# GetSafeDocs Security Commitment **Continuous Security Engineering, Governance & Roadmap** **Document Classification:** Public **Version:** 2.0 **Date:** November 2026 **Prepared By:** GetSafeDocs Inc. --- ## Our Security Philosophy At GetSafeDocs, security is engineered into every architectural layer—from stateless public edge pages to keyless serverless compute, physical storage bucket isolation, Cloud KMS encryption, and isolated browser-sandbox document viewing. With an **OWASP Top 10 compliance score of 99/100 (A+)**, we continuously evolve our controls to stay ahead of emerging threats. --- ## Delivered Security Milestones (2025 – 2026) Over the past year, GetSafeDocs completed every major architectural and application security initiative on our roadmap: - ✅ **Serverless Split-Tier Migration (`getsafedocs.cloud.run`):** Offloaded all authentication, document viewing, messaging, billing, and API workloads to Google Cloud Run in Toronto (`northamerica-northeast2`), leaving the public marketing site (`getsafedocs.com`) completely stateless with zero database or cloud credentials. - ✅ **Native Google Cloud Firestore Migration (`northamerica-northeast2` Toronto):** Migrated all 30 application, account, session, and security audit tables to Google Cloud Firestore in Toronto (`northamerica-northeast2`) with keyless IAM authentication, Delete Protection, 7-day Point-in-Time Recovery (PITR), and programmatic Canadian region residency enforcement—ensuring **100% of data at rest** (both files and database records) resides in Canada. - ✅ **Keyless Cloud IAM Architecture:** Eliminated static service account JSON keys on disk and external database passwords over the public internet in favor of native Cloud Run IAM identity for Cloud Firestore, Cloud Storage, Cloud KMS, and IAM Credentials `signBlob` V4 URL signing. - ✅ **FIDO2 / WebAuthn Passkeys:** Deployed phishing-resistant biometric and hardware security key authentication (`/api/passkey/*`). - ✅ **Enterprise Auto-Enrollment Email Domains:** Enabled verified domain auto-enrollment (`company_email_domains`) with automatic seat provisioning and personal subscription migration. - ✅ **Compromised Password Screening (HIBP) & Complexity Enforcement:** Integrated k-anonymity Have I Been Pwned range checks and strict password complexity validation alongside Argon2id hashing (`memory_cost=65536`, `time_cost=4`, `parallelism=3`). - ✅ **reCAPTCHA Enterprise Integration:** Deployed Google reCAPTCHA Enterprise behavioral risk scoring across login, registration, and contact flows. - ✅ **Seven-Layer Upload Pipeline & QuickSand Cloud Run Scanner (`stopmalware.cloud.run`):** Physical four-bucket isolation (`getsafedocs_canada`, `getsafedocs_canada_temp`, `getsafedocs_canada_quarantine`, `getsafedocs_canada_quicksand`) encrypted with Cloud KMS CMEK in Toronto (`northamerica-northeast2`), with automated exponential-backoff retry queues (`/cron/retry_scan_queue`). - ✅ **Centralized Cloud Logging & Admin Security Consoles:** Combined structured Cloud Firestore security audit trails with Google Cloud Logging and nine specialized admin monitoring dashboards (`/admin_panel`, `/admin_audit_logs`, `/security_recent`, `/security_audit`, `/malware_detections`, `/admin_scan_queue`, `/admin_csp_violations`, `/admin_deleted_accounts`, `/admin_wif_health`). --- ## Ongoing Security Operations ### 1. Continuous Vulnerability & Dependency Management - **Critical Security Patches:** Applied within **48–72 hours** of disclosure. - **Managed Serverless Runtime:** Google Cloud Run automatically patches underlying OS kernels and TLS libraries. - **Subresource Integrity (SRI):** All third-party frontend assets are pinned with SHA-384 cryptographic integrity hashes. ### 2. Quarterly Security Reviews & Threat Modeling - Quarterly reassessment against **OWASP Top 10**, **OWASP ASVS**, and **CIS Controls**. - Continuous monitoring of Content Security Policy (CSP) reports (`/admin_csp_violations`), authentication anomalies (`/security_audit`), and malware telemetry (`/malware_detections`). ### 3. Compliance Governance (ISMS) - Maintained ISO/IEC 27001 and SOC 2 policy suite (`docs/policies/`) covering Access Control, Key Management, Cloud Security, Data Retention, Incident Response, Business Continuity, and Supplier Security. --- ## Upcoming Security Roadmap (2027) ### Short-Term Initiatives 1. **Enterprise Enforced Authentication Policies:** Allow Enterprise Company Admins to mandate MFA or FIDO2 Passkeys for all seats within their organization. 2. **Optional Client-Side Zero-Knowledge E2EE:** Allow senders to optionally encrypt attachments in the browser using `AES-256-GCM` Web Crypto prior to upload, with decryption keys carried exclusively in URL fragments (`#key=...`). 3. **Scoped API Personal Access Tokens (PATs):** Fine-grained, revocable API keys with per-token scopes (`messages:send`, `requests:read`, `files:upload`) for automated CI/CD and ERP integrations. 4. **Real-Time Webhook Event Streaming:** Customer-configurable outbound webhooks (signed with HMAC-SHA256) for `document.viewed`, `document.downloaded`, `request.submitted`, and `malware.quarantined` events. ### Mid-Term Initiatives 1. **Enterprise SSO Federation (SAML 2.0 / OIDC):** Direct integration with Okta, Microsoft Entra ID (Azure AD), and Google Workspace for enterprise tenants. 2. **Formal Third-Party Certifications:** Execution of formal **SOC 2 Type II** and **ISO/IEC 27001:2022** certification audits aligned with enterprise and government procurement milestones. 3. **Automated SIEM Log Export:** Native log streaming sinks to customer Splunk, Microsoft Sentinel, or Chronicle SIEM environments for Dedicated Enterprise deployments. --- ## Responsible Disclosure & Contact We welcome collaboration with security researchers, enterprise security teams, and government assessors. To report a potential security issue or request compliance documentation: - **Contact Portal:** https://getsafedocs.cloud.run/contact - **Security Documentation:** https://getsafedocs.com/security-documentation.html - **Response SLA:** Within 24 hours for vulnerability disclosures. --- **Document Classification:** Public **Copyright:** © 2026 GetSafeDocs Inc. All rights reserved.