# GetSafeDocs Enterprise Admin Guide

This guide is designed for **Enterprise Administrators** managing their organization's GetSafeDocs workspace, team seats, corporate domain auto-enrollment, user invitations, activity monitoring, and security policies on **https://getsafedocs.cloud.run**.

---

## Table of Contents

1. [Getting Started with Enterprise](#getting-started-with-enterprise)
2. [Initial Enterprise Setup](#enterprise-setup)
3. [Company Settings & Seat Allocation](#company-settings)
4. [Auto-Enrollment Email Domains](#auto-enrollment-email-domains)
5. [User Roles & Managing Enterprise Users](#user-management)
6. [Inviting Team Members & Managing Invitations](#inviting-and-managing-users)
7. [Activity Monitoring & Audit Analytics](#monitoring-and-analytics)
8. [Enterprise Security, Custom File Policies & Deployment Options](#security-management)
9. [Billing & Subscription Ownership](#billing-and-subscriptions)
10. [Troubleshooting](#troubleshooting)
11. [Best Practices for Enterprise Admins](#best-practices)
12. [Contact & Enterprise Support](#contact-information)

---

## Getting Started with Enterprise

### Enterprise Plan Highlights

Enterprise licensing is sold in **blocks of 5 seats** (`https://getsafedocs.cloud.run/pricing`) and provides every enrolled seat with full Enterprise capabilities:

- **200 MB Max File Size** per uploaded file (up to **20 files** per message)
- **300 Monthly Messages** per seat and up to **100 Recipients** per message
- **5,000 MB (5 GB) Monthly Viewed/Received Data** allowance per seat
- **Centralized Enterprise Management Console** (`https://getsafedocs.cloud.run/enterprise_admin`)
- **Auto-Enrollment Email Domains** for zero-touch corporate onboarding
- **Unlimited Document Request Portals & Mailing Lists** for all team members
- **Custom Message Expiry** (1 Day to 1 Year, plus ability to extend expiry before expiration)
- **82 Supported File Formats** (including video, audio, and professional design files) plus formal **Enterprise File Type Exceptions** upon security review
- **100% Canadian Data Residency** in Toronto, Ontario (`northamerica-northeast2`)
- **Optional Dedicated / Bring-Your-Own-Cloud (BYOC), On-Premise Deployments & Customer-Managed Encryption Keys (CMEK)**

### Accessing the Enterprise Management Console

1. Sign in at **[https://getsafedocs.cloud.run/login](https://getsafedocs.cloud.run/login)** using your Passkey, Google OAuth, or Email/Password + 2FA.
2. Open **[Profile](https://getsafedocs.cloud.run/profile)** and click the **Enterprise Management** button (or navigate directly to `https://getsafedocs.cloud.run/enterprise_admin`).

---

## Enterprise Setup

If you have just purchased an Enterprise subscription and are accessing `/enterprise_admin` for the first time, you will see the **Create Your Enterprise** setup card:

1. **Enter Your Enterprise Name:** Provide your organization's official display name (e.g., `Acme Financial Corp.`). This name appears on team invitation emails and your Enterprise Management console.
2. **Verify Your Seat Allocation:** Review the **Number of Seats** shown on the setup card (automatically calculated from the number of 5-seat blocks in your Stripe subscription).
3. **Click "Create Enterprise":** GetSafeDocs provisions your company record, links your account as the initial **Company Admin (Subscription Owner)**, and unlocks domain auto-enrollment and user invitations.

---

## Company Settings

From the **Enterprise Overview** and **Company Settings** cards on `/enterprise_admin`, administrators can:

- **Monitor Seat & Message Volume (`Enterprise Overview`):**
  - **Total Users:** Displays active Enterprise seats used out of your total licensed seats (e.g., `Total Users: 7 of 10`).
  - **Total Messages Sent:** Displays the cumulative number of secure messages sent across all members of your organization.
- **Update Organization Name (`Company Settings`):**
  - Edit the **Company Name** field and click **Update Company Name** at any time. Changes take effect immediately across your workspace and future invitation emails.

---

## Auto-Enrollment Email Domains

The **Auto-Enrollment Email Domains** panel on `/enterprise_admin` allows you to onboard employees automatically without sending individual invitation emails.

### How Automatic Domain Enrollment Works

When you register a corporate email domain (for example, `yourcompany.com`):
1. Any new user who registers at `https://getsafedocs.cloud.run/register` using an email address at that domain (`name@yourcompany.com`) and verifies their email address is **automatically enrolled** into your company's Enterprise workspace.
2. Auto-enrollment continues automatically as long as your organization has available seats (`Total Users < Total Seats`).
3. If all licensed seats are currently full, new registrations on that domain default to the Free tier until an administrator adds more seats or frees an existing seat.

### Adding or Removing an Auto-Enrollment Domain

1. In **Enterprise Management** (`/enterprise_admin`), locate the **Auto-Enrollment Email Domains** card.
2. Enter your corporate domain **without** the `@` symbol (e.g., `example.com`) and click **Add Domain**.
3. Active domains are listed in the table below with the date added. Click **Remove** next to any domain to stop future automatic enrollments for that domain (existing enrolled users are not removed).

### Domain Eligibility & Webmail Restrictions

- **Corporate Domains Only:** Only domains owned by your organization are eligible. Each domain can only be registered to one Enterprise organization at a time.
- **Public Webmail Providers Blocked:** Consumer webmail domains (`gmail.com`, `yahoo.com`, `outlook.com`, `hotmail.com`, `live.com`, `msn.com`, `aol.com`, `icloud.com`, `me.com`, `mac.com`, `protonmail.com`, `zoho.com`, `gmx.com`, `tutanota.com`, `fastmail.com`, `hey.com`, `mail.com`, `yandex.com`, `mail.ru`, etc.) are permanently blocked from domain auto-enrollment.
- **Inviting External / Webmail Collaborators:** Team members or contractors who use a webmail address can still be added to your Enterprise seats manually using the **Invite New User** card.

---

## User Management

### Understanding Organization Roles

| Role | Badge / Indicator | Capabilities |
|------|-------------------|--------------|
| **Admin (Subscription Owner)** | `Admin (Subscription Owner)` + `💳` | Primary billing owner who purchased the Stripe subscription. Has full Company Admin privileges and **cannot be downgraded or removed** without first transferring subscription ownership. |
| **Company Admin** | `Admin` | Full access to `/enterprise_admin`: can update company name, manage Auto-Enrollment Email Domains, invite users, resend/cancel invitations, downgrade/upgrade user access levels, remove seats, and view organization-wide message activity. |
| **Enterprise User** | `User` (`Enterprise` badge) | Full access to all Enterprise features (`200 MB` uploads, `20` files/message, `300` messages/month, `100` recipients/message, Document Requests, Mailing Lists, 2FA & Passkeys). Does not have access to `/enterprise_admin`. |

### Reviewing & Managing Team Members (`Enterprise Users` Table)

The **Enterprise Users** table displays every account associated with your organization:
- **Email:** User's account email address (with the `💳` badge indicating the Subscription Owner).
- **Role:** `Admin (Subscription Owner)`, `Admin`, or `User`.
- **Access Level:** `Enterprise` (green badge) or `Free` (gray badge).
- **Joined:** Date the account was created/joined (`YYYY-MM-DD UTC`).
- **Last Login:** Most recent authentication timestamp (`YYYY-MM-DD HH:MM UTC`).
- **Actions:**
  - **Downgrade to Free:** Downgrades an active Enterprise member to the `Free` tier, removes their Enterprise privileges, and immediately frees their seat for another user.
  - **Upgrade to Enterprise:** Upgrades a `Free` user in your organization back to the `Enterprise` tier (available when you have open seats).
  - **Remove:** Removes the user from your Enterprise organization completely, resets their account to the `Free` tier, and marks any accepted company invitations for their email as expired.

---

## Inviting and Managing Users

### Sending Individual Team Invitations

1. In **Enterprise Management** (`/enterprise_admin`), locate the **Invite New User** card.
   - *Note:* If your organization has reached its seat limit (`Total Users == Total Seats`), an alert is shown in place of the form until you free a seat or upgrade your seat count.
2. Enter the user's email address and click **Send Invitation**.
3. GetSafeDocs generates a single-use cryptographic invitation token valid for **7 days** and emails an HTML invitation with a direct onboarding link:
   `https://getsafedocs.cloud.run/accept_invite?token=...`

### How Recipients Accept (or Decline) an Invitation

When the recipient clicks the invitation link (`/accept_invite?token=...`):
- **If the recipient already has a GetSafeDocs account:**
  - They are prompted to sign in at `/login` (if not already signed in) and are presented with the **Company Invitation** confirmation card where they can click **Accept Invitation** or **Decline Invitation**.
  - **Automatic Premium-to-Enterprise Transition:** If the user previously had an individual **Premium** subscription, accepting your Enterprise invitation automatically upgrades their account to **Enterprise** and configures their individual Stripe Premium subscription to cancel at the end of the current billing period (`cancel_at_period_end = true`) so they are never double-billed.
- **If the recipient does not have a GetSafeDocs account yet:**
  - Clicking the invitation link automatically redirects them to `/register` with their invited email address pre-filled in their session.
  - Once they complete registration and verify their email address, they can complete the invitation acceptance and immediately receive Enterprise access.

### Managing Pending & Accepted Invitations

The **Invitations** card on `/enterprise_admin` organizes invitations into two tabs:

1. **Pending Tab:**
   - Lists all active invitations awaiting acceptance, showing `Email`, `Sent At (UTC)`, `Expires (UTC)`, and `Actions`.
   - **Resend:** Extends the invitation's expiration date to **7 days from today** and sends a fresh invitation email.
   - **Account Recovery (`⚠️ Recovery Needed`):** If a user accepted an invitation link before finishing account verification, admins can click **Resend** to automatically reset the invitation to pending and allow the user to complete onboarding.
   - **Cancel:** Immediately deletes the pending invitation and invalidates the token.
2. **Accepted Tab:**
   - Displays all active Enterprise members who joined via invitation, recording both the original `Sent At (UTC)` and `Accepted At (UTC)` timestamps for compliance auditing.

---

## Monitoring and Analytics

Enterprise administrators have built-in visibility into organization-wide usage on `/enterprise_admin`:

- **Enterprise Overview Metrics:**
  - Real-time active seat count vs. licensed seat capacity (`Total Users: X of Y`).
  - Total messages sent across all Enterprise seats (`Total Messages Sent`).
- **Recent Enterprise Messages Table:**
  - Displays the **100 most recent messages** sent by members of your organization, including:
    - **Date:** Exact timestamp in UTC (`YYYY-MM-DD HH:MM UTC`)
    - **Sender:** The Enterprise team member's email address
    - **Subject:** Message subject line
- **Detailed Per-Message Tracking:**
  - Every Enterprise member can also inspect granular recipient view/download logs (`message_view`, `file_view`, `office_view`, `file_download`, `file_download_zip`) with IP addresses, timestamps, and User-Agent strings on `/message_activity_details`.

---

## Security Management

### Identity & Access Controls
- **Passkeys (FIDO2 / WebAuthn) & Two-Factor Authentication (2FA):** All Enterprise users have full access to hardware/biometric Passkeys and Authenticator App (TOTP) or Email 2FA in **Profile** (`/profile` and `/mfa_setup`).
- **Developer API Keys (`gsd_...`):** Team members and administrators can generate named, scoped personal API keys with optional expiration (`30`, `90`, `365` days, or never) in **Profile** (`/profile`). Only the SHA-256 hash is stored at rest, last-used timestamps and IP addresses are tracked, and keys can be revoked immediately.
- **Automated Brute-Force Lockout:** Accounts automatically lock for **60 minutes** after **5 consecutive failed login attempts**, protecting corporate accounts from credential stuffing.
- **Session Security:** Authenticated sessions use `256-bit` (`64 hex char`) cryptographic tokens with a 24-hour sliding expiration (refreshed every 30 minutes of activity) and automatic session invalidation upon password change.

### Data Protection, Malware Defense & Compliance
- **100% Canadian Data Residency:** All data at rest—both uploaded files in **Google Cloud Storage** and all 30 database collections in **Google Cloud Firestore**—is stored in Google Cloud's **Toronto, Ontario (`northamerica-northeast2`)** region under **PIPEDA** jurisdiction (and aligned with **GDPR** under Canada's EU adequacy decision).
- **Encryption at Rest & In Transit:** `AES-256-GCM` server-side encryption at rest with Google Cloud KMS Customer-Managed Encryption Keys (CMEK), Firestore Delete Protection & Point-in-Time Recovery (PITR), and `TLS 1.3` encryption in transit with direct browser-to-GCS V4 Signed URL transfers.
- **Real-Time QuickSand Malware Quarantine:** Every file uploaded by your team or submitted by external clients through Document Request portals passes through 7 validation layers and real-time static/structural malware analysis before delivery.

### Enterprise Customizations & File Type Exceptions
- **Blocked File Type Exceptions:** By default, 34 executable and script extensions (`.exe`, `.bat`, `.dll`, `.js`, `.sh`, `.msi`, etc.) are blocked across all tiers. If your Enterprise organization has a legitimate business requirement to exchange specific blocked formats, contact Enterprise Support to request a formal security review and exception.
- **Large Organization Deployment Options:**
  - **Dedicated or Bring-Your-Own-Cloud (BYOC):** Isolated cloud storage and compute environments tailored to your organization's governance policies.
  - **Customer-Managed Encryption Keys (CMEK):** Bind your own Google Cloud KMS encryption keys in Dedicated/BYOC deployments for complete cryptographic key lifecycle control.
  - **On-Premise Deployments:** Deploy within your own infrastructure for specialized regulatory environments.

---

## Billing and Subscriptions

- **5-Seat Licensing Blocks:** Enterprise subscriptions are billed via Stripe in blocks of **5 seats** (`1 block = 5 seats`, `2 blocks = 10 seats`, etc.).
- **Self-Service Billing Portal:** The **Subscription Owner** (or Company Admin) can manage payment methods, download invoices, or adjust subscription settings by opening **[Profile](https://getsafedocs.cloud.run/profile)** → **User Account Information** and clicking **Manage Subscription** (or visiting **[Pricing](https://getsafedocs.cloud.run/pricing)**).
- **Transferring Subscription Ownership:** Because the `Subscription Owner` (`💳`) is tied to the active Stripe billing record, they cannot be removed or downgraded from the Enterprise Users table until ownership is transferred. Contact **[Enterprise Support](https://getsafedocs.cloud.run/contact)** to transfer the Subscription Owner role to another Company Admin without service interruption.

---

## Troubleshooting

- **"You have reached your user limit":**
  - Your active Enterprise seats (`Total Users`) have reached your licensed seat count. Either remove/downgrade an inactive user in the **Enterprise Users** table, or upgrade your subscription seat blocks via **Profile** → **Manage Subscription** or **[Contact Support](https://getsafedocs.cloud.run/contact)**.
- **"Webmail domains are not allowed for enterprise auto-enrollment":**
  - Public email providers (`gmail.com`, `yahoo.com`, `outlook.com`, etc.) cannot be added to **Auto-Enrollment Email Domains**. Invite those users individually using the **Invite New User** form instead.
- **"Invitation email does not match account email":**
  - For security, an invitation sent to `user@company.com` can only be accepted when signed in as `user@company.com`. Ask the user to sign in with (or register) the exact email address that was invited, or send a new invitation to their preferred email address.
- **Invited user accepted the link, but still appears as Free tier (`⚠️ Recovery Needed`):**
  - If a user clicked the invitation link before verifying their email address, click **Resend** next to their entry in the **Pending** invitations tab and have them click the invitation link again while signed in.

---

## Best Practices

1. **Configure Auto-Enrollment for Corporate Domains:** Add your organization's verified domain(s) under **Auto-Enrollment Email Domains** for frictionless employee onboarding, and use **Invite New User** only for external contractors or webmail users.
2. **Mandate Passkeys & Authenticator App 2FA:** Instruct all team members to register a FIDO2 Passkey and enable TOTP Authenticator App 2FA in **Profile** (`/profile`) immediately after joining.
3. **Audit Seats Monthly:** Review the **Enterprise Users** table (checking `Last Login` timestamps) and the **Pending Invitations** tab monthly. Use **Downgrade to Free** or **Remove** immediately when personnel depart.
4. **Standardize External File Intake on Document Requests:** Have your team use **Document Requests** (`/document_requests`) instead of email attachments when collecting files from clients or vendors so all inbound files are automatically validated and scanned for malware.

---

## Contact Information

- **Enterprise & Technical Support:** [https://getsafedocs.cloud.run/contact](https://getsafedocs.cloud.run/contact) (Priority response within 24 hours for Enterprise customers)
- **Quick Start Guide:** [View Quick Start Guide](markdown_viewer.html?file=quick_start_guide)
- **Complete User Guide:** [View User Guide](markdown_viewer.html?file=user_guide)
- **Developer REST API Documentation:** [View API Documentation](markdown_viewer.html?file=api_docs)
- **Security Documentation Portal:** [View Security Documentation](security-documentation.html)