The platform
One acceptance layer for every environment.
Card networks assume a live connection at the moment of payment. PurpleKey removes that assumption — one protocol that behaves the same at a rural counter, a saturated venue gate and a toll lane at speed.
Offline by design
The transaction completes between the two devices. Connectivity reconciles it later — it never authorises it.
Engineered for peak load
No server round-trip at the point of payment. Throughput is bounded by the lane or the gate, not by the network behind it.
Unit-agnostic
Currency, fares, entries, credits or passes — the protocol carries a unit you define. Access and payment on one integration.
Evidence-based settlement
Both parties sign what was agreed before the service is released. Reconciliation runs against signed records, not promises.
Solutions
Deployed where connectivity is the constraint.
One platform, configured per industry. Profiles are fixed in the terminal's credential at certification — never negotiated at the point of payment.
Fare collection
On-board and station fare acceptance, independent of coverage along the route.
Lane and barrier payments
Authorisation as the vehicle approaches, confirmation at the barrier. Lane speed is never constrained by the cryptography.
Ticketed access and in-venue spend
Many gates, one venue, no coverage guarantee inside. Single-use rights that cannot be presented twice.
Counter payments
The merchant's own device acts as a certified terminal. No dedicated hardware, no dependency on the store connection.
Route collection
Payment at the point of delivery, reconciled at the end of the route.
Campuses and corporate sites
Operator-defined units and rules — meals, credits, passes, entries — on the same evidence model as money.
How it works
Provision. Transact. Settle.
Three stages. Only the second happens at the point of acceptance — and it is the only one that must work without a network.
Provision
While the payer's device is online, your system issues a signed spending right: an amount, a validity window and a scope of acceptance. It waits on the device.
Transact
Device and terminal establish a secure link. The terminal states the amount, both parties sign it, and the service is released — instantly, with no connectivity on either side.
Settle
When either side reconnects, the signed record synchronises and your ledger reconciles against evidence. Offline ceilings bound the exposure in between.
We never hold funds.
PurpleKey moves the authorisation, not the money. You keep your processor, your accounts and your ledger. No float sits with us.
We don't process personal data.
No names, no card numbers, nothing that identifies your customer — not on the wire, not in our records. Your own data travels encrypted under keys we do not hold.
Security & compliance
Designed to be audited.
Every guarantee is stated as what it is — cryptographic, a local control, or after-the-fact detection. Residual exposure is declared and configurable.
Signed on both sides
Terminal and payer each sign the agreed amount before service is released. Disputes are resolved on evidence.
Bounded offline exposure
Ceilings per credential, device and site. You choose the maximum at risk before reconciliation; the platform enforces it offline.
Keys under your control
Issuing keys are generated and held by you in a hosted secure module. PurpleKey cannot sign on your behalf.
Revocation without connectivity
Signed, sequenced deny lists with anti-rollback protection reach terminals offline. A lost device stops being accepted without a round-trip to the cloud.
Immutable evidence
Append-only, hash-chained records, retained for five years and queryable per transaction. Corrections are new entries, never edits.
Independent verification
Test vectors and an executable conformance suite let integrators verify their own implementation, rather than trust ours.
Developers
Integrate in days, not quarters.
Issue rights, accept payments, receive settlement events. The SDK handles the link, retries, deduplication and ordering — your application never needs to know whether a connection existed.
# Issue a spending right to a payer POST /v1/credentials { "subject": "<payer>", "amount": 50000, "unit": "USD_cents", "expires_in": "7d" } # Terminal SDK — no connectivity required pk.quote(amount) # state the amount pk.collect() # returns a signed receipt # Settlement events webhook operation.settled webhook operation.rejected
- Native SDKs for Android and iOS. The merchant's own device can act as a certified terminal.
- REST API and webhooks. Issue credentials, query operations, receive settlement events.
- Idempotent by construction. A duplicate synchronisation can never charge twice; ordering never depends on a clock.
- Custom data, carried intact. Attach your own fields and receive them byte for byte — encrypted under your keys if required.
- Sandbox environment. Run the full flow end to end before certification.
Pricing
Plans for how you operate.
An annual platform licence plus usage on settled transactions. Nothing is bundled. Figures apply to the United States — pricing varies by country.
For a business operating PurpleKey for its own customers, sites and terminals.
- Certification, your own issuing authority, console and support
- Usage priced by industry — see the table below — billed on settled transactions
- Phones and tablets as terminals at no charge, without limit
- Certified hardware terminals at $15 per month each, service included
- Hosted key custody, key generated and held by you: $250 per month
- Transit operators collecting their own fares: $25,000 per year, usage at 2% of average fare
For partners operating PurpleKey on behalf of their own clients.
- Multi-client console, your own certification authority, full API
- Wholesale usage rates, leaving margin between you and the platform
- White-label application, or the SDK alone
- Annual licence and a fee per registered client
- A limited number of integrators per industry, by design
Transit authorities, toll concessions and municipal systems procured by tender.
- Quoted per project against the published specification
- Tolling and motorway lanes are contracted through this route only
- Technical dossier, compliance pack and conformance evidence
- Interoperability: the protocol is licensable, so the system is not bound to a single vendor
- Service levels, source escrow and continuity terms in contract
View indicative usage rates by industry Enterprise plan · USD
One price per billable unit, and every row states where the number comes from. For retail, the average ticket is read from your own signed receipts each quarter.
| Industry | Per billable unit (USD) | Basis |
|---|---|---|
| Retail & hospitality | 2% of observed average ticket · floor $0.06 · cap $1.60 | Read from signed receipts; recalculated quarterly and fixed for the following quarter |
| Parking | $0.50 | 5% of a typical ticket |
| Events & in-venue spend | $0.50 | Same basis as parking |
| Ticketed access, per entry | $0.50 | Typical charge for a ticketed entry |
| Residential & recurring access | $0.015 | High volume, no charge to the resident at the gate |
| Coupons & loyalty, per redemption | $0.03 | A small fraction of the discount carried by the coupon |
| Customer custody, per use | $0.015 | Hotel key, voucher, credential: opaque object, frequent use |
| Public transit, per validation | 2% of average fare | $0.05 on a $2.50 fare; set on the operator's own recorded takings |
| Tolling & motorway lanes | By tender | Quoted per project |
All figures in US dollars, before tax, for the United States. Pricing varies by country: local price lists are quoted in local currency with applicable taxes and are available from sales. Billed monthly on settled transactions; a charge that never reconciled never produces a line. Passes and subscriptions are billed at the per-validation price of their own industry.
Questions
What buyers ask before they sign.
What prevents the same funds being spent twice while offline?
Three controls, each doing a specific job. The right you issue carries a ceiling, so the most that can be at risk is bounded — and you choose the bound. The terminal keeps a local record and rejects any right it has already seen. Where several terminals share a site, a site controller orders the charges between them so two lanes cannot accept the same right. No offline system makes double-spend impossible; PurpleKey makes it bounded, visible, and sized by you.
What happens if a terminal never reconnects?
It continues to accept payments until it reaches the offline ceiling you configured, then stops accepting. Nothing is lost: the signed records remain on the device and reconcile when it reconnects, or when they are collected manually.
Do we need to purchase hardware?
No. Any recent Android or iOS device can act as the terminal, and a certified terminal is a credential we issue rather than a device we sell. Existing dedicated hardware can be certified as well.
Who processes the payment?
You do, with the payment processor you already use. PurpleKey authorises and reconciles; funds never pass through us. This is a deliberate design decision, not a limitation we intend to remove.
Is the platform limited to monetary payments?
No. The protocol carries a unit you define — currency, rides, meals, entries, credits. Access control and payment are the same mechanism with different units, which is why a stadium and a transit route can run on a single integration.
Is PurpleKey certified?
Certification is an ongoing programme, and we would rather state that plainly than imply otherwise. What exists today is the protocol, the contracts and the test vectors integrators build against. If certification is a condition of your procurement, tell us early and we will be specific about scope and timing.
Tell us where the network fails you.
We take on a limited number of integrations at a time and prefer to understand the point of acceptance before quoting it. Write to us with what you need to accept and where, and you will receive a specific answer.