile payments engineering and support arm.