# Security & Compliance

> Configure signer verification gates, evidence capture, certificates, and timestamping policies in WPsigner.

edition: both
Edition: Lite + Pro
AI note: This page applies to Lite and Pro. Call out Lite limits (PDF only, max 2 signers, email OTP, local timestamp) when they apply. Do not invent Pro-only features.
HTML: https://docs.wpsigner.com/core-features/security-compliance/
Markdown: https://docs.wpsigner.com/md/core-features/security-compliance.md
Source file: core-features/security-compliance.md

---

The **Security & Compliance** screen centralizes WPsigner's signing gates and evidence settings. Use it to decide when signers must verify an email, complete KYC, enter an access code, and which cryptographic evidence is added to completed documents. A separate per-signer option can also require a matching WordPress login before the signing page opens.

> **Lite limits**
**Lite** includes email OTP, access codes, audit trail, and local timestamps. KYC integrations, extra OTP channels, and external TSA are **Pro**. [Lite vs Pro](/getting-started/lite-vs-pro/)

Open **WPsigner → More → Security & Compliance**.

> **caution**
These controls strengthen authentication and evidence. They do not by themselves certify a signature as qualified, guarantee compliance, or replace legal advice for your jurisdiction and use case.

## Signing gate policies

OTP, KYC, and access codes each support three policies:

| Policy | Behavior |
|--------|----------|
| **Always** | Require the gate for every applicable signing request |
| **Per document** | Require it only when enabled in that document's Review step |
| **Off** | Do not apply the gate |

With **Per document**, review each document before sending and enable only the controls required for that transaction.

## Email verification (OTP)

OTP verifies that the signer can receive a one-time code through a configured channel.

| Method | Requirement |
|--------|-------------|
| **Email** | Working WordPress email delivery |
| **SMS** | Configured Twilio integration |
| **Both** | Email delivery and Twilio |

Test email and SMS delivery before requiring OTP in production. A failed delivery can prevent the signer from continuing.

WPsigner rate-limits OTP requests and verifies them through protected AJAX actions. If a firewall plugin blocks OTP, check [System Status](/getting-started/system-status-and-storage/) and allowlist the WPsigner actions it reports.

## Identity verification (KYC)

KYC uses the [Didit.me integration](/integrations/didit/) to verify a government-issued ID, selfie match, and liveness result before signing.

1. Configure and test Didit under **WPsigner → More → Integrations → Didit**.
2. Return to **Security & Compliance**.
3. Choose **Always**, **Per document**, or **Off**.

The KYC policy is unavailable or ineffective until Didit credentials are configured. WPsigner stores verification status and decision metadata; identity images remain with Didit.

## Access codes

An access code is a six-digit secret associated with the signing request. The stored code is hashed rather than saved in readable form.

When access codes are required:

1. WPsigner generates or accepts the document's code.
2. Choose whether WPsigner should email the code to signers.
3. The signer must enter the code before continuing.

For stronger separation, deliver the signing link and access code through different channels.

## WordPress login (per signer)

This gate is **opt-in per signer** and **off by default**. It is not a global Security & Compliance policy and it does not replace OTP, KYC, or access codes.

When **Require WordPress login with this email** is checked on a signer:

1. The visitor must be logged in to WordPress.
2. The logged-in account email must match that signer's email (case-insensitive).
3. The unique signing link is not enough on its own.

If nobody is logged in, the signing page asks them to log in and then returns to the same link. If they are logged in with a different account, they see that mismatch and can log out, then log in as the matching user.

Use this when the signer already has a WordPress account on your site (members, staff, LMS users). The checkbox is refused if that email is not a WordPress user — create the account first, or leave the option off. Leave it off for guests and external counterparties. Public campaign links and Bulk Send CSV rows do not use this gate — those flows have no preassigned WordPress user.

You cannot activate a public campaign on a document that already has a gated signer, and you cannot turn the checkbox on while that document has an active campaign. If someone still reaches a public link and types a gated signer's email, WPsigner re-checks the login requirement and refuses the signature until the matching WordPress account is signed in. Individual signing links for a gated signer are never redirected to the campaign URL.

The invitation email adds a short note when the flag is on. Customized email templates need the `require_wp_login` variable if you want that sentence in your own copy.

## Evidence capture

| Control | Evidence added |
|---------|----------------|
| **Capture geolocation** | Approximate signer location when permission and browser support allow |
| **Capture device information** | Browser/device metadata in the audit record |
| **Digital ID (PKI)** | Cryptographic PDF certificate signature |
| **Timestamp provider (TSA)** | Trusted time evidence for the document hash |
| **Immutable timestamping** | Additional configured timestamp evidence |

Geolocation may be unavailable when the signer denies permission, the browser blocks it, or the network obscures the location.

## Compliance score

The screen displays an orientation score based on selected controls:

| Factor | Maximum contribution |
|--------|----------------------|
| OTP policy | 25 |
| Geolocation | 10 |
| Device information | 5 |
| Custom Digital ID certificate | 10 |
| Timestamp provider | Up to 50 |

KYC and access codes are important gates but do not currently add points to this score.

| Displayed level | Score / conditions |
|-----------------|--------------------|
| **SES** | 0–39 |
| **SES+** | 40–64 |
| **AdES** | 65–79 |
| **HA (QES-oriented)** | 80+ plus an active PKI certificate and qualified/custom TSA |

> **important**
The score is configuration guidance, not a legal classification or QES certification. A true Qualified Electronic Signature depends on regulated identity, certificate, provider, and jurisdictional requirements outside a score.

## Recommended profiles

### Routine internal acknowledgement

- OTP: **Per document**
- KYC: **Off**
- Access code: **Off** or **Per document**
- Device information: On
- Geolocation: Based on privacy policy
- Audit trail and secure backups: On

### Higher-risk external agreement

- OTP: **Always**
- KYC: **Per document** or **Always**
- Access code: **Per document**
- Device and geolocation evidence: On where lawful
- Commercial certificate and reliable TSA

Document the reason for each control and avoid collecting more personal data than necessary.

## Before enabling a gate globally

1. Send a test document to accounts you control.
2. Test on desktop and mobile.
3. Confirm SMTP, Twilio, Didit, and TSA connectivity as applicable.
4. Verify the final PDF and audit trail.
5. Publish signer-facing privacy and support instructions.
6. Define retention and deletion policies for collected data.

## Troubleshooting

### KYC cannot be enabled

Configure and test Didit first. The KYC gate only operates when the integration is available.

### SMS is unavailable

Install and configure the WPsigner Twilio integration, then reload the Security & Compliance screen.

### OTP requests fail

Check SMTP, spam filtering, caching, and security-plugin logs. Use **WPsigner → More → System Status** to test email and identify blocked AJAX actions.

### Signers are unexpectedly asked for a gate

Check both the global policy and the document's Review settings. **Always** overrides per-document choice; **Per document** follows the document's saved security settings.

### The score is lower than expected

Confirm the Digital ID is active and the selected TSA provider is recognized. KYC and access codes do not increase the current score.

### Require WordPress login cannot stay checked

The signer email must already belong to a WordPress user. Create that account first, or leave the option off. WPsigner does not create users.

You also cannot turn the checkbox on while the document has an **active public campaign**, and you cannot activate a campaign if any named signer already has the gate on.

### Signer sees a WordPress login page instead of the PDF

That row has **Require WordPress login with this email** on. They must sign in with the WordPress account that uses the same email, then they return to the signing link. A different logged-in account is rejected.

## Related guides

- [Creating Documents](/core-features/creating-documents/#wordpress-users) — user picker, Add me as signer #1, and the checkbox
- [Didit.me KYC](/integrations/didit/)
- [Digital ID](/digital-identity/digital-id/)
- [Timestamping](/digital-identity/timestamping/)
- [Audit Trails](/digital-identity/audit-trails/)
- [System Status, Storage & Retention](/getting-started/system-status-and-storage/)