# GetSafeDocs Security Summary **Enterprise & Government Executive Security Overview** **Document Classification:** Public **Version:** 2.0 **Date:** November 2026 **Prepared By:** GetSafeDocs Inc. --- ## Executive Summary GetSafeDocs provides a secure document sharing and document intake platform engineered for government agencies, legal and financial firms, healthcare organizations, and enterprises. Hosted on a serverless **Google Cloud Run** architecture in **Toronto, Ontario, Canada (`northamerica-northeast2`)**, GetSafeDocs combines Canadian data residency, defense-in-depth upload validation, real-time malware analysis, isolated browser-sandbox document previews, and phishing-resistant authentication. ### Key Security Metrics | Metric | Score / Standard | Standing | |--------|------------------|----------| | **OWASP Top 10 (2021)** | **99 / 100** | **A+ Grade (Pass 10/10)** | | **Database Injection Protection** | **100 / 100** | 100% Parameterized Queries (Cloud Firestore) | | **Authentication & Identity** | **100 / 100** | Argon2id + Passkeys (WebAuthn) + MFA | | **Encryption at Rest** | **AES-256-GCM** | Cloud KMS CMEK (Cloud Storage & Cloud Firestore) | | **Encryption in Transit** | **TLS 1.3** | HSTS Preload + Direct V4 Signed URLs | | **Data Residency (At Rest)** | **100% Canada** | Toronto, ON (`northamerica-northeast2` — Files & Database) | ### Compliance Alignment - ✅ **PIPEDA (Canada):** Compliant — 100% Canadian data residency for all files and database records - ✅ **SOC 2 Type II:** Architecture and Trust Services Criteria controls implemented - ✅ **ISO/IEC 27001:2022:** Annex A technical controls and ISMS policies active - ✅ **PCI-DSS v4.0 Level 1:** Compliant payment processing via Stripe Checkout & verified webhooks - ✅ **GDPR (EU):** Aligned under Canada's EU adequacy decision + full data subject rights --- ## 1. Split-Tier Serverless Architecture GetSafeDocs separates public informational browsing from sensitive document operations: - **Public Marketing & Documentation (`https://getsafedocs.com`):** Stateless web tier with zero database credentials, zero session cookies, and zero cloud keys. - **Serverless Application, API & Database (`https://getsafedocs.cloud.run`):** Runs on Google Cloud Run in Toronto (`northamerica-northeast2`) connected to **Google Cloud Firestore (`northamerica-northeast2`)** and **Google Cloud Storage (`northamerica-northeast2`)** using keyless IAM service account authentication—eliminating static cloud credentials on disk and external database passwords over the public internet. --- ## 2. Authentication & Access Control - **Password Security:** **Argon2id** (`64 MB` memory [`65536`], `4` iterations, `3` threads, per-account 16-byte random salt) with password complexity enforcement, **Have I Been Pwned (HIBP)** k-anonymity breach screening, and legacy bcrypt compatibility. - **Phishing-Resistant Passkeys (FIDO2 / WebAuthn):** Hardware security key and biometric login (`Touch ID`, `Face ID`, `Windows Hello`, `YubiKey`). - **Multi-Factor Authentication (MFA):** RFC 6238 TOTP Authenticator Apps (`/mfa_setup`), Email OTP codes (`mfa_codes`), and 10 single-use Backup Codes (`mfa_backup_codes`). - **Bot & Brute-Force Defense:** **reCAPTCHA Enterprise** behavioral risk scoring, database-backed rate limiting, and automatic **60-minute account lockout** after 5 consecutive failed login attempts. - **Session & API Key Hardening:** `256-bit` (`64 hex char`) CSPRNG database-backed session tokens (`user_sessions`) with `HttpOnly`, `Secure`, `SameSite=Lax` cookies, IP/User-Agent tracking, and 24-hour sliding expiration refreshed every 30 minutes of activity, plus SHA-256 hashed personal Developer API Keys (`gsd_...` via `X-API-Key` / `Authorization: Bearer`) with configurable expiration and instant revocation. --- ## 3. Data Protection & Cloud KMS Encryption - **100% Canadian Data at Rest:** All uploaded files in **Google Cloud Storage (`northamerica-northeast2`)** and all 30 application, account, session, and security audit collections in **Google Cloud Firestore (`northamerica-northeast2`)** reside exclusively in Toronto, Ontario, Canada. - **Encryption at Rest:** All files in Google Cloud Storage (`northamerica-northeast2`) are encrypted with **AES-256-GCM** using Google Cloud KMS Customer-Managed Encryption Keys (`projects/poised-eye-457101-b8/locations/northamerica-northeast2/keyRings/GetSafeDocs/cryptoKeys/GetSafeDocs_Toronto1`), and all database collections in Google Cloud Firestore (`northamerica-northeast2`) are encrypted at rest with **AES-256**, Delete Protection, and 7-day Point-in-Time Recovery (PITR). - **Isolated Browser-Sandbox Document Viewing:** Senders can enforce **Preview-Only (`preview_only = 1`)** mode so recipients view PDFs, Office files, images, and Markdown inside isolated browser viewers (`/pdf_viewer`, `/msview`, `/markdown_viewer`) without raw file download access. - **Direct V4 Signed Transfers:** Uploads and downloads occur directly between the browser and Google Cloud Storage over **TLS 1.3** using short-lived (`15-minute`) HMAC-SHA256 V4 Signed URLs. --- ## 4. Seven-Layer Upload Validation & Malware Quarantine Every file uploaded to GetSafeDocs passes through seven security layers: 1. **Client Pre-Validation** (file size, count, and extension checks) 2. **Server Extension Blocklist** (blocks 30+ executable/script formats: `exe`, `bat`, `cmd`, `msi`, `dll`, `js`, `vbs`, `sh`, `ps1`, `apk`, etc.) 3. **Tier Quota Enforcement** (`5 MB` Free / `128 MB` Premium / `200 MB` Enterprise max file size; `10` / `300` / `300 per seat` monthly messages) 4. **Signed `Content-Type` Binding** (enforced by the GCS V4 `PUT` signature) 5. **Cryptographic Upload Token Verification** 6. **Post-Upload Magic-Byte MIME Verification** 7. **QuickSand Cloud Run Malware Analysis (`stopmalware.cloud.run`)** (static & structural analysis of macros, embedded scripts, PDFs, and archives with MD5/SHA1/SHA256/SHA512 hashing) **Four-Bucket Physical Isolation:** - `getsafedocs_canada`: Verified clean active message files (`scan_rating < 2`) - `getsafedocs_canada_temp`: Ephemeral upload staging (`uploads/`, `doc_requests/`) and temporary multi-file ZIP archives (`zips/`) - `getsafedocs_canada_quarantine`: Isolated quarantine bucket for malicious (`scan_rating >= 2`) uploads - `getsafedocs_canada_quicksand`: QuickSand analysis staging (`new/`) and CMEK-encrypted JSON threat analysis reports (`report/.json`) *(Plus `getsafedocs_static` for non-sensitive public static assets)* --- ## 5. Audit Logging, Monitoring & Incident Response - **Dual-Layer Audit Trail:** Security events are recorded in structured **Google Cloud Firestore** audit collections (`audit_logs`, `authentication_logs`, `malware_detections`, `csp_violations`, `message_activity`) in Toronto (`northamerica-northeast2`) and centralized **Google Cloud Logging**. - **Admin Security Consoles:** Dedicated dashboards for User & Lockout Management (`/admin_panel`), Comprehensive Audit Logs (`/admin_audit_logs`), 7-Day Security Telemetry (`/security_recent`), Shared IP Correlation (`/security_audit`), Malware Detections (`/malware_detections`), Scan Retry Queue (`/admin_scan_queue`), CSP Violations (`/admin_csp_violations`), Deleted Accounts (`/admin_deleted_accounts`), and Cloud IAM Health (`/admin_wif_health`). - **Disaster Recovery:** Firestore Delete Protection, 7-day Point-in-Time Recovery (PITR), and automated daily backups in Toronto (**RTO: 4 hours**, **RPO: 24 hours**). --- ## Contact & Documentation - **Contact Portal:** https://getsafedocs.cloud.run/contact - **Application & API Base URL:** https://getsafedocs.cloud.run - **Website:** https://getsafedocs.com - **Security Documentation:** https://getsafedocs.com/security-documentation.html - **User & API Documentation:** https://getsafedocs.com/user-documentation.html --- **Document Classification:** Public **Copyright:** © 2026 GetSafeDocs Inc. All rights reserved.