Password & Authentication Standard

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: Robert — Security Lead

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Establish minimum requirements for passwords, multi-factor authentication, and signer identity verification across the Touch2Sign platform. Ensures consistent protection of accounts, signing sessions, and audit defensibility.

2. Scope

Context	Covered by this standard
Amazon Cognito (customer and admin accounts)	Yes
AWS IAM console access	Yes (see Access Control Policy)
GitHub organisation	Yes
Signing recipient flows (email PIN, session PIN, WebAuthn)	Yes
API keys and service tokens	Refer to Cryptography & Key Management Policy

3. Amazon Cognito password requirements

Cognito user pool password policy is configured to meet or exceed:

Parameter	Minimum setting
Minimum length	12 characters
Require uppercase	Yes
Require lowercase	Yes
Require numbers	Yes
Require symbols	Yes
Temporary password validity	7 days maximum
Password reuse	Prevent reuse of last 5 passwords (where supported)
Account lockout	Lock after 5 failed attempts; unlock via admin or timed reset

Passwords must not be:

• Dictionary words or common patterns (Password123!)
• Shared across personal and Touch2Sign accounts
• Stored in browsers on shared devices without full-disk encryption

4. Multi-factor authentication (MFA)

4.1 Internal and admin accounts

Account type	MFA	Methods (in order of preference)
Touch2Sign platform staff (/platform)	Required — app TOTP (QR) after password; session flagged mfa_verified	TOTP (Authenticator / 1Password); WebAuthn later
Touch2Sign org owners/admins (/admin)	Required for admin UI — app TOTP (profiles.admin_totp_*); proxy gate	TOTP
AWS IAM	Required	Hardware key, TOTP
GitHub org (write/admin)	Required	Passkey, TOTP

Implementation note (Aug 2026): Org and platform MFA are application TOTP, not Cognito MFA. The Admin Settings “Cognito 2FA” control is not wired — do not treat it as live. Org-admin MFA currently gates /admin/* pages; API-wide enforcement is tracked for HIPAA tier (docs/compliance/HIPAA_TECHNICAL_CONTROLS_GAP.md).

4.2 Customer organisation accounts

• MFA strongly recommended for all organisation admins (enforced for owners/admins on /admin as above)
• Non-admin members/senders: password only today — MFA for all ePHI workforce required before HIPAA BA offer (hipaa_mode)
• Product enforcement per org tier documented in customer-facing security guide
• SMS OTP used only where TOTP/WebAuthn unavailable — subject to SIM-swap risk acceptance

4.3 MFA recovery

• Recovery codes generated at MFA enrolment; stored offline by user
• Admin-assisted MFA reset requires identity verification and is logged
• No MFA reset via email link alone without secondary verification

5. WebAuthn and platform biometric signing

Touch2Sign supports WebAuthn / platform biometric authentication for signer identity binding on supported devices.

Control	Requirement
Secure context	HTTPS or localhost only
Relying party ID	Matches production domain configuration
Credential binding	Signature linked to WebAuthn assertion in audit trail
Fallback	Device fingerprint / SES fallback documented in signature certificate — not equivalent to QES
Mobile verify	/mobile-verify/[token] flow for same-device signing

WebAuthn credentials are not shared across tenants. Platform biometric is marketed as AES-aligned identity binding — regulated QES flows use OneID / eID Easy where configured.

6. Signing PIN and email verification

For signing recipients (including 21 CFR Part 11 flows):

Mechanism	Standard
Email PIN / OTP	Time-limited; single use per verification step
Signing PIN / password	Minimum 6 digits or equivalent entropy; lockout after 3 failed attempts (HTTP 423)
Session reuse	Within 30-minute session window, PIN re-entry only — no full re-verification
Intent to sign	Required for Part 11 before signature application
Reason for signing	Captured and stored in audit trail

Signing PINs are distinct from Cognito account passwords. Support staff must never request a signer's PIN.

7. Session management

• Admin sessions: idle timeout 30 minutes maximum
• Signing sessions: 30-minute window for Part 11 repeat signatures
• Token invalidation on logout, password change, and suspected compromise
• Concurrent session limits enforced where Cognito configuration supports it

8. API and service authentication

• Service-to-service calls use IAM roles or signed tokens — not user passwords
• Webhook endpoints validate signatures or shared secrets from Secrets Manager
• Signing API tokens are scoped, rotatable, and never embedded in client-side code

9. Prohibited practices

• Hard-coded credentials in source code
• Sharing MFA devices or TOTP seeds
• Disabling MFA for convenience on production systems
• Logging passwords, PINs, or OTP values in application logs

10. Related documents

• Access Control Policy
• Cryptography & Key Management Policy
• Secure Development Policy
• MOBILE_BIOMETRIC.md (compliance docs)

11. Review

Reviewed annually and after Cognito configuration changes or authentication-related incidents.

---

Approval

Name	Role	Signature	Date
Robert	CEO / Security Lead	Electronic	11 July 2026