Identity, Sign-in and Credentials Notice

• 1.1 One account signs in to every part of the Site that offers accounts and to the member services of the publisher, such as its newsletters, events and learning pages. Each service receives only what it needs for what you use there.
• 1.2 Your account is identified internally by a random identifier, never by your e-mail address, so a service that receives the identifier does not learn your address unless you share it with that service.

• 2.1 Passkeys are offered first. A password, where used, is stored only as a salted hash, and a second factor can be added. Sign-in attempts are rate-limited and unusual sign-ins can be challenged.
• 2.2 The levels of assurance used follow the digital identity guidelines of the United States National Institute of Standards and Technology (SP 800-63-4) as a reference: no identity proofing for ordinary accounts, and stronger checks only where a service needs them.

• 3.1 The random identifier, a display name and, where you agree, your e-mail address and preferred language. A site never receives your password, your passkey or your activity on other sites.
• 3.2 You can see which sites you have used and end their sessions from the account settings.

• 4.1 Completion records and recognition credentials are issued as signed records that you hold and can share. Where offered, they follow the W3C Verifiable Credentials Data Model 2.0, so that anyone can check who issued them and that they were not changed.
• 4.2 A credential records what was done; it states no grade of competence, licence or qualification unless it says so expressly. It can be revoked when it was issued in error or obtained by misconduct, and the check shows the revocation.
• 4.3 Digital identity wallets, including the European Digital Identity Wallets, may be accepted for sign-in or for sharing attributes where a service supports them; you choose what to share, and nothing more is requested.

• 5.1 Recovery uses the methods you set up. Support staff never ask for your password or passkey.
• 5.2 You can close your account at any time. Personal information is then handled as the Privacy Policy describes; credentials already issued stay checkable unless you ask for their verification to be withdrawn.

• 6.1 Accounts and sign-in are not offered in the territories listed in the Sanctions, Export Controls and Restricted Parties Notice.

Prepared for review by legal counsel before adoption.