Information Security Policy
Touch2Sign Ltd
Version: 1.0
Effective date: 11 July 2026
Owner: Robert — Security Lead
Approved by: Robert — CEO / Managing Director
Next review: 11 July 2027
1. Purpose
This policy establishes Touch2Sign Ltd’s commitment to protecting information assets and personal data processed through the Touch2Sign electronic signature and deed witnessing platform. It supports compliance with GDPR, UK GDPR, eIDAS-aligned signature flows, ISO 27001, and SOC 2 requirements.
2. Scope
Applies to:
- All Touch2Sign employees, contractors, and third parties with access to production systems or customer data
- The Touch2Sign SaaS platform hosted on AWS (eu-west-1, Ireland)
- All information types: customer documents, signing audit data, identity verification results, account and billing data
Out of scope unless explicitly agreed: customer content uploaded under customer’s own compliance regime (e.g. customer-owned Part 11 validation).
3. Information security objectives
- Protect confidentiality, integrity, and availability of customer documents and personal data
- Maintain defensible audit trails for electronic signatures and deed witnessing
- Meet contractual and regulatory obligations (GDPR Art 28, DPA commitments)
- Achieve and maintain ISO 27001 certification and SOC 2 Type II attestation
- Detect, respond to, and recover from security incidents within defined timeframes
4. Roles and responsibilities
| Role |
Responsibility |
Current assignee |
CEO |
Ultimate accountability; approves policy; resources for ISMS |
Robert |
| Security Lead |
ISMS operation; risk register; incident commander; audit liaison |
Robert |
| DPO / Privacy Lead |
GDPR compliance; DPIA; DSAR; breach notification to authorities |
Robert |
| Engineering Lead |
Secure development; access control; patching; DR |
Robert |
| All staff |
Comply with policies; report incidents; complete security training |
Robert (sole operator) |
4.1 Solo operator model
Touch2Sign is currently operated by one person who holds all roles above. Compensating controls (automated build/QA gates, change log, release checklist, documented self-review) are defined in SOLO_TEAM_OPERATING_MODEL.md and accepted for SOC 2 / ISO 27001 until additional staff with production access are onboarded.
5. Risk management
- Touch2Sign maintains a risk register reviewed quarterly
- Risks are assessed for likelihood and impact; treatment options: mitigate, transfer, accept, avoid
- Residual risks above appetite require CEO approval
6. Key security principles
6.1 Access control
- Least privilege for all systems (AWS IAM, Cognito, database, admin routes)
- Multi-factor authentication required for production AWS, GitHub org admins, and Touch2Sign admin accounts
- Quarterly access reviews documented
6.2 Encryption
- TLS 1.2+ for all data in transit
- AES-256 (or equivalent) for data at rest — S3, RDS
- Secrets stored in AWS Secrets Manager — never in source code
6.3 Logging and monitoring
- Authentication events, document lifecycle events, and admin actions logged
- Logs retained minimum 90 days (operational); audit artifacts per customer retention (up to 7 years)
- Alerts configured for authentication anomalies and service errors
6.4 Secure development
- Code changes via pull request with peer review
- Dependency vulnerability monitoring (Dependabot)
- Critical patches within 7 days; high within 30 days
- Production deployment via approved process only
6.5 Third parties
- Sub-processors assessed before engagement — see Sub-processor Register
- DPAs and SCCs required for processors handling EU/UK personal data
6.6 Data retention and disposal
- Retention per customer org settings and legal minimums (eIDAS evidence)
- Secure deletion on account termination and retention expiry
- Customer DSARs handled within 30 days
6.7 Incident response
- Follow the Incident Response Plan
- Personal data breaches assessed for ICO/DPC notification within 72 hours
7. Compliance
Touch2Sign aligns with:
- GDPR / UK GDPR (Regulation 2016/679, UK retained law)
- eIDAS Regulation (EU) 910/2014 — signature level implementation
- UK Electronic Communications Act 2000
- ISO/IEC 27001:2022 (certification programme)
- AICPA SOC 2 Trust Service Criteria
Touch2Sign does not by default process US HIPAA Protected Health Information. Customers must not upload PHI unless a separate BAA is executed.
8. Training and awareness
- Security induction for all new joiners
- Annual security awareness training for all staff
- Role-specific training for engineering (secure coding) and support (DSAR, phishing)
9. Policy violations
Violations may result in disciplinary action up to termination and contractual remedies. Report suspected violations to security@touch2sign.com or the Security Lead.
10. Related documents
- Incident Response Plan
- Access Control Policy
- Acceptable Use Policy
- Data Processing Agreement
- Privacy Policy
- Sub-processor Register
11. Review
This policy is reviewed annually or after a significant incident or regulatory change.
Approval
| Name |
Role |
Signature |
Date |
Robert |
CEO / Security Lead |
Electronic |
11 July 2026 |