Understanding Signature Types in Ketryx

Ketryx supports two types of Part 11 compliant signatures:

1. Click-through signatures: Users confirm their approval with a single click.
2. Biometric (MFA) signatures: Users must complete multi-factor authentication to confirm approval.
   1. MFA can be provided in several ways, including biometrics (e.g., Touch ID, Face ID, Windows Hello), OTP (e.g., Google Authenticator, Authy), or the current user's operating system password.

Whether you see a click-through or MFA prompt depends on two settings described below.

Setting 1: Electronic Signature Item Types

Location: Organization > Advanced OR Project > Settings > Advanced

This setting determines which item types require an electronic signature at all. It accepts a JSON list of item type names.

Default:

["Risk", "Test Case", "Test Execution", "Test Plan"]

To customize this list, add or remove item types. You can find the complete list of standard item types here.

Note: Use the item type names as they appear in your organization or project. If you've renamed a standard item type (e.g., "Requirement" to "Feature") or created a custom item type (e.g., "Threat"), use those names.

Example

["Requirement", "Software Item Spec", "Test Case"]

To disable electronic signatures entirely:

[]

Setting 2: Require MFA for Electronic Signatures

Location: Organization > Security
(Only visible to Organization Owners)

When enabled: All electronic signatures across the organization will require MFA.

When disabled: MFA is only required if the individual user has MFA configured on their account.

How These Settings Work Together

Step 1: Is the item type in the "Electronic signature item types" list?

• No → No signature required. Approval happens without any signature prompt.
• Yes → Proceed to Step 2.

Step 2: Is MFA required for this signature?

• If "Require MFA for electronic signatures" is enabled at the organization level → MFA required
• If that setting is disabled but the user has MFA configured on their account → MFA required (for that user)
• If that setting is disabled and the user does not have MFA configured → Click-through signature only

Why these defaults?

The default list (Risk, Test Case, Test Execution, Test Plan) reflects a deliberate, risk-based approach. Formal electronic signatures are required on the essential assurance items (risks and tests), while approvals of other item types stay lightweight. This strikes a balance between Part 11 assurance where it matters most and not making every routine approval burdensome. You can adjust the list to match your own risk assessment, for example adding "Requirement" if your process calls for signed requirement approvals.

Where does the "Electronic signature item types" setting apply?

This setting controls approvals performed through the Jira and Azure DevOps approval widgets. Approvals performed in the Ketryx application itself always require an electronic signature, regardless of this setting. In other words, Ketryx errs on the stricter side: approving in the Ketryx app always asks you to confirm your name and accept the signature, and requires MFA under the conditions described in Setting 2 above. Signatures performed without MFA are still valid Part 11 electronic signatures; MFA adds a stronger identity check on top.