Security And Compliance

TIB Secured Key Authority

TIB Secured issues TIB application keys. Application-bound keys identify the intended app, audience and approved scopes. Private material stays in TIB-protected custody; the connection receives the appropriate public material. TCC coordinates approved request packages and receives public keys only.

Protect Member Sign-In

Use the approved app-specific connection adapter, exact registered HTTPS callbacks, request-bound state, S256 PKCE and one-use short-lived exchange. Validate issuer, audience, subject, expiry and replay conditions. Email matching alone cannot claim an existing local app account.

Keep Access Limited

Document purpose and field-level scope, separate personal/business subjects, protect operator access and store secrets outside source code. Make revocation effective, protect logs, test backup restoration and document incident response and vulnerability remediation.

Maintain Your Connection

Keep the authorized contacts, business identity, callbacks, privacy/terms and data-flow documentation current. Material ownership, scope, provider, audience or endpoint changes need review. Continued access depends on current approvals and evidence. The proposed TIB SSO Compliance Standard remains subject to owner approval.

Protect Minors And Listing Audiences

Prepare age-appropriate experiences and guardian permissions where required. Separate adult-exclusive listings and assets from minor-facing services. Maintain an assigned reporting route and safeguarding evidence. Marketplace visibility and product content have separate approval requirements.

Policies And Operational Evidence

Submit policy acceptance and training evidence when required by the approved standard. Record review findings and remediation, preserve audit history and follow the published appeal process. Specific review intervals and incident deadlines take effect through the approved policy version, not this overview.

Ready To Prepare Your Connection?

Use your existing personal account and registered business profile to start a normal application. TIB-owned applications use their dedicated portal.

Required Incident Reporting Links

Every SSO provider must publish and maintain the general incident reporting link issued by TIB Secured. Providers serving minors must also publish the separate minor safety link issued by TIB. Save the application draft to receive the links. Upload publication evidence with the security packet. TIB verifies both links, where required, before key issuance. These requirements continue after onboarding.

Implementation Evidence Required

• TLS And Transport: TLS 1.3 preferred; TLS 1.2 minimum, older protocols disabled and certificates validated.
• Encryption And Key Custody: Use maintained authenticated encryption for sensitive storage, backups and exports; server-side managed keys with tested rotation and revocation.
• Authorization And Isolation: Demonstrate that two members and two applications cannot access each other’s records or documents.
• Personal Documents: Do not place personal documents in SSO or onboarding packets. Private document services require scoped, expiring access and fail-closed file inspection before release.
• Banking Information: Transmit only approved provider tokens and wallet references; exclude PAN, CVV, bank credentials and private keys from SSO.
• Revocation And Retention: Prove access stops on revocation and expiry; demonstrate deletion, backup recovery and audit-log redaction.
• Release Tests: Test consent, issuer/audience, state/PKCE, replay, credentials and dependencies; no unresolved critical or high findings in shared-data paths.

Upload security and acceptance-test packets with the tested source commit, environment, dates, test IDs, expected and observed outcomes, findings and remediation. TIB reviewers must inspect actual implementation and tests, record each uploaded evidence reference and verify all 14 controls before key issuance. Reviews older than 30 days cannot authorize a new key. Material code, scope, origin or processor changes require renewed review. Missing or unverified controls block approval; a questionnaire alone does not pass.

New activation also requires the verified review, bound profiles, published reporting links and an active TIB key. Existing app connections are not silently changed. This is TIB’s integration acceptance policy, not a claim of external certification.

Technical references: OWASP Transport Security, Cryptographic Storage and File Upload Protection.