Remote Working Policy

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: [HR / Security Lead]

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Define security requirements for Touch2Sign personnel working remotely or from non-office locations. Protects customer data and production systems when accessed outside Touch2Sign premises.

2. Scope

Applies to all employees and contractors who:

• Work from home, co-working spaces, or while travelling
• Access Touch2Sign email, Slack, GitHub, AWS, or customer data remotely
• Use personal or company-issued devices for Touch2Sign work

3. Approved remote access

Touch2Sign production systems are cloud-hosted (AWS eu-west-1). Remote access is permitted via:

• HTTPS to Touch2Sign application and admin interfaces
• AWS Console / CLI with MFA
• GitHub with MFA
• VPN to AWS resources not required when MFA is enforced on all privileged access paths

Direct RDS or S3 access from remote locations requires MFA, least-privilege IAM, and approved tooling — never public endpoints.

4. Device requirements

Requirement	Company device	BYOD (approved)
Full-disk encryption	Required	Required
OS auto-updates	Required	Required
Screen lock (≤ 5 min)	Required	Required
Antivirus / endpoint protection	Required	Required
Firewall enabled	Required	Required
Jailbroken / rooted devices	Prohibited	Prohibited
Shared family computer for production access	Discouraged	Prohibited without CEO exception

BYOD must be registered with IT/Security and removed at engagement end.

5. Authentication

• MFA mandatory for AWS, GitHub, Cognito admin, and email — see Access Control Policy
• No saving production passwords in unsecured browser profiles on shared devices
• WebAuthn/passkeys preferred over SMS where supported

VPN is not required for standard application access when MFA and TLS protect the session. VPN or AWS Session Manager may be mandated for specific break-glass or database administration tasks.

6. Physical security — clean desk

Remote workers must:

• Position screens away from public view where practicable
• Lock screen when leaving device unattended
• Not discuss Confidential or Restricted customer data in public spaces
• Store printed materials securely; cross-cut shred when discarded
• Not leave devices in unattended vehicles

Video calls: use background blur; do not share screen with customer documents visible unless necessary for support.

7. Network security

Practice	Requirement
Home Wi-Fi	WPA2/WPA3; change default router password
Public Wi-Fi	Acceptable for MFA-protected HTTPS access; avoid public Wi-Fi for AWS console without additional caution
Public hotspots	Do not access Restricted data on untrusted networks without encrypted tunnel if mandated by Security Lead
Personal hotspots	Preferred over café Wi-Fi for sensitive tasks

8. Data handling

• Customer documents and exports must not be stored on personal cloud (Dropbox, iCloud) without approval
• Use Touch2Sign-approved systems only for Confidential data
• Report lost or stolen devices within 4 hours to security@touch2sign.com
• Remote wipe enabled on company devices

9. Incident reporting

Report from any location:

• Lost/stolen device
• Suspected malware
• Accidental customer data disclosure
• Phishing targeting Touch2Sign credentials

Follow Incident Response Plan — preserve evidence; do not self-remediate production without guidance.

10. Prohibited activities

• Allowing family members to use devices logged into Touch2Sign systems
• Disabling encryption or MFA for convenience
• Screen-recording customer signing sessions without consent
• Working from sanctioned countries without Legal approval

11. Related documents

• Acceptable Use Policy
• Access Control Policy
• Password & Authentication Standard
• Data Classification Policy
• Security Awareness Training

12. Review

Reviewed annually and when remote work practices or tooling changes.

---

Approval

Name	Role	Signature	Date
Robert	CEO / Security Lead	Electronic	11 July 2026