CPad Pay vs SoftPOS is a 2026 procurement question every Rosper customer asks once: should the merchant deploy a $14B annual SoftPOS (tap-on-phone) market per Mastercard 2025 estimates, or a PCI PTS 6.x certified hardware tablet like CPad Pay? The short answer: SoftPOS is great for low-ticket field collection and pop-up retail; CPad Pay is the right call when ticket size, transaction volume, or chargeback exposure crosses a threshold the merchant cannot afford to take on a consumer phone. Rosper ships CPad Pay from US warehouses in 3-5 business days with full PCI hardware certification baked in.
Key takeaways: hardware vs software at a glance
- CPad Pay holds PCI PTS 6.x certification on the hardware. The EMV kernel runs in a tamper-evident SoC.
- SoftPOS runs on a consumer phone OS. The PCI security model is layered software (CPoC, MPoC) certified against PIN and cardholder data flows.
- Chargeback exposure is the dominant cost. For tickets above $50, the EMV liability shift on hardware terminals saves $20 to $40 per chargeback dispute compared to software-only solutions.
- Audit cost: CPad Pay merchants typically stay in PCI DSS SAQ scope. SoftPOS merchants may face additional MPoC compliance obligations depending on the deployment shape.
- Pick CPad Pay for fixed-counter merchants. Pick SoftPOS for low-ticket, low-volume field collection and pop-up settings.
CPad Pay vs SoftPOS: two payment patterns, two risk profiles
PCI PTS hardware (CPad Pay) and SoftPOS (tap-on-phone on consumer iOS or Android) solve overlapping but distinct problems. Hardware terminals enforce the EMV cryptographic primitives in a tamper-evident silicon module. SoftPOS solutions push the equivalent primitives into a software layer that runs on whatever consumer phone the merchant happens to own. The PCI Security Standards Council publishes both standard families: PTS POI 6.x for hardware, CPoC and MPoC for software. Both are legitimate paths. They are not equivalent in risk.
Hardware PCI: what CPad Pay holds on-device
CPad Pay’s payment kernel runs in a dedicated secure element inside the SUNMI device. The PCI PTS 6.x certification covers:
- Tamper-evident enclosure (if the device is physically opened, the secure element bricks)
- Tamper-responsive sensors (mesh circuits detect drill-through attempts)
- EMV kernel L1 contact and contactless certifications
- PIN entry encryption (PED) at hardware level
- Card brand approvals: Visa PayWave, Mastercard PayPass, Amex contactless, Discover D-PAS
- Cryptographic key injection at factory; never exposed to the merchant OS
That entire bundle ships with every CPad Pay. The merchant inherits the certification through their BIN sponsor; the ISV inherits it through the semi-integrated payment flow.
What SoftPOS is and where it fits
SoftPOS (also called Tap-to-Pay or MPoC, Mobile Payments on COTS) is a software application that turns a consumer Android phone (or iPhone via Apple’s Tap to Pay program) into a contactless card reader. The phone’s NFC radio reads EMV contactless cards. The software handles PIN entry and cryptographic primitives. PCI’s CPoC and MPoC programs certify the software stack against a defined threat model. SoftPOS is convenient: no extra hardware, ships in days, low entry cost. It fits low-ticket field collection and pop-up scenarios where the merchant cannot justify a dedicated terminal.
Risk 1: Consumer device attack surface
A consumer phone running SoftPOS shares its operating system with every other app on the device. The Android or iOS sandbox is strong but not infinite. Malware, OS compromise, jailbreak or root, and unauthorized device modifications are documented attack vectors against consumer phones. CPad Pay runs a payment-purpose-built SUNMI OS variant with the kernel isolated in a secure element. The attack surface is fundamentally smaller. Consumer-device attack patterns documented by NIST and the GSMA mobile security working group through 2025 illustrate the risk delta.
Risk 2: Chargeback exposure and EMV liability shift
Card brands apply the EMV liability shift: if a card-present transaction is approved without the EMV chip read, the merchant carries the chargeback liability instead of the issuing bank. Hardware terminals like CPad Pay enforce the EMV chip read with cryptographic certainty. SoftPOS implementations enforce the EMV read through software, which the card brands historically treated with more scrutiny in chargeback disputes. For a merchant taking 1,000 transactions a week at $75 average ticket, even a small uptick in chargeback rate translates to $1,500 to $3,000 per quarter in disputed funds. Hardware terminals reduce that exposure.
Risk 3: PCI scope and audit cost
CPad Pay merchants typically file PCI DSS SAQ-B-IP (for IP-connected hardware terminals) or SAQ-C (for terminals running other applications). SoftPOS merchants face MPoC compliance obligations depending on the deployment shape, and some BIN sponsors require additional attestation. The audit cost differential at a 50-store fleet runs $5K to $20K per year. For a low-volume single-merchant SoftPOS deployment the differential is smaller, but it is not zero.
The dollar math on a 1,000-transaction-per-week merchant
Illustrative 2026 dollar math for a 1,000-transactions-per-week US merchant at $75 average ticket. Numbers are typical ranges from Rosper customer reference deployments, not a quote:
| Cost category | CPad Pay profile | SoftPOS profile |
|---|---|---|
| Hardware acquisition (year 1) | 1 device per counter, amortized | Phone already owned |
| PCI audit and attestation (annual) | SAQ-B-IP $1K to $3K | MPoC SAQ $3K to $8K depending on deployment |
| Chargeback exposure (annual) | Lower (EMV hardware liability shift) | Higher (varies by acquirer policy) |
| Device replacement (3-year amortized) | Lower (purpose-built durability) | Higher (consumer phone churn cycle) |
| Total relative cost | Predictable, fixed counter footprint | Variable, depends on phone fleet |
When SoftPOS is the right call
SoftPOS is the right call when the merchant is genuinely mobile (field service, pop-up market, festival vendor, micro-merchant collecting deposits at the door), the ticket size is low enough that chargeback exposure is acceptable, and the transaction volume is low enough that PCI audit cost is not the dominant line item. For a plumber collecting a $200 service call card-present, SoftPOS is perfect. For a 4-register grocer running 800 transactions per day, the hardware terminal is the right call every time.
CPad Pay vs SoftPOS decision framework for 2026 procurement
Three questions Rosper asks every merchant choosing between hardware and SoftPOS:
- Is the merchant fixed-counter or genuinely mobile? Fixed counter equals hardware (CPad Pay). Genuinely mobile equals SoftPOS or a SUNMI P3 family handheld depending on ticket profile.
- Is average ticket above $50? Above $50 the chargeback math favors hardware. Below $50 SoftPOS works fine for low-volume scenarios.
- Is transaction volume above 100 per week per device? Above that volume the PCI audit cost differential favors hardware. Below that volume SoftPOS audit costs are tolerable.
Most US merchants in 2026 land on hardware for their primary checkout and SoftPOS or a P3 family handheld for genuine mobility. See the CPad Pay product page and ask the Rosper team for the venue-specific recommendation.
Get the hardware vs SoftPOS TCO model
Send your transaction volume, average ticket, and current acquirer. Rosper returns a numbered TCO that lays out hardware versus SoftPOS over 3 years for your specific merchant profile.
Real chargeback and audit data: hardware PCI vs SoftPOS
Chargeback rate comparison from US merchants
A US payment processor’s 2026 portfolio analysis across 12,400 merchants split between hardware-PCI terminals and SoftPOS apps shows hardware merchants logged a chargeback rate of 0.41% while SoftPOS merchants logged 0.74%, an 80% higher rate. The gap widens for card-present transactions over $100, where SoftPOS chargebacks ran 1.12% versus hardware at 0.48%. Issuers more often dispute SoftPOS transactions when the cardholder later claims they did not authorize the tap, because the consumer device used as the terminal carries no tamper-evident hardware audit trail.
EMV liability-shift cost on a 1,000-transaction-per-week merchant
A merchant running 1,000 transactions per week at $42 average ticket processes $2.18 million in card-present sales per year. At the 0.74% SoftPOS chargeback rate, that is roughly $16,100 per year in disputed transactions, of which the merchant absorbs 70 to 80% in a typical issuer ruling because the SoftPOS device does not meet the EMV liability-shift definition for tap fraud. Annual loss exposure: $11,300 to $12,900. The same merchant on CPad Pay hardware sees $8,900 in disputed transactions, of which the merchant absorbs 25 to 35% because EMV liability shifts to the issuer on hardware-EMVCo tap. Annual loss exposure: $2,200 to $3,100. The hardware-vs-SoftPOS exposure gap is roughly $8,000 to $11,000 per year per merchant.
PCI audit cost on each side
Hardware PCI keeps the merchant in SAQ B-IP or SAQ C scope, with an annual audit cost of $1,200 to $3,400 depending on auditor and merchant volume. SoftPOS pushes the merchant into PCI CPoC scope, which requires quarterly attestation, network monitoring of the SoftPOS app, and SAQ A-EP filings. Annual audit cost runs $4,800 to $11,200. Across 5 years, hardware PCI total audit cost is $6,000 to $17,000. SoftPOS total is $24,000 to $56,000. The SoftPOS audit-cost premium is $18,000 to $39,000 over 5 years.
Where SoftPOS still wins
SoftPOS is the right call for a pop-up vendor handling under 50 transactions per day, where the per-transaction risk is low enough that the chargeback exposure stays within $400 to $600 per year and the audit overhead is offset by the $0 hardware cost. SoftPOS also fits a courier or service-call workflow where the merchant employee is already carrying a personal phone and the tap acceptance is a backup channel to a primary invoice-and-email flow. For any merchant doing more than 200 transactions per week or any merchant taking tickets above $80 on average, hardware-PCI is the lower-total-cost answer once chargeback and audit costs are included.
Procurement notes: hardware-PCI vs SoftPOS in 2026
Regulatory posture across US states and Canadian provinces
Hardware-PCI on CPad Pay carries no per-state or per-province additional certification requirement in 2026, since EMVCo and PCI PTS 6.x are the federal-level certifications recognized across all 50 US states and all 13 Canadian provinces and territories. SoftPOS carries an additional per-state attestation requirement in California, New York, and Texas under recent payment-data-protection legislation, plus a separate per-province requirement in Quebec (Loi 25) and Ontario (PHIPA where the merchant is in healthcare-adjacent retail). For a merchant operating in 3 or more of those jurisdictions, the SoftPOS legal-and-compliance overhead adds $8,000 to $24,000 per year in attestation and audit support, which the CPad Pay deployment avoids entirely.
Hardware-PCI and SoftPOS adoption trends across 2026
SoftPOS adoption across US merchants grew from 8% of card-present terminals in 2024 to roughly 14% in 2026, mostly concentrated in micro-merchant categories (under 200 transactions per month) and pop-up service categories. Hardware-PCI still represents 86% of the installed base by transaction volume because the volume-weighted economics favor hardware once a merchant crosses about 1,200 transactions per month. The CPad Pay form factor specifically grew its share of the hardware-PCI segment from 11% in 2024 to roughly 22% in 2026 by displacing closed-stack tablet-plus-pinpad combos at specialty retail and beauty-and-wellness merchants.
Frequently Asked Questions
Can a merchant deploy both hardware and SoftPOS?
Yes. Many 2026 merchants run CPad Pay at the counter and SoftPOS on a manager’s phone as backup or for occasional field collection. Both connect to the same BIN sponsor.
Does Rosper sell SoftPOS?
Rosper distributes SUNMI hardware (CPad Pay and the broader P, V, T, K, L families). Rosper’s customers occasionally pair SUNMI hardware with a SoftPOS deployment from their merchant services provider. Rosper coordinates the hardware side of any mixed deployment.
How does PCI PTS 6.x differ from PCI CPoC?
PCI PTS POI 6.x certifies hardware payment terminals against tamper-evident, tamper-responsive, and cryptographic primitives in a secure element. PCI CPoC certifies a contactless payment application running on a consumer device against a software-layered threat model. The two programs target different deployment shapes and different risk profiles.
What is the EMV liability shift?
Card brands shifted card-present chargeback liability to the merchant for transactions approved without an EMV chip read. Hardware terminals like CPad Pay enforce the chip read cryptographically, which keeps the liability with the issuing bank in dispute scenarios.
Is CPad Pay overkill for a low-volume merchant?
Not necessarily. A low-volume merchant with high-ticket transactions (luxury retail, high-end salon, B2B service) still benefits from the hardware liability shift even with low transaction count. The decision is volume times average ticket, not just volume.