# GetSafeDocs User Guide

Welcome to **GetSafeDocs**, the enterprise-grade secure document exchange and intake platform hosted in **Toronto, Ontario, Canada (`northamerica-northeast2`)**. This guide covers account creation, passkey and two-factor authentication, sending malware-scanned documents, managing recipients and activity tracking, creating document request portals, and security best practices.

---

## Table of Contents

1. [Getting Started](#getting-started)
2. [Account & Profile Management](#account-management)
3. [Sending Documents](#sending-documents)
4. [Recipient Management & Outbox Tracking](#recipient-management)
5. [Receiving, Previewing & Replying to Documents](#receiving-documents)
6. [Document Requests (Client Upload Portals)](#document-requests)
7. [Mailing Lists](#mailing-lists)
8. [Passkeys, Two-Factor Authentication (2FA) & API Keys](#two-factor-authentication-2fa)
9. [Account Tiers, File Types & Quotas](#account-tiers-and-features)
10. [Security Features](#security-features)
11. [Troubleshooting](#troubleshooting)
12. [Best Practices](#best-practices)

---

## Getting Started

### Creating Your Account

1. Visit **[https://getsafedocs.cloud.run/register](https://getsafedocs.cloud.run/register)** (or click **Sign Up** on **https://getsafedocs.com**).
2. Enter your email address and create a strong password (minimum 8 characters), or choose **Sign in with Google** for one-click OAuth 2.0 registration.
3. Accept the Terms of Service and Privacy Policy and submit the registration form.
4. Check your inbox for the verification email and click the verification link (or enter the verification code on `https://getsafedocs.cloud.run/verify_email`) to activate your account.
   - *Didn't receive the email?* Check your spam/junk folder or request a fresh code at **[https://getsafedocs.cloud.run/resend_verification](https://getsafedocs.cloud.run/resend_verification)** (a 60-second cooldown applies between resends).
   - *Corporate Auto-Enrollment:* If your employer has registered your company email domain in **Enterprise Admin**, registering with your work email address automatically enrolls you in your organization's **Enterprise** plan upon verification.

### Logging In

Sign in at **[https://getsafedocs.cloud.run/login](https://getsafedocs.cloud.run/login)** using any of the following methods:
- **Passkey (FIDO2 / WebAuthn):** Sign in without a password using Touch ID, Face ID, Windows Hello, or a hardware security key (such as a YubiKey).
- **Email & Password:** Standard login protected by Argon2id hashing, brute-force rate limiting, and optional 2FA (Authenticator App or Email OTP).
- **Sign in with Google:** One-click Google OAuth 2.0 authentication.
- **Document Access Token (No Account Required):** If you received an access token (`token`) to view a shared document or upload to a Document Request, enter it directly on **https://getsafedocs.com** or **[https://getsafedocs.cloud.run/access_document](https://getsafedocs.cloud.run/access_document)** without needing an account.

---

## Account Management

### Profile & Usage Dashboard

Navigate to **Profile** (`https://getsafedocs.cloud.run/profile`) when signed in to view your real-time account status and manage your settings:

- **Plan & Quota Summary:**
  - **Account Status:** Current tier (`Free`, `Premium`, or `Enterprise` Plan).
  - **Messages Remaining This Month:** Remaining monthly messages out of your tier allowance (`10` Free / `300` Premium / `300` Enterprise).
  - **Maximum File Size:** Per-file upload cap (`5 MB` Free / `128 MB` Premium / `200 MB` Enterprise).
  - **Maximum Files per Message:** Attachment count cap (`1` Free / `20` Premium / `20` Enterprise).
  - **Maximum Recipients per Message:** Recipient cap (`2` Free / `30` Premium / `100` Enterprise).
  - **Data Usage This Month:** Total data **Sent (MB)** and **Viewed/Received (MB)** compared against your monthly received data allowance (`100 MB` Free / `3,000 MB` Premium / `5,000 MB` Enterprise).
- **Subscription & Billing Management:**
  - **Upgrade Your Plan:** Start a **7-day free trial of Premium** or subscribe to Premium/Enterprise via Stripe Checkout at **[https://getsafedocs.cloud.run/pricing](https://getsafedocs.cloud.run/pricing)**.
  - **Manage Subscription:** Premium subscribers and Enterprise Company Admins can open the Stripe Billing Portal or click **Cancel Subscription** (which maintains access through the end of the current billing period).
- **Deleting Your Account:**
  - Under **User Account Information**, clicking **Delete Account** permanently deletes your account, cancels any active Stripe subscription immediately, purges your sent messages and uploaded files from Google Cloud Storage, and logs you out.

### Password Management

- **Changing or Setting a Password:**
  1. Go to **Profile** (`https://getsafedocs.cloud.run/profile`) → **User Account Information**.
  2. Click **Change Password** (or **Set Password** if you originally signed up via Google OAuth) to open `https://getsafedocs.cloud.run/set_password`.
  3. Enter your new password (minimum 8 characters) and confirm. Changing your password automatically invalidates all other active sessions.
- **Resetting a Forgotten Password:**
  1. Click **Forgot your password?** on the login page (`https://getsafedocs.cloud.run/reset_password`).
  2. Enter your account email address to receive a time-limited cryptographic reset link.
  3. Follow the link to set a new password.

---

## Sending Documents

### How to Send a Secure Document Package

1. Sign in and click **Send Documents** (`https://getsafedocs.cloud.run/send_message`).
2. **Upload Files (Optional):**
   - Click **Choose Files** or drag and drop files into the upload area.
   - Each file uploads directly from your browser to Google Cloud Storage in **Toronto, Ontario (`northamerica-northeast2`)** over TLS 1.3 using a short-lived V4 Signed URL (`get_signed_url` → `PUT` → `process_cloud_upload`).
   - Progress is tracked in real time: `0–45%` direct upload, `45–55%` server verification, and `55–100%` **QuickSand Malware Analysis**.
   - Once scanning completes, each file displays a security badge (**Clean**, **Suspicious**, or **Malicious**) and a **View Malware Scan Results** button (`/scan_report?uuid=...`).
   - *Note:* You can also send a secure text message without attaching any files.
3. **Configure Preview-Only Mode (Optional):**
   - Check **Preview Only - Recipients can only view supported documents in sandbox, no downloads allowed** to let recipients read documents inside GetSafeDocs' browser viewer while blocking raw file downloads.
4. **Compose Subject & Message:**
   - Enter a **Subject** (required, up to 200 characters) and an optional **Message** body (up to 5,000 characters).
5. **Enable Activity Notifications (Optional):**
   - Check **Notify me when recipients view or download this message** to receive an automatic email alert (including timestamp, recipient email, file name, IP address, and User-Agent) whenever a recipient views your message, previews a file in the sandbox, or downloads an attachment.
6. **Add Recipients:**
   - **Comma-Separated Emails:** Enter recipient email addresses (e.g., `alice@example.com, bob@example.com`) up to your plan's per-message limit (`2` Free / `30` Premium / `100` Enterprise).
   - **Or Select a Mailing List (Premium & Enterprise):** Choose one of your saved recipient groups from the **Or Select a Mailing List** dropdown (use the 🔄 button to refresh lists on the fly).
   - **Manual Access Code:** Leave both recipient fields blank to generate a single manual access token that you can share yourself via another channel.
7. **Set Message Expiry (Premium & Enterprise):**
   - Free tier messages expire after **1 Month (Default)**.
   - Premium and Enterprise users can select: **1 Day**, **3 Days**, **1 Week**, **2 Weeks**, **1 Month (Default)**, **2 Months**, **3 Months**, **6 Months**, or **1 Year**.
   - *Important:* When a message expires, its attached files and message body are permanently purged from storage and cannot be recovered.
8. Click **Send Message**.

---

## Recipient Management

### Managing Delivery & Sharing Tokens

Immediately after sending a message (or by clicking **Manage Recipients** from your Outbox), you arrive at **Recipient Management** (`https://getsafedocs.cloud.run/recipient_management?message_id=...`):

- **Account Holders (`Account Holder` badge):**
  - Recipients who already have a verified GetSafeDocs account are **auto-notified** immediately when the message is created.
  - For maximum security, their notification email does not contain an external access token; instead, the message and attachments appear directly inside their authenticated **GetSafeDocs Inbox** (`/inbox`).
- **External Recipients (Non-Account Holders):**
  - External email addresses have a checkbox in the **Send Email** column (checked by default; use **Select All / Deselect All** to toggle).
  - Click **Send Selected Emails** (or **Resend Selected Emails**) to email each selected recipient a notification containing their unique **ID Token** and message details.
- **Manual Token & URL Sharing:**
  - Every recipient row (including manual access codes created when no email was entered) provides one-click **Copy** buttons for:
    - **Token ID:** An 8-character unambiguous access code (e.g., `a7k9m2p4`) that the recipient can enter on `https://getsafedocs.com`.
    - **Full URL:** Direct link (`https://getsafedocs.cloud.run/access_document?token=...`) to open the document access page with the token pre-filled.

### Outbox, Message Details & Activity Tracking

Open **Outbox** (`https://getsafedocs.cloud.run/outbox`) to manage all messages you have sent:

- **Message Details (`/message_details?message_id=...`):**
  - View message content, attached files, individual Malware Scan Reports, recipient read status, and threaded replies.
  - **Extend Message Expiry (Premium & Enterprise):** Before a message expires, you can extend its expiration date (up to 1 year) directly from the Message Details page.
  - **Delete Message:** Permanently delete a sent message and its stored files at any time.
- **Message Activity & Tracking Logs (`/message_activity_details?message_id=...`):**
  - Inspect a complete chronological audit trail of every event on your message: `message_sent`, `message_view`, `file_view`, `office_view`, `file_download`, and `file_download_zip`, including UTC timestamps, recipient attribution, IP addresses, and User-Agent details.

---

## Receiving Documents

### Accessing Documents via Token or Link

You do **not** need a GetSafeDocs account to view or download documents shared with you:

1. Visit **https://getsafedocs.com** (or **[https://getsafedocs.cloud.run/access_document](https://getsafedocs.cloud.run/access_document)**) and enter your **Access Token**, or click the direct link provided by the sender.
2. Check the consent box agreeing to the Terms of Service, Privacy Policy, and Cookie Policy, then click **Access Document**.
3. Review the sender's message and the **Malware Scan Result** badge next to each file. Click **View Malware Scan Results** (`/scan_report?uuid=...`) to verify the file's SHA-256 hash, file type, and threat score before opening.

### Safe Preview in Sandbox vs. Downloading

- **Safe Preview in Sandbox:**
  - Click **Preview / View** to inspect files safely in your browser without downloading potentially untrusted files to your local disk:
    - **PDF Documents (`.pdf`):** Rendered in the built-in sandboxed PDF viewer (`/pdf_viewer`).
    - **Microsoft Office Files (`.doc`, `.docx`, `.xls`, `.xlsx`, `.ppt`, `.pptx`):** Rendered in the full-size sandboxed Office viewer (`/msview`).
    - **Markdown Files (`.md`):** Rendered with sanitized HTML formatting (`/markdown_viewer`).
    - **Images & Text Files:** Displayed directly via short-lived signed viewer streams.
- **Downloading Files:**
  - If the sender has not enabled **Preview Only** mode, click **Download** on any individual file or click **Download All as ZIP** (`/download_zip`) to download all attachments in a single archive.

### Using Your Inbox & Replying

- **Inbox (`https://getsafedocs.cloud.run/inbox`):**
  - Registered users can view all received messages in one place, see unread badges, filter active messages, and click **Archive** to organize completed threads.
  - When accessing a message from your logged-in Inbox, Terms consent is applied automatically for seamless viewing.
- **Replies & Threaded Conversations:**
  - Recipients can submit a reply directly from the document access page (`/access_document`) or message details page (`/message_details`), which notifies the sender by email.
  - **Free Tier Users:** Can send an initial reply (up to 2,000 characters) to any message they receive.
  - **Premium & Enterprise Users:** Can participate in full multi-turn threaded conversations (replying to replies) and mark replies as read.

---

## Document Requests

**Document Requests** (available on **Premium** and **Enterprise** plans) let you create customizable, token-protected upload portals so clients, vendors, applicants, or partners can securely submit files and messages to you—**without needing a GetSafeDocs account**.

### Creating a Document Request Page

1. Navigate to **Document Requests** (`https://getsafedocs.cloud.run/document_requests`) and click **Create New Request**.
2. Configure your request in the modal:
   - **Request Name (Required):** A clear title identifying the request (e.g., `Client Onboarding Documents`).
   - **Expiry (days):** Number of days the portal remains active (`1–365`, default `30`), or enter `0` for **no expiry**.
   - **Description (Optional):** Instructions explaining which documents the submitter should upload.
   - **Send Notification To (Optional):** Comma-separated email addresses to immediately email the upload link and access token upon creation (up to your plan's recipient limit).
   - **Max File Size (MB):** From `1 MB` up to your tier maximum (`128 MB` Premium / `200 MB` Enterprise).
   - **Max Files per Submission:** From `1` up to `20` files per submission.
   - **Allowed File Types (Optional):** Comma-separated list of allowed extensions (e.g., `pdf,doc,docx,jpg,png`). Leave blank to allow all file types supported by your plan.
   - **Required Fields To Be Provided By The Sender:** Choose whether submitters must provide their **Email address**, **Subject**, and/or **Message**.
   - **Allow multiple submissions from the same person:** Enabled by default so submitters can upload additional batches if needed.
3. Click **Create Request**.

### Sharing & Managing Document Requests

From your **Document Requests** table (`/document_requests`), each request provides quick actions:
- **Copy Token ID** (📋) & **Copy Full URL** (🔗): Copy the 12-character unambiguous request token or the direct upload link (`https://getsafedocs.cloud.run/document_request_upload?token=...`).
- **View Details & Submissions (`👁️` / `/document_request_view?id=...`):** Inspect every submission, see submitter details, view malware scan reports, and preview or download submitted files.
- **Test Upload (`⬆️`):** Open the live upload portal in a new tab to preview the submitter experience.
- **Share Request (`📤`):** Email the upload portal link and access code to additional recipients at any time.
- **Activate / Deactivate (`⏸️` / `▶️`):** Temporarily pause a request portal to stop new uploads without deleting existing submissions, and reactivate it whenever needed.
- **Delete (`🗑️`):** Permanently delete the document request along with all associated submission messages and stored files.

---

## Mailing Lists

**Mailing Lists** (`https://getsafedocs.cloud.run/mailing_lists`, available on **Premium** and **Enterprise** plans) make it easy to send documents to recurring groups of recipients:

1. Open **Mailing Lists** (`/mailing_lists`) and click **Create New List**.
2. Enter a **List Name**, an optional **Description**, and paste your **Recipients** (email addresses separated by commas, spaces, or newlines).
3. Click **Create List**.
4. You can **Edit** or **Delete** lists at any time, and select any saved list directly from the **Or Select a Mailing List** dropdown on the **Send Documents** page (`/send_message`).

---

## Two-Factor Authentication (2FA)

GetSafeDocs supports both **Phishing-Resistant Passkeys (FIDO2 / WebAuthn)** for all users and **Two-Factor Authentication (2FA)** for Premium and Enterprise users.

### Passkeys (All Account Tiers)

Passkeys let you sign in with a biometric sensor (`Touch ID`, `Face ID`, `Windows Hello`) or hardware security key (`YubiKey`) instead of typing a password:

1. Go to **Profile** (`https://getsafedocs.cloud.run/profile`) and expand **User Account Information**.
2. Under **Passkeys**, click **Add Passkey**.
3. Enter a descriptive name for your device (e.g., `MacBook Touch ID` or `Work YubiKey`) and complete your browser/device prompt.
4. Your registered passkeys are listed with creation and last-used dates, and can be **Renamed** (`✏️`) or **Deleted** (`🗑️`) at any time.

### Two-Factor Authentication (Premium & Enterprise)

1. Go to **Profile** (`https://getsafedocs.cloud.run/profile`) → **User Account Information** and click **Enable Two-Factor Authentication** (or visit `https://getsafedocs.cloud.run/mfa_setup`).
2. Choose your preferred verification method:
   - **Authenticator App (TOTP — Recommended):**
     1. Select **Authenticator App** and scan the on-screen QR code using Google Authenticator, Authy, 1Password, or Microsoft Authenticator (or enter the manual secret key).
     2. Enter the 6-digit verification code from your app and click **Verify and Enable**.
     3. **Save Your Backup Codes:** Record the one-time backup codes displayed upon completion in a safe place so you can sign in if you ever lose your device.
   - **Email Verification:**
     1. Select **Email Verification** to receive a one-time verification code at your account email address.
     2. Enter the code and click **Verify and Enable**.
3. **Changing or Removing 2FA:** Return to `/mfa_setup` at any time to switch between Authenticator App and Email Verification or to disable 2FA (requires verifying a code from your current MFA method first).

### Developer API Keys & MCP Server (All Account Tiers)

You can generate personal **API Keys** directly from your Profile to automate document sharing, uploads, document requests, and tracking via the GetSafeDocs REST API or connect AI assistants via the **Model Context Protocol (MCP) Server** (`https://getsafedocs.cloud.run/mcp`)—without needing a password or browser session:

1. Go to **Profile** (`https://getsafedocs.cloud.run/profile`) and expand **User Account Information**.
2. Under **Developer API Keys & MCP Server**, enter a descriptive key name (e.g., `CLI Script`, `Claude Desktop`, or `CI/CD Pipeline`), choose an optional expiration (`Never expires`, `30 days`, `90 days`, or `1 year`), and click **Generate API Key**.
3. Copy your `gsd_...` key immediately using the **Copy Key** button (for security, only the SHA-256 hash is stored and the full key is shown only once).
4. Pass your key in the `X-API-Key: gsd_...` or `Authorization: Bearer gsd_...` header when calling any `https://getsafedocs.cloud.run/api/*` REST endpoint or `https://getsafedocs.cloud.run/mcp` MCP server. You can view last-used timestamps and **Revoke** any key at any time from your Profile.

---

## Account Tiers and Features

### Complete Plan Comparison

| Feature / Quota | Free Tier | Premium Tier | Enterprise Tier |
|-----------------|-----------|--------------|-----------------|
| **Max File Size** | **5 MB** per file | **128 MB** per file | **200 MB** per file |
| **Max Files per Message** | **1** file | **20** files | **20** files |
| **Monthly Sent Messages** | **10** / month | **300** / month | **300** / month per seat |
| **Max Recipients per Message** | **2** recipients | **30** recipients | **100** recipients |
| **Monthly Viewed/Received Data** | **100 MB** / month | **3,000 MB (3 GB)** / month | **5,000 MB (5 GB)** / month per seat |
| **Message Expiry** | 1 Month (Default) | Configurable: 1 Day – 1 Year | Configurable: 1 Day – 1 Year |
| **Extend Message Expiry** | — | ✅ Up to 1 Year before expiry | ✅ Up to 1 Year before expiry |
| **Supported File Types** | **61** formats | **82** formats (+21 media/design) | **82** formats (+ custom exceptions) |
| **Real-Time Malware Scanning** | ✅ Included | ✅ Included | ✅ Included |
| **Safe Preview in Sandbox** | ✅ Included | ✅ Included | ✅ Included |
| **Preview-Only (No-Download) Mode** | ✅ Included | ✅ Included | ✅ Included |
| **Passkey Authentication (WebAuthn)** | ✅ Included | ✅ Included | ✅ Included |
| **Developer REST API & API Keys** | ✅ Included | ✅ Included | ✅ Included |
| **Two-Factor Auth (TOTP / Email)** | — | ✅ Included | ✅ Included |
| **Document Request Portals** | — | ✅ Unlimited | ✅ Unlimited |
| **Mailing Lists** | — | ✅ Included | ✅ Included |
| **Advanced Activity & IP Tracking** | — | ✅ Included | ✅ Included |
| **Threaded Reply Conversations** | Initial reply only | ✅ Full back-and-forth threads | ✅ Full back-and-forth threads |
| **Enterprise Admin Console** | — | — | ✅ Included (sold in 5-seat blocks) |
| **Auto-Enrollment Email Domains** | — | — | ✅ Included |
| **Dedicated Cloud / BYOC / CMEK** | — | — | ✅ Available on request |

### Supported & Forbidden File Types

For the live, code-generated reference of every extension and MIME mapping, visit **[Supported File Types](https://getsafedocs.cloud.run/file_types)** (also available in **[JSON](https://getsafedocs.cloud.run/file_types?format=json)** and **[Markdown](https://getsafedocs.cloud.run/file_types?format=markdown)**).

- **Free Tier (`61` Supported Extensions):**
  - **Documents (`12`):** `.pdf`, `.doc`, `.docx`, `.xls`, `.xlsx`, `.ppt`, `.pptx`, `.txt`, `.rtf`, `.odt`, `.ods`, `.odp`
  - **Images (`8`):** `.jpg`, `.jpeg`, `.png`, `.gif`, `.bmp`, `.webp`, `.tiff`, `.svg`
  - **Archives (`5`):** `.zip`, `.rar`, `.7z`, `.tar`, `.gz`
  - **Text, Data & Code Files (`36`):** `.sql`, `.csv`, `.json`, `.xml`, `.html`, `.htm`, `.css`, `.md`, `.ini`, `.conf`, `.cfg`, `.yaml`, `.yml`, `.log`, `.py`, `.rb`, `.php`, `.pl`, `.ps1`, `.go`, `.rs`, `.cpp`, `.c`, `.h`, `.java`, `.scala`, `.kt`, `.swift`, `.dart`, `.ts`, `.tsx`, `.vue`, `.svelte`, `.env`
- **Premium & Enterprise Additional Types (`+21` Extensions, `82` Total):**
  - **Video Files (`8`):** `.mp4`, `.avi`, `.mov`, `.wmv`, `.flv`, `.webm`, `.mkv`, `.m4v`
  - **Audio Files (`6`):** `.mp3`, `.wav`, `.flac`, `.aac`, `.ogg`, `.m4a`
  - **Professional Design Files (`7`):** `.psd`, `.ai`, `.eps`, `.indd`, `.sketch`, `.fig`, `.xd`
- **Forbidden File Types (`34` Permanently Blocked Across All Tiers):**
  - **Executables & Libraries:** `.exe`, `.bat`, `.cmd`, `.com`, `.msi`, `.scr`, `.pif`, `.cpl`, `.dll`, `.ocx`, `.gadget`, `.app`, `.run`, `.bin`
  - **Executable Scripts:** `.vbs`, `.vbe`, `.vb`, `.vbscript`, `.js`, `.jse`, `.wsh`, `.wsf`, `.ws`, `.sh`
  - **System, Shortcut & Mobile Packages:** `.lnk`, `.reg`, `.inf`, `.ins`, `.inx`, `.job`, `.apk`, `.ipa`
  - *Enterprise Exceptions:* Enterprise organizations with legitimate business requirements to exchange specific blocked file types can request a security review and exception via **[Contact Support](https://getsafedocs.cloud.run/contact)**.

---

## Security Features

### 1. Seven-Layer Upload Validation & QuickSand Malware Analysis
Every uploaded file passes through seven sequential security checks:
1. Client-side extension, file count, and size validation
2. Server-side forbidden extension blocklist check
3. Account tier & quota enforcement
4. V4 Signed URL `Content-Type` cryptographic binding
5. Upload session token verification (anti-replay)
6. Post-upload magic-byte MIME content inspection
7. **QuickSand Cloud Run (`stopmalware.cloud.run`)** static & structural malware analysis (inspecting Office macros, PDF streams, archives, and embedded payloads)

**Security Ratings & Four-Bucket Quarantine Isolation:**
- **Clean (`Rating 0`) / Low-Risk (`Rating 1`):** Staged in `getsafedocs_canada_temp` during upload and moved to verified active storage in `getsafedocs_canada` upon message submission, available for recipient preview/download.
- **Malicious (`Rating >= 2`):** Automatically isolated in `getsafedocs_canada_quarantine` and blocked from recipient download. Detailed cryptographic hashes (`MD5`, `SHA-1`, `SHA-256`, `SHA-512`) and threat findings are stored in `getsafedocs_canada_quicksand` and viewable in the Malware Scan Report (`/scan_report`).

### 2. Encryption & 100% Canadian Data Residency
- **At Rest (100% in Canada):** All data at rest—both uploaded files in **Google Cloud Storage** (encrypted with AES-256-GCM and Google Cloud KMS Customer-Managed Encryption Keys [CMEK]) and all account, message, recipient, and activity records in **Google Cloud Firestore** (encrypted with AES-256, Delete Protection, and Point-in-Time Recovery)—resides exclusively in **Toronto, Ontario, Canada (`northamerica-northeast2`)**.
- **In Transit:** Modern HTTPS (`TLS 1.3`) with HSTS preload and direct browser-to-GCS signed transfers.
- **Compliance:** Engineered for **PIPEDA** compliance, **GDPR** alignment (under Canada's EU adequacy status), **SOC 2 Type II**, and **ISO/IEC 27001** controls, achieving a **99/100 OWASP Top 10** security rating.

### 3. Account & Session Protection
- **Brute-Force Lockout:** Accounts automatically lock for **60 minutes** after **5 consecutive failed login attempts**.
- **Sliding Session Timeout:** Authenticated browser sessions use 256-bit database-backed tokens with a **24-hour** sliding expiration (refreshed automatically after 30 minutes of activity).
- **Disposable Email Filtering:** Known disposable/throwaway email domains are blocked from registration to prevent platform abuse.

---

## Troubleshooting

- **"File upload failed" or "File type not allowed":**
  - Check your plan's per-file size limit (`5 MB` Free / `128 MB` Premium / `200 MB` Enterprise) and attachment count limit (`1` Free / `20` Premium & Enterprise).
  - Verify the file extension is supported for your tier on the **[Supported File Types](https://getsafedocs.cloud.run/file_types)** page and that the file's actual content matches its extension.
- **"You have reached your monthly message limit" or recipient cannot view file:**
  - Check **Profile** (`/profile`) to see your remaining monthly messages (`10` Free / `300` Premium & Enterprise) and your monthly viewed/received data usage (`100 MB` Free / `3,000 MB` Premium / `5,000 MB` Enterprise). Upgrade your plan if you need higher capacity.
- **"Invalid or expired token":**
  - Verify that you copied the complete 8-character message token (or 12-character document request token).
  - Confirm with the sender that the message or document request has not passed its expiration date or been deactivated.
- **"Account temporarily locked":**
  - After 5 consecutive failed login attempts, your account locks for 60 minutes. Wait 60 minutes or use **[Forgot Password](https://getsafedocs.cloud.run/reset_password)** to reset your password.

---

## Best Practices

1. **Register a Passkey & Enable 2FA:** Add a biometric or hardware Passkey in **Profile** (`/profile`) and enable **Authenticator App 2FA** (`/mfa_setup`) on Premium and Enterprise accounts.
2. **Use Safe Preview Before Downloading:** When receiving unexpected files, always inspect the **Malware Scan Report** and use **Safe Preview in Sandbox** before downloading files to your device.
3. **Enable Preview-Only Mode for Sensitive Records:** Check **Preview Only** when sending confidential documents that recipients need to read but should not download locally.
4. **Deliver to Registered Inboxes When Possible:** Encourage frequent collaborators to create a free GetSafeDocs account so documents are delivered directly to their authenticated **Inbox** without external token emails.
5. **Use Document Request Portals for Client Intake:** Replace insecure email attachments with token-protected **Document Request** portals (`/document_requests`) whenever collecting tax, legal, HR, financial, or KYC documents.

---

## Need Help?

- **Quick Start Guide:** [View Quick Start Guide](markdown_viewer.html?file=quick_start_guide)
- **Enterprise Admin Guide:** [View Enterprise Admin Guide](markdown_viewer.html?file=enterprise_admin_guide)
- **API Documentation:** [View API Documentation](markdown_viewer.html?file=api_docs)
- **Security Documentation:** [View Security Documentation](security-documentation.html)
- **Contact Support:** [https://getsafedocs.cloud.run/contact](https://getsafedocs.cloud.run/contact)