Enterprise Self Service Signup

This describes the self service and managed signup flow (managed is just done backend)

Overview

GetTrusted's Organization Signup Flow enables enterprise administrators to create their organization account through the GetTrusted Enterprise web portal using AWS Cognito authentication. This flow establishes the organizational infrastructure including AWS KMS encryption keys, an organization-specific Certificate Authority (CA), and OIDC integration capabilities for employee onboarding.

Key Security Features:

• AWS Cognito Authentication: Authentication with email verification, this becomes the root account after SSO.

• Automatic CA Generation: Organization intermediate CA created invisibly during signup

• AWS KMS Encryption: Organization data encrypted at rest with dedicated KMS keys

• FIPS-Compliant Cryptography: ECC P-256 signing keys with ECDSA-SHA256

• Certificate Authority Hierarchy: Organization CA signed by GetTrusted Business CA

• Transparency Logging: Business identity attestations submitted to public transparency log

• Zero-Knowledge Architecture: Sensitive data encrypted before storage in Firestore

Process Overview

Diana (a new enterprise administrator) wants to set up GetTrusted for her organization, Acme Corp. She will create an account in the gettrusted-enterprise web portal and establish her organization's cryptographic infrastructure.

Diana's Perspective (Enterprise Administrator)

1

Visit signup portal

Diana visits the Enterprise portal and clicks "Create Account".

2

Fill signup form

Fields: First Name, Last Name, Work Email, Company Name, Password.

3

Accept terms

Accept Terms of Service and Privacy Policy.

4

Email verification

Cognito sends verification code to her work email via SES.

5

Enter confirmation code

Diana enters the confirmation code from email.

6

Auto-login

Auto-login after confirmation and redirect to dashboard.

7

Create organization

Dashboard prompts organization creation with pre-filled data.

8

Submit organization details

Diana submits: Company Name, Company Domain, Contact Email.

9

Backend creates organization

Backend creates organization with encrypted data and CA certificate.

10

Organization active

Organization active: Diana can now configure OIDC and onboard employees.

Backend Perspective (GetTrusted API + AWS Services)

1

Cognito signup

Cognito signup request arrives with user credentials. Cognito creates user in user pool with email verification required. Verification code sent via AWS SES.

2

Confirmation & authentication

Confirmation received with verification code from user. User authenticated and JWT tokens issued.

3

Organization creation request

Organization creation request arrives with organization details.

4

Generate organizationId

Generate organizationId (UUID v4) and check domain uniqueness.

5

Create KMS encryption key

Create KMS encryption key for organization data (SYMMETRIC_DEFAULT) and enable key rotation.

6

Encrypt sensitive data

Encrypt sensitive data (organization name, contact email) with KMS.

7

Store initial organization document

Store initial organization document in Firestore.

8

Create organization CA signing key

Create organization CA signing key in KMS (ECC_NIST_P256, SIGN_VERIFY).

9

Create CSR and sign

Create X.509 CSR for organization intermediate CA, sign CSR with Business CA using KMS signature.

10

Build certificate chain

Build certificate chain: [Org CA, Business CA, Root CA].

11

Attestation & transparency log

Create business identity attestation signed by Business CA and submit to transparency log for public verification.

12

Create master identity

Create master identity for organization CA (gtm prefix + SHA256) and sign for proof of possession.

13

Update organization & subscription

Update organization document with CA key ARN and serial number. Create subscription record (30-day trial).

14

Return success

Return success to web portal.

Process Flow Diagram

Cryptographic Security

Full PKI Hierarchy:

1. GetTrusted Root CA (Self-Signed, Offline)
   ├─ Subject: O=GetTrusted, CN=GetTrusted Root CA
   ├─ Key Usage: Certificate Signing, CRL Signing
   ├─ Basic Constraints: CA:TRUE
   ├─ Validity: 20 years

2. GetTrusted Business Intermediate CA (Signed by Root CA, KMS)
   ├─ Subject: C=US, L=GetTrusted, CN=GetTrusted Business Intermediate CA
   ├─ Issuer: GetTrusted Root CA
   ├─ Key Usage: Certificate Signing, CRL Signing
   ├─ Basic Constraints: CA:TRUE, pathlen:1
   ├─ KMS Key ARN: arn:aws:kms:us-east-2:760715349462:key/b76016f1-c832-4bc7-b05d-157fad7a0fbf
   ├─ Validity: 10 years

3. Acme Corporation Intermediate CA (Signed by Business CA, KMS)
   ├─ Subject: CN=Acme Corporation Intermediate CA, O=Acme Corporation, C=US
   ├─ Issuer: GetTrusted Business Intermediate CA
   ├─ Key Usage: Certificate Signing, CRL Signing
   ├─ Basic Constraints: CA:TRUE, pathlen:0
   ├─ KMS Key ARN: {organization_ca_signing_key_arn}
   ├─ Validity: 5 years

4. Employee Device Certificates (Signed by Org CA + Device Key)
   ├─ Subject: O=Acme Corporation, OU=Employee, CN=diana.prince
   ├─ Issuer: Acme Corporation Intermediate CA
   ├─ Key Usage: digitalSignature
   ├─ Dual Signatures: [Device Key, Org CA]
   ├─ Validity: 365 days (1 year)

Business Identity Attestation

Attestation Structure:

{
  "version": 1,
  "subject_fingerprint": "sha256_hash_of_org_ca_public_key",
  "issuer_fingerprint": "sha256_hash_of_business_ca_public_key",
  "claim_type": "business_ca_delegation",
  "claim_data": {
    "claim_hash": "sha256_hash_of_private_claim_data_with_salt",
    "public_metadata": {
      "category": "business_ca_delegation",
      "assurance_level": 4,
      "region": null,
      "sector": null,
      "geohash": null,
      "proximity": null
    },
    "proof_requirements": {
      "requires_claim_details": false,
      "requires_salt": false,
      "requires_context": false
    }
  },
  "issued_at": "2025-01-10T00:00:00Z",
  "expires_at": "2026-01-10T00:00:00Z",
  "nonce": "random_16_byte_hex",
  "signature": "ecdsa_signature_from_business_ca"
}

Security Guarantees

1. Cognito Authentication

• Industry-standard OAuth 2.0 / OpenID Connect

• Email verification required before account activation

• RS256 JWT tokens with Cognito public key validation

• MFA support available

• Password policies: minimum 8 characters

1. AWS KMS Key Protection

• Organization encryption keys created per-organization

• CA signing keys stored in Hardware Security Modules (HSMs)

• Keys never leave KMS (all operations via API)

• Automatic key rotation for symmetric keys (365 days)

• Fine-grained IAM policies control key access

• CloudTrail logging for all key usage

1. Data Encryption at Rest

• Organization name and contact email encrypted with KMS

• Encrypted data stored as base64 in Firestore

• Decryption requires both KMS key ARN and ciphertext

• No plaintext sensitive data in database

1. Certificate Authority Security

• FIPS-compliant ECC P-256 cryptography

• Business CA private key in KMS (never exported)

• Organization CA private key in KMS (never exported)

• Certificate chain validation from root to leaf

• 5-year validity for organization CAs

• Rotation eligible 6 months before expiry

1. Transparency and Auditability

• Business identity attestations logged publicly

• Merkle tree inclusion proofs

• Public verification of organization CA delegation

• Immutable audit trail in transparency log

• Master identity with cryptographic proof of possession

1. Zero-Knowledge Architecture

• GetTrusted backend never sees private keys

• Encrypted blobs stored in Firestore

• KMS handles all encryption/decryption operations

• Minimal metadata for indexing/querying

1. Certificate Lifecycle Management

• Automatic rotation support (6 months before expiry)

• CRL distribution points configured

• OCSP endpoints for real-time revocation checking

• Certificate serial numbers tracked in Firestore

Strategic Implications

Enterprise Onboarding Simplification

Before GetTrusted:

- Manual CA setup with HSM procurement
- Complex PKI infrastructure deployment
- IT staff training on certificate management
- Weeks/months of setup time
- High upfront costs ($50k-$500k+)

With GetTrusted:

- 5-minute signup via web portal
- Automatic CA generation with AWS KMS
- No infrastructure to deploy or maintain
- Instant employee onboarding capability
- Pay-as-you-grow pricing (trial included)

Cryptographic Trust Hierarchy

Trust Establishment:

• Organization CA signed by GetTrusted Business CA

• Business CA signed by GetTrusted Root CA (offline, air-gapped)

• Root CA trusted by GetTrusted mobile apps

• Employee device certificates signed by Organization CA

• End-to-end cryptographic verification

Assurance Levels:

1. Root CA (Maximum Trust): Offline signing, physical security
2. Business CA (High Trust): AWS KMS HSM, audited operations
3. Organization CA (Organizational Trust): Per-org KMS keys, business attestation
4. Employee Certificates (Delegated Trust): Dual-signed by org CA + device key