# Password & Authentication Standard

**Touch2Sign Ltd**  
**Version:** 1.0  
**Effective date:** 11 July 2026  
**Owner:** Robert — Security Lead  
**Approved by:** Robert — CEO / Managing Director  
**Next review:** 11 July 2027

---

## 1. Purpose

Establish minimum requirements for passwords, multi-factor authentication, and signer identity verification across the Touch2Sign platform. Ensures consistent protection of accounts, signing sessions, and audit defensibility.

## 2. Scope

| Context | Covered by this standard |
|---------|--------------------------|
| Amazon Cognito (customer and admin accounts) | Yes |
| AWS IAM console access | Yes (see Access Control Policy) |
| GitHub organisation | Yes |
| Signing recipient flows (email PIN, session PIN, WebAuthn) | Yes |
| API keys and service tokens | Refer to Cryptography & Key Management Policy |

## 3. Amazon Cognito password requirements

Cognito user pool password policy is configured to meet or exceed:

| Parameter | Minimum setting |
|-----------|-----------------|
| Minimum length | 12 characters |
| Require uppercase | Yes |
| Require lowercase | Yes |
| Require numbers | Yes |
| Require symbols | Yes |
| Temporary password validity | 7 days maximum |
| Password reuse | Prevent reuse of last 5 passwords (where supported) |
| Account lockout | Lock after 5 failed attempts; unlock via admin or timed reset |

Passwords must not be:

- Dictionary words or common patterns (`Password123!`)  
- Shared across personal and Touch2Sign accounts  
- Stored in browsers on shared devices without full-disk encryption  

## 4. Multi-factor authentication (MFA)

### 4.1 Internal and admin accounts

| Account type | MFA | Methods (in order of preference) |
|--------------|-----|----------------------------------|
| Touch2Sign **platform** staff (`/platform`) | **Required** — app TOTP (QR) after password; session flagged `mfa_verified` | TOTP (Authenticator / 1Password); WebAuthn later |
| Touch2Sign **org owners/admins** (`/admin`) | **Required** for admin UI — app TOTP (`profiles.admin_totp_*`); proxy gate | TOTP |
| AWS IAM | Required | Hardware key, TOTP |
| GitHub org (write/admin) | Required | Passkey, TOTP |

**Implementation note (Aug 2026):** Org and platform MFA are **application TOTP**, not Cognito MFA. The Admin Settings “Cognito 2FA” control is **not wired** — do not treat it as live. Org-admin MFA currently gates `/admin/*` pages; API-wide enforcement is tracked for HIPAA tier (`docs/compliance/HIPAA_TECHNICAL_CONTROLS_GAP.md`).

### 4.2 Customer organisation accounts

- MFA strongly recommended for all organisation admins (enforced for owners/admins on `/admin` as above)  
- **Non-admin members/senders:** password only today — **MFA for all ePHI workforce** required before HIPAA BA offer (`hipaa_mode`)  
- Product enforcement per org tier documented in customer-facing security guide  
- SMS OTP used only where TOTP/WebAuthn unavailable — subject to SIM-swap risk acceptance  

### 4.3 MFA recovery

- Recovery codes generated at MFA enrolment; stored offline by user  
- Admin-assisted MFA reset requires identity verification and is logged  
- No MFA reset via email link alone without secondary verification  

## 5. WebAuthn and platform biometric signing

Touch2Sign supports **WebAuthn / platform biometric** authentication for signer identity binding on supported devices.

| Control | Requirement |
|---------|-------------|
| Secure context | HTTPS or localhost only |
| Relying party ID | Matches production domain configuration |
| Credential binding | Signature linked to WebAuthn assertion in audit trail |
| Fallback | Device fingerprint / SES fallback documented in signature certificate — not equivalent to QES |
| Mobile verify | `/mobile-verify/[token]` flow for same-device signing |

WebAuthn credentials are not shared across tenants. Platform biometric is marketed as **AES-aligned** identity binding — regulated QES flows use OneID / eID Easy where configured.

## 6. Signing PIN and email verification

For signing recipients (including 21 CFR Part 11 flows):

| Mechanism | Standard |
|-----------|----------|
| Email PIN / OTP | Time-limited; single use per verification step |
| Signing PIN / password | Minimum 6 digits or equivalent entropy; lockout after 3 failed attempts (HTTP 423) |
| Session reuse | Within 30-minute session window, PIN re-entry only — no full re-verification |
| Intent to sign | Required for Part 11 before signature application |
| Reason for signing | Captured and stored in audit trail |

Signing PINs are distinct from Cognito account passwords. Support staff must never request a signer's PIN.

## 7. Session management

- Admin sessions: idle timeout **30 minutes** maximum  
- Signing sessions: 30-minute window for Part 11 repeat signatures  
- Token invalidation on logout, password change, and suspected compromise  
- Concurrent session limits enforced where Cognito configuration supports it  

## 8. API and service authentication

- Service-to-service calls use IAM roles or signed tokens — not user passwords  
- Webhook endpoints validate signatures or shared secrets from Secrets Manager  
- Signing API tokens are scoped, rotatable, and never embedded in client-side code  

## 9. Prohibited practices

- Hard-coded credentials in source code  
- Sharing MFA devices or TOTP seeds  
- Disabling MFA for convenience on production systems  
- Logging passwords, PINs, or OTP values in application logs  

## 10. Related documents

- Access Control Policy  
- Cryptography & Key Management Policy  
- Secure Development Policy  
- MOBILE_BIOMETRIC.md (compliance docs)  

## 11. Review

Reviewed **annually** and after Cognito configuration changes or authentication-related incidents.

---

**Approval**

| Name | Role | Signature | Date |
|------|------|-----------|------|
| Robert | CEO / Security Lead | Electronic | 11 July 2026 |