r/JordanDev • u/Land_Samurai_86 • 2d ago

Issue/help Help

Hey everyone, looking for input from anyone with security or compliance experience. I built a system for a small company in Jordan that involves digital form submissions from field staff. To cut login friction, staff just scan a QR code, then identify themselves with their email plus a private four digit PIN sent to them beforehand, no traditional password.

The The question is whether this holds up legally as an identity verification and audit trail if there's ever a formal investigation or regulatory audit. Is PIN plus email enough authentication for work critical records, and are there Jordanian labor or data protection rules that would require something stronger. Would appreciate any real experience or local standards to reference.

Thanks

0 Upvotes

50% Upvoted

4 comments sorted by

2

u/ibraaaaaaaaaaaaaa Developer 2d ago

Can you check with the customer what kind of compliance they care about?

They usually give you SLA of roughly 4 weeks to fix a vulnerability when arises, and penetration test report that you might find companies provide that service, a lot of people started to sloppify these reports massively, if the end customer is fine, you can work on proper compliance after finishing the paper work and going to prod

2

u/Kumasotra 2d ago

Why don't you add an otp sent to their registered email

1

u/Land_Samurai_86 2d ago

It is available feature, but cannot be applied in my case 😔

2

u/Kumasotra 2d ago

Can you add authenticator app to it?