Changelog

We released several updates to Apple Pay, and continue to improve feature parity across SDKs. New versions of the React Native and Android SDKs were also released. You can now create and manage acquirers in the dashboard, and we're working on both new Payment APIs and improvements to existing ones. On the docs side, we added machine-readable versions of all our pages, and made some significant improvements to the 3DS and Relay docs.

Outside of all this core work, we have a webinar on multi-PSP routing coming up, and we published the first two chapters of our guide on building multi-PSP routing.

Betas

• Pre-chargeback Alerts notify you when a cardholder raises a dispute with their issuer, giving you a window to resolve it before it escalates to a formal chargeback.

• Intelligent Retries give you stronger signals for when to retry declined transactions, helping you to recover lost revenue.

Improvements and fixes

• Payments

  • Added a programmatic dismiss method, a custom Apple merchant ID option, and selectable disbursement capabilities to the Apple Pay web SDK, and added a transaction type field to the payment result

  • Added billing and payer contact requests to the Apple Pay iOS SDK, including contact details, a transaction type field, and phonetic name fields in the response, and added typed card enrichment fields to the Apple Pay web SDK response

  • Replaced the boolean availability check in the Apple Pay iOS SDK with three-state availability (available, unavailable, or unsupported), added a callback that distinguishes cancellation from a successful authorization, and exposed the transaction ID in the decrypted response, with a matching transaction ID type added to the web SDK

  • Added support for prefilling billing contact info, shipping contact info, and coupon codes to the Apple Pay web SDK

  • Fixed a bug in Chrome (desktop) where the shipping address change handler caused the payment sheet to crash

  • Added a shouldAuthorize hook and a separate onDecline callback to the Apple Pay iOS SDK, and made callback timing safer so merchants can present their own UI after a decline or failure

  • Added a matchPrecision field to BIN lookup responses indicating how closely the matched data confirms the submitted BIN

• Dashboard

  • Rolled out acquirer configuration to all customers

• SDKs

  • Released React Native SDK version 2.7.0 with updated iOS and Android dependencies, including Android SDK version 2.5.0 for Kotlin 2.1 compatibility, and security fixes for the Android encryption library

• Docs

  • Significant updates to the Relay and 3DS docs

  • Published machine-readable versions of our docs

  • Various updates and additions across docs

Pre-Chargeback Alerts are in beta. These alerts notify you when a cardholder raises an issue with their issuer, giving you a window to resolve it before it escalates to a formal chargeback.

We improved 3D Secure logs in the dashboard, and now provide a full timeline of events for each session, which includes more information about the status, liability shift, payment, and more. You can also now create and manage acquirers in the dashboard on the Payments tab.

React Native SDK v2.7.0 has been released, which included some general fixes and security improvements to our encryption library used on Android. We recommend updating to version 2.7.0 when possible to pick up these fixes. This update is compatible with React Native 0.76+, but if you use Expo in your apps, you need to make sure you're on Expo 53+ (which requires React Native 0.79+).

Apple Pay Web now works inside cross-origin iframes, and sandbox test cards match the brand a customer selects in their wallet. On the SDK side, we fixed a handful of script-loading and icon-override issues to make integrations more reliable, and updated several pieces of documentation.

Improvements and fixes

• Payments

  • Removed the unused optional automatic_updates field from CreateCardRequest

  • Updated card account updater to improve delivery and avoid some duplicate notifications

  • Launched Pre-Chargeback Alerts in beta

• Apple Pay

  • Improved feature parity for Apple Pay Web so it's more in sync with the iOS SDK, and it now works when the checkout component is embedded in a cross-origin iframe, such as a PSP-hosted widget inside a merchant's store

  • Exposed a new .abort() method so users can programmatically close the Apple Pay sheet

  • Sandbox Apple Pay now works with your Apple Sandbox account and test cards in Apple sandbox wallets

• Sandbox

  • Sandbox apps now support test cards across four brands, Visa, Mastercard, American Express, and Discover, returning the corresponding Evervault-encrypted test card in the credentials response

• Dashboard

  • Launched an enhanced 3D Secure logs view with a full session timeline and details on status, liability shift, payment, and more

  • Logs now have a consistent URL format, /logs/:traceId, so any log can load directly regardless of the filters set on the logs page

  • Acquirers can now be created in the dashboard

• SDKs

  • Released React Native SDK v2.7.0

  • Fixed race conditions from duplicate script loads and a bug where onLoadError was not called on script load failure in the React SDK (2.27.0); reloading the script now appends an attempt query parameter

  • Added support for partial CardIcon overrides on the JavaScript and React SDKs, so users can override individual card brand icons instead of all of them

• Enclaves

  • You can now enable concurrent request processing for enclaves

• Docs

  • Significant updates to the core concepts and card collection pages

  • Updated the JavaScript and React SDK docs to document missing props and events across Card, ThreeDSecure, useThreeDSecure, and Pin, and corrected some incorrect type signatures

  • Updated the React Native docs to fix incorrect prop types and names across Card, ThreeDSecure, ThreeDSecure.Frame, and useThreeDSecure

  • Numerous minor updates to existing pages

We released some updates and bug fixes across the dashboard, docs, payment APIs, and SDKs. There's now a shortName field on the Merchant API, a sandbox for the Apple Pay web integration, and support for custom card brands in the JavaScript and React SDKs.

Improvements and fixes

• Dashboard

  • You can now specify a legal business name when creating new merchants

  • Fixed name and address validation issues when creating merchants

  • Fixed an issue where the delete button wasn’t working on function inbound allowlists

• Payments

  • Added the shortName field to the Merchant API to support use cases (e.g., for 3DS) where the merchant name has a max length of 40 characters

  • Added further resiliency improvements to Card Account Updater

  • Added a sandbox to the Apple Pay Web integration

  • Acquirers are now checked with a $0 3DS authentication when they’re created to ensure their details are correct

  • Minor bug fixes

• SDKs

  • Added custom brand support to our JavaScript and React SDKs

  • Fixed a bug where scrollbars were jumping during the 3DS redirect flow

• Docs

  • Updated the create merchant endpoint with the correct regex validation rules

  • Updated the Core Concepts and Card Collection pages

  • Minor updates to existing pages

We’ve made several improvements to our ASV scanning product. You can now schedule scans, save exceptions across scans, and reuse hosts across targets. It’s also easier to see which scans passed or failed from the overview page.

Apple Pay now supports recurring payments, and we reduced the latency on network token creation. The merchant onboarding flow and the List Merchants API have also been improved.

On the docs side, we added format and regex rules, as well as better enum support to the API ref. We've also been working on broader updates across our docs to address customer feedback and style issues.

Outside of product-level changes, we announced our Series B, and released our first long-form guide on card acceptance.

Improvements and fixes

• Site

  • Released a new pricing page

  • Released a new 3DS page

  • Added a Guides section under Resources, and posted the card acceptance guide

• Docs

  • Added links to product pricing

  • Added format and regex rules

  • Added better support for enum values

  • API endpoint links now link directly to sections

  • Fixed an issue with scrolling when using the mobile menu

  • Added and updated various sections based on customer feedback

  • Fixed various style issues to improve consistency

• UI

  • ASV Scans: Added the ability to schedule scans monthly or quarterly

  • ASV Scans: Exceptions now carry over to future scans

  • The dashboard now remembers your last opened app when switching teams

  • Log timestamps now show multiple timezones on hover

  • You can now search and paginate on the merchants page

  • When accepting an invite, your email is pre-populated on the sign-in page

  • Fixed a bug where hobby teams couldn't create more than one sandbox app

  • Fixed a broken flow when setting up Slack alerts for relays

• Payments

  • Added a ready event for Apple Pay

  • Added support for recurring payments for Apple Pay

  • Improved validation on the Acquirers API

  • Improved the merchant onboarding flow

  • Improved how the List Merchants endpoint manages long lists of merchants

  • Improved how network tokens are created to reduce latency

  • Various improvements on the backend to improve reliability and stability

New metrics are now available in the Evervault dashboard. Personalize your metrics view with the features most important to you. You can choose metrics for decrypts, encrypts, inspects, 3DS sessions, network tokens, and BIN lookups. All metrics can be filtered for the past 24 hours, 7 days, or 30 days.

Relays, functions, and enclave metrics have also received an update. You can now see the total number of requests, failures, and latency in a given timeframe. Hover over each chart to see the breakdown of requests per instance, and click to view the relevant logs.

Quick links will now appear for recently visited pages, such as Relays, Functions, or Page Protection pages. Monthly billing details are also available for a quick glance at your team’s usage.

Improvements

• Added shortcut from function details to copy the run endpoint

• Added support for response timeouts in logs

• Added support to search for the insights category in logs

• Added validation for reserved environment variables in functions and enclaves

• Fixed ASV scan downloads reporting the wrong status

You can now run ASV (Approved Scanning Vendor) scans with Evervault. These scans are part of the PCI Data Security Standard (specifically requirement 11.3.2). If you’re in scope for that requirement, you need to submit a passing ASV scan at least every three months or 90 days. Evervault recommends completing your scan well ahead of the deadline. Many customers submit monthly to enhance security and allow for early identification and resolution of any issues. Contact your account manager to get started, or check out our docs for more information.

Why we added ASV scans

ASV scanning is part of our continuing effort to build out the compliance tooling side of our platform. Legacy tools in this space are often clunky and inefficient, and because you’re likely using Evervault’s other products already, it made sense to add ASV scanning. While not a complete list, below are some of the key benefits to our solution.

• Stay compliant: Meet PCI DSS 4.0 requirement 11.3.2 with quarterly scans and on-demand rescans.

• Faster remediation: View vulnerabilities in a structured dashboard, not buried in lengthy PDFs.

• User-friendly: Set up scans, track progress, request exceptions, and download reports in a few clicks.

• Unlimited rescans: Run as many scans as needed until you pass, at no extra cost.

• Standalone and modular: Buy only what you need, with self-serve and sales-assisted options.

You can now accept Apple Pay and Google Pay with Evervault in native apps with our Swift & Android SDKs.

Apple Pay for iOS →)

Google Pay for Android →

Improved Merchant Onboarding

You can now create and manage merchants from the new Payments view in the Evervault Dashboard. From here you can:

• Create new merchants to enable use of Network Tokens, Apple Pay and Google Pay.

• Manage Apple Pay domains.

• Manage Apple Pay certificates.

New Webinars Hub

We’ve launched a new hub for our monthly webinars allowing you to easily go back and watch any webinars you might have missed.

Evervault Webinars →

Improvements

• You can now do plain text searches inside of the logs view without having to construct a full query.

• The Card Collection component now accepts a validation option to allow developers to add custom validation logic. For now this only supports adding regex validation to the card holder name, however, we plan to expand this to other validation types and inputs.

• The Card Collection component will now include a 6 digit BIN inside of the payload as soon as it is detected — previously this was only returned once a full card number was entered.

• Apple Pay in the JS SDK now exposes an onPaymentMethodChange hook to allow developers to respond to users selected different payment methods inside of the payment sheet.

• The Command palette (cmd+k) now allows you to quickly search for any of your teams Evervault resources by name and quickly navigate to it.

• Enclaves now support egress to mysql databases.

• Fixed bug in our functions logging infrastructure that could some times cause a Function to become unresponsive.

• Page Protection will now include data on whether a script likely originated from a users browser extension.

• We have reworked a lot of our settings pages making it easier for you to navigate between team, app and account settings.

Jump anywhere in the dashboard with the new command palette. Triggered with ⌘ + K (Ctrl + K on Windows). The palette surfaces shortcuts to pages, actions, and recent items, so you no longer dig through menus. Fewer clicks mean you stay in flow and find what you need faster.

Apple Pay Recurring Payments

Set up subscription billing in a single tap. Our Apple Pay component now supports recurring payments. Customers approve an ongoing charge in the familiar Apple Pay sheet, making renewals effortless.

Private Network Links

Pipe traffic straight from your VPC into Enclave without touching the public internet. Compliance teams gain peace of mind and sensitive data stays on your network. Reach out to support if you want to enable Private Link on your Enclave.

Improvements

• Inspect API now accepts both JSON objects and JSON strings.

• Introduced a new repareTransaction option for Apple Pay which allows merchants to adjust pricing just before the sheet appears.

• The last four digits of the payment payment are now returned in Apple Pay and Google Pay payloads.

• Introduced a new onShippingAddressChange hook in Apple Pay to allow merchants to recalculate the price when the address updates.

• The Evervault CLI now publishes checksums for installers and artifacts to simplify integrity checks.

Our new Card Art API is an extension for Network Tokens that lets you fetch the official artwork for a card.

Get Started with Card Art ->

Improvements

• We've introduced a new availability method to our Apple Pay component to allow you to check for Apple Pay support on the device before rendering the Apple Pay button. Learn more

We have released a new major version of our React Native SDK. This is a complete rewrite of the SDK which is now compatible with the new React Native architecture. Our React Native SDK enables your team to safely collect payment details and reduce fraud with 3D Secure.

Improvements

• We've Improved relay errors in the log view - We now include a detailed message in the log drawer explaining the cause of the error when relay fails to handle a request.

We've released a new @evervault/js package to allow our browser SDK to be imported as a CommonJS module or ES module. The package provides typescript types for use inside of typescript codebases.

Learn more ->

We've made some small DX improvements to our logs view. One of which is the abillity to toggle between UTC and your local time zone when searching and viewing logs.

Apple Pay Disbursements

Dispursment transaction are now supported by our Apple Pay component. This allows your to use Apple Pay to collect payment details from users for transfering funds to their account.

Learn More ->

Improvements

• We've completely rebuilt our dashboard function deployment flow from the ground up to provide a better DX.

We’re excited to introduce our newest product, 3D-Secure. 3D-Secure (3DS) is a security protocol created in 2001 to authenticate online card transactions, and ensures merchants and acquirers comply with SCA and PSD2 regulations. It verifies that the person making the purchase is the legitimate cardholder. A significant benefit of 3D-Secure is that it shifts chargeback liability from the acquirer to the issuer — a huge advantage to high-risk merchants. In many regions, including the EU, Australia, India, and Japan, 3DS is now mandatory for certain transactions.

Today, we're launching the Evervault 3D Secure API—a universal API for 3DS authentication that works independently of your payment processor. Our API is built for developers with our leading security and design principles. It’s easy to integrate, highly reliable and distills the 3DS authentication process into easy steps using our client side SDKs.

Get Started with 3D Secure ->

Card Account Updater

Card Account Updater is a service offered by major card networks to automatically update card-on-file details. Card Account Updater ensures that merchants always have the latest card information (like updated card numbers and expiration dates) for their customers.

We've released a new API designed to let you integrate Card Account Updater in minutes without having to interact directly with the card networks.

Get Started with CAU

Network Tokens replace sensitive card details (like the 16-digit card number, expiration date, and security code) with a unique identifier generated by a card network (e.g. Visa or Mastercard). This token is used to process payments without exposing actual card details, thus adding a layer of security. For merchants, this can also result in higher authorization rates and lower authorization fees.

We're excited to release our new easy-to-use APIs designed to let you create and use Network Tokens in minutes without having to integrate directly with the card networks.

Get Started ->

Welcome to Part 2 of 'staying on top of any errors that occur in your system'.

Firstly, you can now configure Evervault to send alerts for both Cages and Relays. We've also expanded our third-party integration support to include Discord as well as Slack. If you need to control the flavour of error that you'd like to receive via an alert (4XX, 5XX), this is also configurable within the dashboard. Lastly, we've added custom webhook support for those of you who prefer to handle your workflow programatically.

We've included more information on alerts in the docs

With Evervault Inputs we’re making it easier than ever to become PCI compliant.

This functionality, embedded within our JavaScript and React SDKs, makes it easy to collect encrypted cardholder data in a completely PCI-compliant environment.

Evervault Inputs are served within an iFrame retrieved directly from Evervault’s PCI-compliant infrastructure, which can reduce your PCI DSS compliance scope to the simplest form (SAQ-A) once integrated correctly.

It’s as easy as specifying the ID of the element in which the iFrame should be embedded.

Get started with Evervault Inputs →

Evervault is continuously expanding and improving the developer experience of the platform, and supporting an ever expanding ecosystem of programming languages with SDKs is one of our top priorities.

We are delighted to now provide full support for the Evervault platform with Java. Using the Java SDK developers can now encrypt data, proxy requests through Relay, and interact with Cages.

Check out our Java SDK docs.

It’s important to stay on top of any errors that occur in your system. With that in mind, we’ve just shipped our first alert feature. You can now configure a Slack channel to receive alerts when your Relay encounters an error. You will now know in real time if an inbound request from your client fails before it reaches your app.

See issues that matter and triage them accordantly!

We are working on adding support for Cages alerts next, and adding new destinations so you can keep on top of alerts from your favourite app.

To set up alerts in the Dashboard, go to Relay -> Alerts -> Setup Slack Channel

With this update we are adding support to the secp256r1 curve — also known as NIST P-256 or prime256v1. Relay already supports secp256k1 (koblitz) curves, but now we’re providing our users with the choice so they can decide which curve they want to use.

Our SDKs will continue to default to the secp256k1 curve, but please follow our Python SDK and NodeJS SDK guides to learn how to change your curve.

---

For more in-depth information about elliptic curves and its differences, please refer to our documentation on elliptic curves.

By default, your Cages can be run by any client with a valid API key, but you may want to have additional control over where your Cage can be run from.

You can now restrict your Cage to only accept invocations from a predefined set of IPs. Define a list of IP addresses and/or CIDR blocks to accept in the Evervault dashboard.

If a Cage run is requested from outside of your whitelist, the invocation will be rejected with a status code of 403, or a ForbiddenIPError in our Node & Python clients.

You can read more about Cage IP whitelisting in our docs & can get started by going to Dashboard → Cage → IP Whitelist.

Outbound Relay traffic passes through Evervault’s proxy and is decrypted before going to trusted destinations like Stripe or Twilio. We’ve added the ability to put a hard constraint on what destinations data should be forwarded to.

When you start configuring Outbound Destinations for a team, any request to a domain not in the list will be blocked whether it contains encrypted data or not.

You can now start restricting your Outbound Destinations in the Evervault Dashboard: Settings → Outbound Destinations → Configure Destinations

Environment variables are helpful when storing strings such as node environments and API URLs. But, it can also contain values best kept secret like database passwords.

We just released new functionality that allows you to securely store secret environment variables. You can now choose to make your environment variables secret at creation.

By choosing this new option, your environment variables will be masked in the Evervault dashboard and CLI.

You can access the feature in the Evervault Dashboard: Cage → Environment Variables → Create variable

We know that latency is a core consideration when implementing Evervault Relay, so we’re delighted to be releasing our new latency reporting functionality today.

For every request your users send through Relay, we measure and record the latency between Evervault’s infrastructure and your infrastructure. The charting functionality in the Dashboard allows you to analyze latency at various percentiles, making it easier for you to make latency commitments to your own users.

Application performance is a major priority for us in every engineering decision that we make, so we’re excited about this first step in holding ourselves accountable for improving your infrastructure’s performance.

We are happy to announce charting for Relay requests. The goal is to help make traffic data more digestible, so it’s easier to monitor trends over time, see spikes in traffic, and identify any possible bottlenecks.

With the new charting capabilities, users are also able to filter by HTTP code (e.g. 2XX, 3XX, 4XX, 5XX) or any search term — because when you filter for logs the chart is also updated to reflect your search.

This is the first of a series of improvements we are making to help users better understand traffic behaviour, and get better insights from their data. Stay tuned!

This month, we overhauled the Evervault documentation. We rewrote and reprioritised content, improved navigation and discoverability and reworked the landing page. Overall, it’s a big plus for developer experience. Within the coming months, we’ll also be adding technology-specific user guides to cater to the growing number of Evervault use cases; so keep an eye out for your stack.

Check out the new and improved Evervault documentation at docs.evervault.com.

Evervault Relay accepts connections from your users, encrypts sensitive data fields and then connects to your API and transmits the encrypted data over TLS. Occasionally, errors can occur between your user and Relay or between Relay and your API. These errors can often be difficult to debug without verbose request logs.

We just released new functionality that surfaces underlying system errors to developers, so you can quickly identify issues in your system. The errors displayed are bubbled up directly from our underlying HTTPS implementation and include details on things like TLS handshake errors, socket hangups and network timeouts.

You can access the feature by navigating to Relay → Activity Logs in the Evervault Dashboard.

Coming soon: get notified about unusual events and error spikes by e-mail, SMS, PagerDuty or Slack.

Evervault Relay communicates directly with your API over Transport Layer Security (TLS). Your API may be configured to require client-side TLS authentication. This is known as Mutual TLS (or mTLS).

We just released a new feature that allows you to upload an mTLS certificate to authenticate the connection between Relay and your API.

We also allow you to upload password-protected certificates for added security.

Enabling mTLS between Relay and your API means that you can block any requests that are not routed through Evervault, preventing you from accidentally collecting plaintext sensitive data as well as giving you the ability to reject clients that are not protected by Relay's network-level security capabilities.

You can access the feature by navigating to Relay → Configuration → Mutual TLS Certificates in the Evervault Dashboard.

Evervault automatically encrypts sensitive data at the field-level. Developers specify the routes and fields they want to encrypt, then requests are encrypted before ever entering your app. Straightforward, right?

Well, we've just shipped a feature that makes this process even more intuitive. Developers can now configure encrypted fields directly from existing Relay traffic.

When you choose a request from the last 24 hours, we'll build an interactive map of the JSON payload, allowing you to quickly select any fields you'd like to encrypt.

You can access the feature Relay → Encrypted Fields → Configure using Relay's Traffic.

The feature also supports JSONPath and Wildcards for URL Parameters!

Fancy name, what’s that?

Well…

When a request is sent through an Evervault Relay, some fields are encrypted — as defined by you in the Evervault Dashboard. This payload (which is a mixture of plaintext and ciphertext) is sent to the Relay’s pre-configured destination — your API — which you also define in the Dashboard.

The response from the target may, in some cases, contain encrypted data.

To ensure client-side applications (e.g. web browsers, phones, etc) do not render encrypted data to your users, Relay will decrypt any Evervault encrypted strings before they are shown in your UI.

Of course, some data is so sensitive that it must also be masked from clients. Common use cases of this include payment credentials, banking information, and application secrets.

To support this, Relay can now be configured in a new mode.

When a request is sent through Relay, any fields configured to be encrypted will now be encrypted on the response from Relay’s target — not the request to it.

This mode can be used to retrieve sensitive data from your own or third party APIs, masked as encrypted data and shown to your users!

Over the last number of weeks, we've been rolling out a new onboarding experience for first-time Evervault users. The feature is a contextual tutorial that allows users to send JSON data through a configurable Sandbox Relay and watch as it gets encrypted in realtime. Why? Better onboarding which decreases time-to-first-encryption will improve user proficiency and retention.

Sandbox Relays which are created during onboarding can be accessed via your Dashboard — just in case you ever need to reacquaint yourself with Relay or test a new encrypted payload structure.

To access the new onboarding experience, just create a new account with Evervault.

This week we are introducing new guides (and improving the old ones) in our Dashboard, so it’s easier to get started with Relay and Cages. Some of the new guides include:

• How Relay works

• Running Relay with your local server

• Using outbound interception with our SDKs

• How to run and deploy your Cage

On the product side, the changes made include:

• The ability to deploy Cages using your CI pipeline

• The ability run Relay with your local server

• E3, Relay, and Cages being deployed in Western Europe

• Improved reliability of team creations and deletions in our Dashboard

In addition, we have reduced the bundle size of our dashboard from 2.63 MB to 1.95 MB (25% smaller), so it should be a lot faster to load! We will continue to improve this further.

As always, lots of small bugs were fixed and performance improvements across the board.

Relay and Cages are live. Both are built on the Evervault Encryption Engine (E3).

E3 is a what all Evervault products and services will be built on, and is where all cryptographic operations will happen. E3 is built on AWS Nitro Enclaves — fully isolated, hardened, and highly constrained virtual machines that have no persistent storage, no interactive access, and no external networking.

Relay makes it easy for developers to automatically encrypt sensitive data at the field-level before it enters their app, and decrypt it as it leaves.

Cages are isolated serverless functions hosted on Evervault for processing the data encrypted with Relay.