Understanding Signature Types in Ketryx

Ketryx supports two types of Part 11 compliant signatures:

1. Click-through signatures: Users confirm their approval with a single click.
2. Biometric (MFA) signatures: Users must complete multi-factor authentication to confirm approval.
   1. MFA can be provided in several ways, including biometrics (e.g., Touch ID, Face ID, Windows Hello), OTP (e.g., Google Authenticator, Authy), or the current user's operating system password.

Whether you see a click-through or MFA prompt depends on two settings described below.

Setting 1: Electronic Signature Item Types

Location: Organization > Advanced OR Project > Settings > Advanced

This setting determines which item types require an electronic signature at all. It accepts a JSON list of item type names.

Default:

["Risk", "Test Case", "Test Execution", "Test Plan"]

To customize this list, add or remove item types. You can find the complete list of standard item types here.

Note: Use the item type names as they appear in your organization or project. If you've renamed a standard item type (e.g., "Requirement" to "Feature") or created a custom item type (e.g., "Threat"), use those names.

Example

["Requirement", "Software Item Spec", "Test Case"]

To disable electronic signatures entirely:

[]

Setting 2: Require MFA for Electronic Signatures

Location: Organization > Security
(Only visible to Organization Owners)

When enabled: All electronic signatures across the organization will require MFA.

When disabled: MFA is only required if the individual user has MFA configured on their account.

How These Settings Work Together

Step 1: Is the item type in the "Electronic signature item types" list?

• No → No signature required. Approval happens without any signature prompt.
• Yes → Proceed to Step 2.

Step 2: Is MFA required for this signature?

• If "Require MFA for electronic signatures" is enabled at the organization level → MFA required
• If that setting is disabled but the user has MFA configured on their account → MFA required (for that user)
• If that setting is disabled and the user does not have MFA configured → Click-through signature only