Registration & Authentication Security

Authentication Factors

Depending on the user's registration server, up to four authentication factors are available. With OpenID, there can be more of them. Only one is mandatory. The other factors can be enabled as additional ones.

Factor	RTS Lite	CTS ETS
SMS code to phone number	Mandatory factor.	Your organization's server administrator can turn it off with Allow registration without phone number in the Registration Settings section. Users link their own phone number if your organization's server administrator has enabled Allow to add phone number in the same section. In the internal environment (corporate network), your organization's server administrator can skip this step with Allow skipping two-factor authentication within the contour in the “Registration Settings” section.
Email code / NTLM / OpenID	Not available.	Mandatory factor. Built-in brute force protection applies to Email code and NTLM. When using OpenID, any number of additional factors can be added — these are configured on the specific OpenID provider's side.
Personal password (encryption key protection)	Optional factor. The user sets it in the settings — more details.
PIN code	Optional factor. The user sets it in the settings.	Your organization's server administrator can make the PIN code mandatory: in the “Role Model Rules” section, they create a rule of the Mandatory PIN code type.

Access and Device Restrictions by the Administrator

• Your organization's server administrator can prohibit connections from specific client platforms and limit the lifespan of user sessions. Both settings are in the “Activations” section: Prohibited Platforms and Maximum Activations Lifetime. By default, an inactive web app session ends after one week. On the public RTS server, the eXpress team manages these settings.
• Access to
  CTS
  /
  eCTS
  can additionally be restricted by location: the proxy filters connections to the corporate server. This is another security factor.
• The role model supports "device corporate status": rules can be triggered based on the presence of a corporate certificate on the device — see role model rules.

Storage of Credentials and Keys on Client Devices

Credentials are stored in a protected area of the device's memory that cannot be accessed externally. The app does not start on rooted or jailbroken devices.

Platform	How credentials are stored
iOS	The keys are stored in the protected KeyChain area.
Android	The keys are stored in the protected KeyStore area.
Aurora	The keys are stored in a protected software vault.
Desktop	Credentials are stored in system keychains (eXpress) or in their own encrypted storage. The storage depends on the ETS app settings — see desktop version credential storage for specific OSes.
Web	Tokens stored in cookies are used.

Certification and Cryptography

• Platform security is certified by FSTEC — more details.
• Cryptographic strength has passed an independent audit.
• Secure on-premise servers are available for enterprise customers (
  CTS
  /
  eCTS
  ), as well as server operation in isolated mode (
  ETS
  only).
• Transport encryption uses TLS 1.3 and DTLS.
• Enhanced qualified electronic signature (QES) and Russian GOST encryption are supported upon request.

Fraud and Phishing

Never share one-time SMS codes with anyone — without the code, it is impossible to log into an account using your phone number. Official eXpress SMS messages contain a reminder: do not share the code with third parties.

A Stranger Is Asking for My eXpress SMS Code. What Should I Do?

Never share SMS codes with anyone! Maybe someone is trying to create or use a public account with your phone number. This happens if codes arrive and then someone asks you to share them, but you never registered in eXpress yourself. eXpress is a messenger: after gaining access to the account, an attacker can send messages on your behalf.

How Do I Restrict Access to My Account If I Already Shared the SMS Code With Attackers?

• Download eXpress, log in with your phone number, and delete the account: Settings > Profile > three dots > (Actions with profile) > Delete profile. Or ask eXpress support to do this. The account is deleted permanently.
• If you do not want to delete the account — open Settings > Active sessions and terminate any sessions you do not recognize. Set a personal password for extra protection. Without the one-time SMS code and the personal password, an attacker will not be able to log in again.