# GetSafeDocs Security Architecture
## Enterprise & Government Security White Paper

**Version:** 2.0  
**Date:** November 2026  
**Classification:** Public  
**Document Owner:** GetSafeDocs Inc.

---

## Executive Summary

GetSafeDocs is an enterprise-grade secure document exchange and intake platform engineered to meet the stringent security, privacy, and data residency requirements of government agencies, financial institutions, healthcare providers, legal practices, and regulated enterprises.

Built on a **serverless Google Cloud Run architecture** in **Toronto, Ontario, Canada (`northamerica-northeast2`)**, GetSafeDocs combines bank-grade encryption, direct-to-cloud V4 signed transfers, real-time malware analysis, isolated browser-sandbox document previews, and phishing-resistant FIDO2/WebAuthn passkey authentication.

### Key Security Highlights

- **99/100 OWASP Top 10 Compliance Score** — Top 0.1% of assessed web applications
- **Serverless Split-Tier Isolation** — Public marketing/documentation (`getsafedocs.com`) is completely decoupled from the authenticated serverless application and API tier (`getsafedocs.cloud.run`), eliminating database and credential exposure on the public website
- **100% Canadian Data Residency for All Data at Rest** — Serverless compute (Google Cloud Run), database collections (Google Cloud Firestore), KMS encryption keys (Google Cloud KMS), and isolated object buckets (Google Cloud Storage) all reside exclusively in Toronto, Ontario (`northamerica-northeast2`) under PIPEDA jurisdiction
- **AES-256-GCM Encryption at Rest + Cloud KMS CMEK** — All Cloud Storage buckets and Cloud Firestore collections in Toronto are encrypted at rest with AES-256-GCM and Google Cloud KMS Customer-Managed Encryption Keys (CMEK), with Dedicated BYOC KMS options for enterprise tenants
- **Phishing-Resistant Authentication** — Argon2id password hashing, FIDO2/WebAuthn Passkeys, RFC 6238 TOTP MFA, Email OTP, 10 single-use Backup Codes, Google OAuth 2.0, and reCAPTCHA Enterprise risk analysis
- **Seven-Layer Upload Defense & Real-Time Malware Quarantine** — Dedicated QuickSand Cloud Run (`stopmalware.cloud.run`) static/structural document analysis with physical four-bucket storage isolation
- **Immutable Audit Trail & Cloud Logging** — Cloud Firestore security audit collections (with Delete Protection and Point-in-Time Recovery) combined with centralized Google Cloud Logging

### Certifications & Compliance Readiness

GetSafeDocs' security controls are mapped and implementation-ready for formal enterprise and government audits:

| Framework | Status | Assessment / Posture |
|-----------|--------|----------------------|
| **OWASP Top 10 (2021)** | **Assessed** | **99/100 (A+ Grade — Pass 10/10)** |
| **PIPEDA (Canada)** | **Compliant** | Active — 100% Canadian Data Residency |
| **SOC 2 Type II** | **Architecture Ready** | All 5 Trust Services Criteria implemented |
| **ISO/IEC 27001:2022** | **Controls Implemented** | Annex A controls & ISMS policy pack active |
| **PCI-DSS v4.0 Level 1** | **Compliant Processing** | Stripe Checkout & HMAC-verified webhooks |
| **GDPR (EU)** | **Aligned** | Adequacy decision (Canada) + full data subject rights |

---

## Table of Contents

1. [Platform Overview & Deployment Models](#1-platform-overview--deployment-models)
2. [Serverless Security Architecture](#2-serverless-security-architecture)
3. [Cryptography & Data Protection](#3-cryptography--data-protection)
4. [Identity, Authentication & Access Control](#4-identity-authentication--access-control)
5. [Seven-Layer Upload Security & Malware Defense](#5-seven-layer-upload-security--malware-defense)
6. [Application Threat Protection (OWASP Top 10)](#6-application-threat-protection-owasp-top-10)
7. [Security Monitoring, Audit Logging & Incident Response](#7-security-monitoring-audit-logging--incident-response)
8. [Privacy, Data Residency & Retention](#8-privacy-data-residency--retention)
9. [Technical Specifications & Tier Limits](#9-technical-specifications--tier-limits)
10. [Compliance Framework Mapping](#10-compliance-framework-mapping)
11. [Contact Information](#11-contact-information)

---

## 1. Platform Overview & Deployment Models

### Core Capabilities
GetSafeDocs enables organizations and individuals to:
- **Send Sensitive Documents Securely**: Share confidential files without insecure email attachments using cryptographically generated access tokens, recipient verification, expiry policies, and preview-only (no-download) controls.
- **Collect External Documents Safely (Document Requests)**: Publish dedicated, token-protected intake portals with custom file-type rules, size caps, and automatic malware scanning before any file reaches internal staff.
- **Verify Every Access**: Track every view, download, reply, and authentication event with IP, geolocation, User-Agent, and timestamp attribution.

### Deployment Models

#### 1. Standard Cloud Deployment (Multi-Tenant Canadian Cloud)
- **Region**: Google Cloud Platform — Toronto, Ontario, Canada (`northamerica-northeast2`)
- **Isolation**: Strict logical tenant isolation at the database, session, and GCS object-path layers
- **Encryption**: AES-256-GCM with Google Cloud KMS Customer-Managed Encryption Keys (CMEK)
- **Availability**: Auto-scaling serverless Cloud Run instances with zero-downtime rolling updates

#### 2. Enterprise Dedicated / Bring-Your-Own-Cloud (BYOC)
- **Dedicated GCP Project**: Complete compute, database, and storage isolation in the customer's chosen region(s)
- **Customer-Managed Encryption Keys (CMEK)**: Full key lifecycle ownership in the customer's Cloud KMS key ring (`projects/<project>/locations/northamerica-northeast2/keyRings/...`), allowing instant cryptographic revocation
- **Custom Policies**: Organization-enforced MFA, custom retention schedules, and dedicated VPC Service Controls

---

## 2. Serverless Security Architecture

### Split-Tier Architecture Diagram

```
┌────────────────────────────────────────────────────────────────────────────┐
│                               Client Layer                                 │
│   Web Browser (Passkeys / Sandboxed Viewers)  │   REST API Integrators     │
└──────────────────────┬───────────────────────┴──────────────┬──────────────┘
                       │ TLS 1.3 (HSTS Preload)               │ TLS 1.3
          ┌────────────▼────────────┐            ┌────────────▼────────────┐
          │   Public Website Tier   │            │ Serverless App/API Tier │
          │     getsafedocs.com     │───302/307─▶│  getsafedocs.cloud.run  │
          │  • Static Marketing     │            │  • Python 3.14 / Flask  │
          │  • Public Documentation │            │  • GCP Cloud Run (YYZ)  │
          │  • Zero DB / Zero Keys  │            │  • Keyless IAM Identity │
          └─────────────────────────┘            └──────┬───────────┬──────┘
                                                        │           │
                         ┌──────────────────────────────┘           └──────────────────────────┐
                         ▼                                                                     ▼
┌─────────────────────────────────────────────────┐   ┌────────────────────────────────────────────────┐
│   Google Cloud Firestore (Toronto - YYZ)        │   │     Isolated Google Cloud Storage (Toronto)    │
│  • 30 Native Collections via Keyless GCP IAM    │   │  • getsafedocs_canada (Verified Clean Active)  │
│  • Delete Protection & 7-Day PITR               │   │  • getsafedocs_canada_temp (Ephemeral Staging) │
│  • Argon2id Hashes & 256-Bit Session Tokens     │   │  • getsafedocs_canada_quarantine (Isolated)    │
│  • Security Audit, Lockout & Rate-Limit Tables  │   │  • getsafedocs_canada_quicksand (Scan Reports) │
└─────────────────────────────────────────────────┘   └────────────────────────┬───────────────────────┘
                                                                               │
                                                                               ▼
                                                      ┌────────────────────────────────────────────────┐
                                                      │     QuickSand Malware Analysis Cloud Run       │
                                                      │          (stopmalware.cloud.run - YYZ)         │
                                                      │  • Static & Structural Document Inspection     │
                                                      │  • MD5/SHA1/SHA256/SHA512 + CMEK Scan Reports  │
                                                      └────────────────────────────────────────────────┘
```

### Keyless Cloud IAM Security
Unlike legacy architectures that store static cloud service account keys on disk or connect to external databases over the public internet:
- **Zero Static Cloud Keys & Zero Public DB Passwords**: The Cloud Run application authenticates to **Google Cloud Firestore**, **Google Cloud Storage**, **Cloud KMS**, and the **IAM Credentials API** using its native, hardware-backed **GCP Service Account identity** via the internal metadata server.
- **V4 Signed URL Delegation**: When signing short-lived upload or download URLs, the service uses the **IAM Credentials `signBlob` API** with ephemeral OAuth2 access tokens.
- **Secret Isolation**: All runtime secrets (Stripe keys, HMAC secrets, reCAPTCHA keys) are injected strictly as protected Cloud Run environment/Secret Manager variables and never stored in web-accessible files.

---

## 3. Cryptography & Data Protection

### Encryption at Rest (100% in Toronto, Canada)
1. **Cloud Storage Object Encryption**: All objects stored in Google Cloud Storage (`northamerica-northeast2` Toronto) are encrypted at rest using **AES-256-GCM**.
2. **Cloud Firestore Database Encryption**: All 30 application, account, session, messaging, and security audit collections in **Google Cloud Firestore (`northamerica-northeast2` Toronto)** are encrypted at rest with **AES-256**, protected by Firestore **Delete Protection** and **7-day Point-in-Time Recovery (PITR)**, and programmatically constrained to Canadian GCP regions (`northamerica-northeast2` Toronto / `northamerica-northeast1` Montréal).
3. **Customer-Managed Encryption Keys (CMEK)**: All primary storage buckets (`getsafedocs_canada`, `getsafedocs_canada_temp`, `getsafedocs_canada_quarantine`, `getsafedocs_canada_quicksand`) are encrypted with Google Cloud KMS keys hosted in `northamerica-northeast2` (`projects/poised-eye-457101-b8/locations/northamerica-northeast2/keyRings/GetSafeDocs/cryptoKeys/GetSafeDocs_Toronto1`), with automated rotation and full Cloud Audit Logs visibility.
4. **Isolated Browser-Sandbox Document Viewing**:
   - Senders can enforce **Preview-Only (`preview_only = 1`)** mode to prevent raw file downloads.
   - Documents are rendered inside isolated browser viewers (`/pdf_viewer`, `/msview`, `/markdown_viewer`) with sanitized HTML/Markdown (`bleach`) and strict framing headers (`X-Frame-Options: SAMEORIGIN` only on internal preview routes).

### Encryption in Transit
- **TLS 1.3** (with strong ECDHE forward-secret cipher suites) enforced across `getsafedocs.com` and `getsafedocs.cloud.run`.
- **HTTP Strict Transport Security (HSTS)**: `max-age=31536000; includeSubDomains; preload`.
- **Direct Browser-to-GCS Transfers**: File payloads stream directly between the user's browser and `https://storage.googleapis.com` over TLS 1.3 via V4 Signed URLs (`15-minute` maximum TTL), minimizing intermediate memory exposure.

### Password & Token Cryptography
- **Password Hashing**: **Argon2id** (`memory_cost = 65536` [64 MB], `time_cost = 4`, `parallelism = 3`) with a unique per-account 16-byte cryptographic salt (`secrets.token_hex(16)`), plus transparent verification support for legacy bcrypt (`$2y$`/`$2b$`) hashes.
- **Breach Check Integration**: Optional k-anonymity SHA-1 prefix verification against the **Have I Been Pwned (HIBP)** Pwned Passwords API (`ENABLE_HIBP_CHECK`) so full passwords or hashes are never disclosed externally.
- **Cryptographic Tokens**: All session tokens (`256 bits` / `64 hex chars`), CSRF tokens (`256 bits`), password reset tokens, and document access tokens are generated via `secrets.token_hex()` / OS CSPRNG.

---

## 4. Identity, Authentication & Access Control

### Multi-Modal Authentication
GetSafeDocs supports four hardened authentication mechanisms:
1. **Email & Password (Argon2id)** with configurable complexity rules (minimum 8+ characters, uppercase, lowercase, digit, and symbol enforcement) and reCAPTCHA Enterprise protection.
2. **FIDO2 / WebAuthn Passkeys**: Hardware-bound or synced biometric credentials (`Touch ID`, `Face ID`, `Windows Hello`, `YubiKey`) using public-key cryptography (`ES256` / `RS256` / `EdDSA`) and challenge-response verification (`/api/passkey/*`).
3. **Multi-Factor Authentication (MFA)**:
   - **TOTP Authenticator Apps** (RFC 6238 compliant, 30-second window, QR provisioning at `/mfa_setup`)
   - **Email One-Time Passcodes (OTP)** (time-limited 10-minute cryptographic codes in `mfa_codes`)
   - **Single-Use Recovery Backup Codes** (10 single-use 8-character codes stored in `mfa_backup_codes`)
4. **Google OAuth 2.0**: Verified OpenID Connect identity federation (`/callback`, `/oauth_callback`) with HMAC-SHA256 signed `state` token validation (`nonce.timestamp.signature`) and automatic Enterprise email domain enrollment (`company_email_domains`).
5. **Developer API Keys (`gsd_...`)**: Programmatic REST API authentication via `X-API-Key` or `Authorization: Bearer gsd_...` headers. Full keys (`gsd_<48-hex>`) are displayed once at creation and stored strictly as **SHA-256 hashes** in `api_keys` with optional expiration (`30`, `90`, `365` days), last-used timestamp/IP tracking, and instant revocation in `/profile`.

### Session & Lockout Controls
- **Database-Backed Sessions**: Every active session is tracked in the `user_sessions` table and bound to a `256-bit` (`64 hex char`) token, client IP address, and User-Agent string, with support for both session cookies and `Authorization: Bearer <session_token>` API headers.
- **Sliding Expiration & Rotation**: Sessions have a **24-hour (`86400s`)** sliding expiration refreshed automatically after 30 minutes (`1800s`) of activity, rotate on login, and are globally revoked upon password change or reset.
- **Cookie Hardening**: `HttpOnly; Secure; SameSite=Lax`.
- **Automated Account Lockout**:
  - **5 consecutive failed login attempts** trigger an automatic **60-minute (`3600s`) account lockout**.
  - Lockout events are recorded in `authentication_logs` and the security audit trail, notify the user by email, and can be inspected or unlocked by administrators in `/admin_panel`.

### Multi-Tier Authorization Model
Every request is authorized across five dimensions:
1. **Authentication State** (valid active session or valid document token)
2. **Resource Ownership / Recipient Binding** (verified sender ID, recipient email, or token match)
3. **Subscription Tier Enforcement** (`free`, `user` [Premium], `enterprise`, `admin`)
4. **Preview-Only Enforcement** (`preview_only = 1` blocks raw file download endpoints while permitting sandboxed browser viewing)
5. **Expiration & Quarantine State** (`expiry_date` and malware `security_rating` verified before generating any GCS signed URL)

---

## 5. Seven-Layer Upload Security & Malware Defense

Every file uploaded via Send Document or Document Request passes through **seven sequential security layers**:

| Layer | Control | Enforcement Details |
|-------|---------|---------------------|
| **1. Client Pre-Validation** | Browser checks | Validates extension, tier file size cap, and file count before requesting a signed URL |
| **2. Extension Policy & Blocklist** | Server-side extension gate | Permanently blocks 30+ dangerous executable/script extensions (`exe`, `bat`, `cmd`, `msi`, `dll`, `vbs`, `js`, `sh`, `ps1`, `apk`, `lnk`, etc.) and enforces tier-allowed types |
| **3. Tier & Quota Enforcement** | Account & request limits | Enforces per-file size (`5 MB` Free / `128 MB` Premium / `200 MB` Enterprise), attachment limits (`1` / `20` / `20`), and monthly message quotas |
| **4. Content-Type Binding** | V4 Signed URL signature | Cryptographically binds the `Content-Type` header into the GCS V4 `PUT` signature so the client cannot swap MIME types mid-upload |
| **5. Upload Token Verification** | Anti-tamper state token | Validates the server-issued upload token and object path ownership before post-upload processing |
| **6. Server-Side Magic-Byte Inspection** | Post-upload MIME verification | Inspects actual magic bytes / headers of the uploaded object to detect extension spoofing |
| **7. QuickSand Malware Analysis** | Serverless static/structural scan | `stopmalware.cloud.run` inspects Office macros, PDF streams, archives, and embedded payloads; scores and routes files across isolated buckets |

### Four-Bucket Physical Isolation & Quarantine Workflow
All storage buckets reside in **Toronto, Ontario (`northamerica-northeast2`)** and are encrypted with Cloud KMS Customer-Managed Encryption Keys (`projects/poised-eye-457101-b8/locations/northamerica-northeast2/keyRings/GetSafeDocs/cryptoKeys/GetSafeDocs_Toronto1`):
1. **Ephemeral Upload & ZIP Staging (`getsafedocs_canada_temp`)**: Holds initial browser uploads (`uploads/`, `doc_requests/`) prior to message submission and temporary multi-file download archives (`zips/`).
2. **Verified Clean Active Storage (`getsafedocs_canada`)**: Holds verified clean message documents (`messages/<message_id>/<uuid>_<filename>`) where `scan_rating < 2`.
3. **Quarantine Storage (`getsafedocs_canada_quarantine`)**: Files flagged as **Malicious (`scan_rating >= 2`)** by the QuickSand Cloud Run scanner are immediately moved to the isolated quarantine bucket upon submission and purged from staging. Quarantined files cannot be downloaded by recipients.
4. **Analysis Staging & Report Storage (`getsafedocs_canada_quicksand`)**: Stages samples (`new/<uuid>`) for `stopmalware.cloud.run` and stores CMEK-encrypted JSON threat analysis reports (`report/<sha256>.json`, cached for 6 days with MD5/SHA1/SHA256/SHA512 hashes) for administrator inspection.
*(A fifth non-sensitive bucket, `getsafedocs_static`, serves public static web assets such as CSS, JS, and images.)*

### Scan Failure Resilience Policy
If the malware scanning microservice experiences a transient timeout, GetSafeDocs enforces a configurable **3-tier scan failure policy** (`MALWARE_SCAN_FAILURE_POLICY`):
- **`queue` (Production Default)**: Marks `status = 'pending'` in `scan_queue` and schedules exponential-backoff retries (`5, 10, 20, 40, 80` minutes, up to 5 attempts) via the `/cron/retry_scan_queue` worker.
- **`reject` (Strict Mode)**: Immediately deletes the uploaded object and rejects the submission.
- **`allow` (Testing Only)**: Permits the file with a logged warning.

---

## 6. Application Threat Protection (OWASP Top 10)

### Injection Prevention (`100/100`)
- **Database / Query Injection**: 100% of database operations execute with parameterized query bindings (`%s` placeholders) backed by native Google Cloud Firestore collections (`core/firestore_db.py`). Zero string interpolation is used for user data.
- **Cross-Site Scripting (XSS)**: Jinja2 auto-escaping is enabled globally across all HTML templates, Markdown rendering is sanitized through `bleach` with a strict tag allowlist, and all user inputs pass through context-aware sanitization (`html`, `email`, `filename`, `url`, `alphanumeric`).
- **Command Injection**: Zero shell execution (`os.system` / `subprocess`) is used on user inputs; all cloud operations use native Python SDKs and REST APIs.

### CSRF, Bot & Abuse Protection
- **CSRF Tokens**: State-changing form submissions validate cryptographic CSRF tokens tied to the active session.
- **reCAPTCHA Enterprise**: Evaluates behavioral risk scores (`0.0` to `1.0`) on login, registration, and contact requests.
- **Granular Rate Limiting**: Database-backed rate limiting (`rate_limits` table) with Cloudflare IPv4/IPv6 proxy awareness protects critical actions:

| Endpoint / Action | Rate Limit | Window | Scope |
|-------------------|------------|--------|-------|
| Login Attempts | 10 attempts (5 fails → 60m account lock) | 15 minutes | Per IP / Account |
| Account Registration | 5 attempts | 15 minutes | Per IP |
| Password Reset & Set Password | 5–8 requests | 15 minutes | Per IP |
| Email Verification & MFA Verification | 8–10 attempts | 15 minutes | Per IP |
| Passkey Authentication | 10 attempts | 15 minutes | Per IP |
| Document Token Lookup | 10 attempts | 15 minutes | Per IP |
| Contact Form Submission | 5 requests | 15 minutes | Per IP |

### HTTP Security Headers
Every response from `getsafedocs.cloud.run` and `getsafedocs.com` includes hardened security headers:
- `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
- `X-Frame-Options: DENY` (with `SAMEORIGIN` only on internal document preview frames)
- `X-Content-Type-Options: nosniff`
- `X-XSS-Protection: 1; mode=block`
- `Referrer-Policy: strict-origin-when-cross-origin`
- `Permissions-Policy: geolocation=(), microphone=(), camera=()`
- `Content-Security-Policy` with violation reporting to `/csp-violation-report`
- **Subresource Integrity (SRI)** SHA-384 hashes on all external CDN scripts and stylesheets

---

## 7. Security Monitoring, Audit Logging & Incident Response

### Dual-Layer Audit Logging
GetSafeDocs records security and operational events in both **Google Cloud Firestore audit collections** (`audit_logs`, `authentication_logs`, `malware_detections`, `csp_violations`, `message_activity`) and **Google Cloud Logging**:
- **Authentication & Identity**: Logins, failures, lockouts, admin unlocks, MFA enrollments, passkey registrations, password resets.
- **Document Lifecycle**: Every file upload, malware scan score, quarantine action, preview, download (with filename, SHA-256 hash, sender/recipient email, IP, and User-Agent), and expiration cleanup.
- **Administrative Actions**: Tier changes, enterprise company & seat modifications, domain management, scan queue retries, and security log queries.

### Administrative Security Dashboards
Administrators have real-time visibility through dedicated security consoles on `getsafedocs.cloud.run`:
- **Admin Panel (`/admin_panel`)**: User management, tier controls, and one-click account unlock.
- **Recent Security Activity (`/security_recent`)**: 7-day authentication and lockout telemetry.
- **Shared IP Audit (`/security_audit`)**: Multi-account IP correlation to detect credential stuffing or abuse.
- **Malware Detection Log (`/malware_detections`)**: Full visibility into quarantined files and QuickSand threat reports.
- **Scan Queue Monitor (`/admin_scan_queue`)**: Inspection and manual trigger of queued malware scans.
- **CSP Violation Monitor (`/admin_csp_violations`)**: Real-time tracking of blocked script/frame injection attempts.
- **Cloud IAM / WIF Health (`/admin_wif_health`)**: Live verification of GCS signing and cloud identity health.

### Incident Response Lifecycle
GetSafeDocs follows a 5-phase Incident Response Plan (`docs/policies/IncidentResponsePlan.md`):
1. **Detection & Triage** (< 1 hour internal review of critical alerts)
2. **Containment** (Automated account lockout, IP blocking, or quarantine bucket isolation)
3. **Eradication** (Vulnerability remediation, key/session revocation, dependency patching within 72 hours)
4. **Recovery** (Verified restoration from Firestore Point-in-Time Recovery [PITR] and daily automated encrypted backups in Toronto; **RTO: 4 hours**, **RPO: 24 hours**)
5. **Post-Incident & Breach Notification** (Root-cause analysis and PIPEDA/GDPR breach notification to affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible)

---

## 8. Privacy, Data Residency & Retention

### 100% Canadian Data Residency (All Data at Rest in Canada)
- **Primary Region**: Toronto, Ontario, Canada (`northamerica-northeast2`)
- **Complete Data Sovereignty at Rest**: Both uploaded files (**Google Cloud Storage** in `northamerica-northeast2`) and all 30 database collections covering accounts, messages, recipients, sessions, and audit logs (**Google Cloud Firestore** in `northamerica-northeast2`) are stored and encrypted at rest exclusively in Canada.
- **Programmatic Region Guardrails**: The database engine enforces Canadian region residency (`ALLOWED_CANADIAN_LOCATIONS = {"northamerica-northeast2", "northamerica-northeast1"}`) prior to opening connections.
- **Regulatory Framework**: Personal Information Protection and Electronic Documents Act (**PIPEDA**)
- **EU Adequacy**: Canada holds an active European Commission adequacy decision under GDPR Article 45, enabling lawful EU-to-Canada data transfers without additional Standard Contractual Clauses.

### Automated Data Retention & Lifecycle Cleanup
- **Message & File Expiration**: Expiring messages and their underlying GCS objects are automatically purged by scheduled Cloud Run cleanup jobs (`/cron/cleanup_expired`).
- **Session, Rate-Limit & Audit Hygiene**: Expired sessions, CSRF tokens, rate-limit records, and aged audit records are maintained automatically via `/cron/security_maintenance` and `/cron/cleanup_audit_logs`.
- **Quarantine Retention**: Quarantined files are isolated from users and purged after administrative review or retention expiry (90 days).
- **Right to Erasure**: Users can request account deletion at any time; personal data is purged within 30 days while preserving anonymized compliance audit logs (`/admin_deleted_accounts`).

---

## 9. Technical Specifications & Tier Limits

### Account Tiers & Capacities

| Capability | Free Tier | Premium Tier | Enterprise Tier |
|------------|-----------|--------------|-----------------|
| **Max File Size** | **5 MB** per file | **128 MB** per file | **200 MB** per file |
| **Monthly Message Quota** | 10 messages / month | 300 messages / month | **300 messages / month per seat** (blocks of 5 seats) |
| **Max Attachments / Message** | 1 attachment | 20 attachments | 20 attachments |
| **Max Recipients / Message** | 2 recipients | 30 recipients | 100 recipients |
| **Monthly Received Storage** | 100 MB / month | 3,000 MB / month | 5,000 MB / month |
| **Allowed File Types** | 61 formats (business, image, archive & code) | 82 formats (adds video, audio & design files) | 82 formats + formal exception workflow |
| **Message Expiry** | 1 Month (Default) | Configurable (1 Day – 1 Year, extendable) | Configurable (1 Day – 1 Year, extendable) |
| **Malware Scanning** | QuickSand Real-Time Scan | QuickSand Real-Time Scan | QuickSand Real-Time Scan |
| **Sandboxed Preview & Preview-Only Mode** | Included | Included | Included |
| **2FA (TOTP / Email) & Passkeys** | Full 2FA + Passkeys | Full 2FA + Passkeys | Full 2FA + Passkeys + Auto-Enrollment Domains |
| **Document Request Portals** | — | Included | Included |
| **Delivery & View Tracking** | Basic | Full IP/Timestamp Audit | Organization-Wide Audit |
| **Team & Seat Management** | — | — | Enterprise Admin Console (`/enterprise_admin`) |
| **Encryption Keys** | Cloud KMS CMEK (AES-256) | Cloud KMS CMEK (AES-256) | Cloud KMS CMEK (AES-256) / Dedicated BYOC |

**Live File Type Reference:**
- Web: `https://getsafedocs.cloud.run/file_types`
- JSON: `https://getsafedocs.cloud.run/file_types?format=json`
- Markdown: `https://getsafedocs.cloud.run/file_types?format=markdown`

---

## 10. Compliance Framework Mapping

| Domain | OWASP Top 10 (2021) | SOC 2 Trust Criteria | ISO/IEC 27001:2022 |
|--------|---------------------|----------------------|--------------------|
| **Access Control & MFA** | A01, A07 (Pass 99/100) | CC6.1, CC6.2, CC6.3 | Annex A.5.15 – A.5.18, A.8.5 |
| **Cryptography & Key Mgmt** | A02 (Pass 99/100) | CC6.1, CC6.7, C1.1 | Annex A.8.24 |
| **Injection & Input Security** | A03 (Pass 100/100) | CC7.1, PI1.3 | Annex A.8.26, A.8.28 |
| **Serverless & Zero-Trust Design** | A04, A05 (Pass 99/100) | CC6.6, CC6.8, A1.2 | Annex A.8.9, A.8.20 – A.8.22 |
| **Malware & Integrity Verification** | A08 (Pass 98/100) | CC6.8, PI1.4 | Annex A.8.7, A.8.16 |
| **Audit Logging & Incident Response** | A09 (Pass 99/100) | CC7.2, CC7.3, CC7.4 | Annex A.5.24 – A.5.28, A.8.15 |

Complete ISMS policy documents (`docs/policies/`) are maintained in the repository covering Access Control, Cryptography & Key Management, Cloud Security, Data Retention & Deletion, Incident Response, Business Continuity & Disaster Recovery, Risk Management, and Supplier Security.

---

## 11. Contact Information

For enterprise and government security inquiries, architecture reviews, compliance questionnaires, or coordinated vulnerability disclosure:

- **Contact Portal:** https://getsafedocs.cloud.run/contact
- **Application & API Base URL:** https://getsafedocs.cloud.run
- **Main Website:** https://getsafedocs.com
- **Security Documentation Portal:** https://getsafedocs.com/security-documentation.html
- **User & API Documentation Portal:** https://getsafedocs.com/user-documentation.html

**Response SLA:** Within 24 hours for security disclosures and enterprise inquiries.

---

**Document Classification:** Public  
**Copyright:** © 2026 GetSafeDocs Inc. All rights reserved.