# Information Security Policy

**Touch2Sign Ltd**  
**Version:** 1.0  
**Effective date:** 11 July 2026  
**Owner:** Robert — Security Lead  
**Approved by:** Robert — CEO / Managing Director  
**Next review:** 11 July 2027

---

## 1. Purpose

This policy establishes Touch2Sign Ltd’s commitment to protecting information assets and personal data processed through the Touch2Sign electronic signature and deed witnessing platform. It supports compliance with GDPR, UK GDPR, eIDAS-aligned signature flows, ISO 27001, and SOC 2 requirements.

## 2. Scope

Applies to:

- All Touch2Sign employees, contractors, and third parties with access to production systems or customer data  
- The Touch2Sign SaaS platform hosted on AWS (eu-west-1, Ireland)  
- All information types: customer documents, signing audit data, identity verification results, account and billing data  

Out of scope unless explicitly agreed: customer content uploaded under customer’s own compliance regime (e.g. customer-owned Part 11 validation).

## 3. Information security objectives

1. Protect confidentiality, integrity, and availability of customer documents and personal data  
2. Maintain defensible audit trails for electronic signatures and deed witnessing  
3. Meet contractual and regulatory obligations (GDPR Art 28, DPA commitments)  
4. Achieve and maintain ISO 27001 certification and SOC 2 Type II attestation  
5. Detect, respond to, and recover from security incidents within defined timeframes  

## 4. Roles and responsibilities

| Role | Responsibility | Current assignee |
|------|----------------|------------------|
| **CEO** | Ultimate accountability; approves policy; resources for ISMS | Robert |
| **Security Lead** | ISMS operation; risk register; incident commander; audit liaison | Robert |
| **DPO / Privacy Lead** | GDPR compliance; DPIA; DSAR; breach notification to authorities | Robert |
| **Engineering Lead** | Secure development; access control; patching; DR | Robert |
| **All staff** | Comply with policies; report incidents; complete security training | Robert (sole operator) |

### 4.1 Solo operator model

Touch2Sign is currently operated by one person who holds all roles above. **Compensating controls** (automated build/QA gates, change log, release checklist, documented self-review) are defined in [SOLO_TEAM_OPERATING_MODEL.md](../SOLO_TEAM_OPERATING_MODEL.md) and accepted for SOC 2 / ISO 27001 until additional staff with production access are onboarded.

## 5. Risk management

- Touch2Sign maintains a **risk register** reviewed quarterly  
- Risks are assessed for likelihood and impact; treatment options: mitigate, transfer, accept, avoid  
- Residual risks above appetite require CEO approval  

## 6. Key security principles

### 6.1 Access control

- Least privilege for all systems (AWS IAM, Cognito, database, admin routes)  
- **Multi-factor authentication** required for production AWS, GitHub org admins, and Touch2Sign admin accounts  
- Quarterly access reviews documented  

### 6.2 Encryption

- **TLS 1.2+** for all data in transit  
- **AES-256** (or equivalent) for data at rest — S3, RDS  
- Secrets stored in **AWS Secrets Manager** — never in source code  

### 6.3 Logging and monitoring

- Authentication events, document lifecycle events, and admin actions logged  
- Logs retained minimum **90 days** (operational); audit artifacts per customer retention (up to 7 years)  
- Alerts configured for authentication anomalies and service errors  

### 6.4 Secure development

- Code changes via pull request with peer review  
- Dependency vulnerability monitoring (Dependabot)  
- Critical patches within **7 days**; high within **30 days**  
- Production deployment via approved process only  

### 6.5 Third parties

- Sub-processors assessed before engagement — see Sub-processor Register  
- DPAs and SCCs required for processors handling EU/UK personal data  

### 6.6 Data retention and disposal

- Retention per customer org settings and legal minimums (eIDAS evidence)  
- Secure deletion on account termination and retention expiry  
- Customer DSARs handled within **30 days**  

### 6.7 Incident response

- Follow the **Incident Response Plan**  
- Personal data breaches assessed for ICO/DPC notification within **72 hours**  

## 7. Compliance

Touch2Sign aligns with:

- GDPR / UK GDPR (Regulation 2016/679, UK retained law)  
- eIDAS Regulation (EU) 910/2014 — signature level implementation  
- UK Electronic Communications Act 2000  
- ISO/IEC 27001:2022 (certification programme)  
- AICPA SOC 2 Trust Service Criteria  

Touch2Sign does **not** by default process US HIPAA Protected Health Information. Customers must not upload PHI unless a separate BAA is executed.

## 8. Training and awareness

- Security induction for all new joiners  
- Annual security awareness training for all staff  
- Role-specific training for engineering (secure coding) and support (DSAR, phishing)  

## 9. Policy violations

Violations may result in disciplinary action up to termination and contractual remedies. Report suspected violations to security@touch2sign.com or the Security Lead.

## 10. Related documents

- Incident Response Plan  
- Access Control Policy  
- Acceptable Use Policy  
- Data Processing Agreement  
- Privacy Policy  
- Sub-processor Register  

## 11. Review

This policy is reviewed **annually** or after a significant incident or regulatory change.

---

**Approval**

| Name | Role | Signature | Date |
|------|------|-----------|------|
| Robert | CEO / Security Lead | Electronic | 11 July 2026 |