End-client/User creation

• Registration/Compliance enabled

In the process of creating a user, and also when a new user is invited from the 'Team' section, personal information is required from the user following the registration process. Beyond the strictly personal data, the following are mandatory fields:

• Email and phone number:

This data is used to verify, in the first step, the applicant user. In this sub-sequential flow, an email is sent to the email recipient with a link to define the credentials. This method ensures the email registered exists.

Once the invitation process is done by a Director or an Account owner, the invited user will receive an email to join the SME or CONSUMER platform. The email received will contain the following information:

• _Welcome to [Name]. [Name] has invited you to join the company [Company Name] in [Name]. Click here or follow the link below to set up your credentials and start using [Name]._

The link is secured with a 48-hour valid token. Once the link expires, you will not be able to set up credentials by following that link and will need to be re-invited from the Admin portal.

Once you successfully reach the set-credentials screen, the following information is required:

As a final step, you will be required to confirm the phone number that was provided during the registration or invitation process. To run this validation we use OTP implementation, you will be required to add the 4-digit code sent to the provided phone number. This phone number will be used from this point forward as a secure device to validate key operations. The phone number will also be blocked from editing forms and can only be updated in the Admin portal under request and admin user confirmation.

Registration/Compliance disabled

Find more information in Managing your clients.

Blacklists

When fraudulent use of the platform is detected by a client, by creating a ticket to Toqio's internal support team, we can blacklist both the phone number and the IP address. Therefore, checks on these parameters are run while creating a new user. A partial flow of the client registration process where Toqio's system checks blacklisted records:

OTP

Toqio is integrated with Twilio services to validate the phone number registered as a secure device. The current implementation permits clients to choose the delivery method of these messages:

• SMS or WhatsApp

This selection is a general configuration, not client or region based, so if the client selects SMS all the OTPs will be sent through that channel.

Automatic expirations of the session

For security reasons, there are some automatic session expirations in the platform.

Password update for logged-in users

The password is created by the user on the 'set up credentials' step. Beyond the password setup and its variations, there are other sections where the password can be managed:

• Forgot password: located on the login screen, the user can find a link to a form for forgotten password reset
  • Username is required
  • If all the information is correct, the user will receive a 6-digit OTP in the registered phone number
  • Once the OTP is validated, the user will be required to add a new password

• Reset password: a user logged in can reset the password by accessing the user settings section
  • Old password:
    • On error, the user will see a generic error such as: Try it again, please. On success, the user won't see any specific message.
    • If no password is entered yet: Field is required
  • New password:
    • Validation: At least 9 characters including one uppercase, one lowercase, and one number
    • If no password is entered yet: Field is required
  • Repeat the new password:
    • Validation within new password: Passwords don't match
    • If no password is entered yet: Field is required
  • If the password has been changed successfully, the user will be shown a message: Data has been saved successfully

Security code management:

Security code update

A security code for a logged-in user can be updated in the 'User settings' section. The form presented to the user will require the following flow:

If the code has been changed successfully, the user will be shown a confirmation screen.

If the code has not been changed successfully, the user will be shown the same screen to try again or to go back. Confirming the code doesn't have a limit of tries. If they go back, the process can be started again with the old code.

Security code required

There are a few actions that must be confirmed by adding the security code. These are the following:

• Make a Payment
• Issue a new card
• View card PIN
• Block the card
• Cancel the card
• Modify card limits
• View card details

Roles and permissions:

The platform is based on permissions. This way there is control over what a user can access depending on the permissions they have assigned.

Permission is assigned to a role, and depending on what features (see Turning admin functions on/off for more information) they have, permissions belonging to a role are kept or removed.

Currently, there are two sets of roles:

Permissions

As mentioned previously, each role has a set of permissions, these permissions are what allow the platform to know when to display or not something, to allow access to different endpoints, etc. Here is a table describing some:

SME and CONSUMER clients' table of permissions