Back Print Download Markdown

GetSafeDocs Enterprise Admin Guide

This guide is designed for Enterprise Administrators managing their organization's GetSafeDocs workspace, team seats, corporate domain auto-enrollment, user invitations, activity monitoring, and security policies on https://getsafedocs.cloud.run.

Table of Contents

  1. Getting Started with Enterprise
  2. Initial Enterprise Setup
  3. Company Settings & Seat Allocation
  4. Auto-Enrollment Email Domains
  5. User Roles & Managing Enterprise Users
  6. Inviting Team Members & Managing Invitations
  7. Activity Monitoring & Audit Analytics
  8. Enterprise Security, Custom File Policies & Deployment Options
  9. Billing & Subscription Ownership
  10. Troubleshooting
  11. Best Practices for Enterprise Admins
  12. Contact & Enterprise Support

Getting Started with Enterprise

Enterprise Plan Highlights

Enterprise licensing is sold in blocks of 5 seats (https://getsafedocs.cloud.run/pricing) and provides every enrolled seat with full Enterprise capabilities:

  • 200 MB Max File Size per uploaded file (up to 20 files per message)
  • 300 Monthly Messages per seat and up to 100 Recipients per message
  • 5,000 MB (5 GB) Monthly Viewed/Received Data allowance per seat
  • Centralized Enterprise Management Console (https://getsafedocs.cloud.run/enterprise_admin)
  • Auto-Enrollment Email Domains for zero-touch corporate onboarding
  • Unlimited Document Request Portals & Mailing Lists for all team members
  • Custom Message Expiry (1 Day to 1 Year, plus ability to extend expiry before expiration)
  • 82 Supported File Formats (including video, audio, and professional design files) plus formal Enterprise File Type Exceptions upon security review
  • 100% Canadian Data Residency in Toronto, Ontario (northamerica-northeast2)
  • Optional Dedicated / Bring-Your-Own-Cloud (BYOC), On-Premise Deployments & Customer-Managed Encryption Keys (CMEK)

Accessing the Enterprise Management Console

  1. Sign in at https://getsafedocs.cloud.run/login using your Passkey, Google OAuth, or Email/Password + 2FA.
  2. Open Profile and click the Enterprise Management button (or navigate directly to https://getsafedocs.cloud.run/enterprise_admin).

Enterprise Setup

If you have just purchased an Enterprise subscription and are accessing /enterprise_admin for the first time, you will see the Create Your Enterprise setup card:

  1. Enter Your Enterprise Name: Provide your organization's official display name (e.g., Acme Financial Corp.). This name appears on team invitation emails and your Enterprise Management console.
  2. Verify Your Seat Allocation: Review the Number of Seats shown on the setup card (automatically calculated from the number of 5-seat blocks in your Stripe subscription).
  3. Click "Create Enterprise": GetSafeDocs provisions your company record, links your account as the initial Company Admin (Subscription Owner), and unlocks domain auto-enrollment and user invitations.

Company Settings

From the Enterprise Overview and Company Settings cards on /enterprise_admin, administrators can:

  • Monitor Seat & Message Volume (Enterprise Overview):
  • Total Users: Displays active Enterprise seats used out of your total licensed seats (e.g., Total Users: 7 of 10).
  • Total Messages Sent: Displays the cumulative number of secure messages sent across all members of your organization.
  • Update Organization Name (Company Settings):
  • Edit the Company Name field and click Update Company Name at any time. Changes take effect immediately across your workspace and future invitation emails.

Auto-Enrollment Email Domains

The Auto-Enrollment Email Domains panel on /enterprise_admin allows you to onboard employees automatically without sending individual invitation emails.

How Automatic Domain Enrollment Works

When you register a corporate email domain (for example, yourcompany.com):
1. Any new user who registers at https://getsafedocs.cloud.run/register using an email address at that domain (name@yourcompany.com) and verifies their email address is automatically enrolled into your company's Enterprise workspace.
2. Auto-enrollment continues automatically as long as your organization has available seats (Total Users < Total Seats).
3. If all licensed seats are currently full, new registrations on that domain default to the Free tier until an administrator adds more seats or frees an existing seat.

Adding or Removing an Auto-Enrollment Domain

  1. In Enterprise Management (/enterprise_admin), locate the Auto-Enrollment Email Domains card.
  2. Enter your corporate domain without the @ symbol (e.g., example.com) and click Add Domain.
  3. Active domains are listed in the table below with the date added. Click Remove next to any domain to stop future automatic enrollments for that domain (existing enrolled users are not removed).

Domain Eligibility & Webmail Restrictions

  • Corporate Domains Only: Only domains owned by your organization are eligible. Each domain can only be registered to one Enterprise organization at a time.
  • Public Webmail Providers Blocked: Consumer webmail domains (gmail.com, yahoo.com, outlook.com, hotmail.com, live.com, msn.com, aol.com, icloud.com, me.com, mac.com, protonmail.com, zoho.com, gmx.com, tutanota.com, fastmail.com, hey.com, mail.com, yandex.com, mail.ru, etc.) are permanently blocked from domain auto-enrollment.
  • Inviting External / Webmail Collaborators: Team members or contractors who use a webmail address can still be added to your Enterprise seats manually using the Invite New User card.

User Management

Understanding Organization Roles

Role Badge / Indicator Capabilities
Admin (Subscription Owner) Admin (Subscription Owner) + 💳 Primary billing owner who purchased the Stripe subscription. Has full Company Admin privileges and cannot be downgraded or removed without first transferring subscription ownership.
Company Admin Admin Full access to /enterprise_admin: can update company name, manage Auto-Enrollment Email Domains, invite users, resend/cancel invitations, downgrade/upgrade user access levels, remove seats, and view organization-wide message activity.
Enterprise User User (Enterprise badge) Full access to all Enterprise features (200 MB uploads, 20 files/message, 300 messages/month, 100 recipients/message, Document Requests, Mailing Lists, 2FA & Passkeys). Does not have access to /enterprise_admin.

Reviewing & Managing Team Members (Enterprise Users Table)

The Enterprise Users table displays every account associated with your organization:
- Email: User's account email address (with the 💳 badge indicating the Subscription Owner).
- Role: Admin (Subscription Owner), Admin, or User.
- Access Level: Enterprise (green badge) or Free (gray badge).
- Joined: Date the account was created/joined (YYYY-MM-DD UTC).
- Last Login: Most recent authentication timestamp (YYYY-MM-DD HH:MM UTC).
- Actions:
- Downgrade to Free: Downgrades an active Enterprise member to the Free tier, removes their Enterprise privileges, and immediately frees their seat for another user.
- Upgrade to Enterprise: Upgrades a Free user in your organization back to the Enterprise tier (available when you have open seats).
- Remove: Removes the user from your Enterprise organization completely, resets their account to the Free tier, and marks any accepted company invitations for their email as expired.

Inviting and Managing Users

Sending Individual Team Invitations

  1. In Enterprise Management (/enterprise_admin), locate the Invite New User card.
  2. Note: If your organization has reached its seat limit (Total Users == Total Seats), an alert is shown in place of the form until you free a seat or upgrade your seat count.
  3. Enter the user's email address and click Send Invitation.
  4. GetSafeDocs generates a single-use cryptographic invitation token valid for 7 days and emails an HTML invitation with a direct onboarding link:
    https://getsafedocs.cloud.run/accept_invite?token=...

How Recipients Accept (or Decline) an Invitation

When the recipient clicks the invitation link (/accept_invite?token=...):
- If the recipient already has a GetSafeDocs account:
- They are prompted to sign in at /login (if not already signed in) and are presented with the Company Invitation confirmation card where they can click Accept Invitation or Decline Invitation.
- Automatic Premium-to-Enterprise Transition: If the user previously had an individual Premium subscription, accepting your Enterprise invitation automatically upgrades their account to Enterprise and configures their individual Stripe Premium subscription to cancel at the end of the current billing period (cancel_at_period_end = true) so they are never double-billed.
- If the recipient does not have a GetSafeDocs account yet:
- Clicking the invitation link automatically redirects them to /register with their invited email address pre-filled in their session.
- Once they complete registration and verify their email address, they can complete the invitation acceptance and immediately receive Enterprise access.

Managing Pending & Accepted Invitations

The Invitations card on /enterprise_admin organizes invitations into two tabs:

  1. Pending Tab:
  2. Lists all active invitations awaiting acceptance, showing Email, Sent At (UTC), Expires (UTC), and Actions.
  3. Resend: Extends the invitation's expiration date to 7 days from today and sends a fresh invitation email.
  4. Account Recovery (⚠️ Recovery Needed): If a user accepted an invitation link before finishing account verification, admins can click Resend to automatically reset the invitation to pending and allow the user to complete onboarding.
  5. Cancel: Immediately deletes the pending invitation and invalidates the token.
  6. Accepted Tab:
  7. Displays all active Enterprise members who joined via invitation, recording both the original Sent At (UTC) and Accepted At (UTC) timestamps for compliance auditing.

Monitoring and Analytics

Enterprise administrators have built-in visibility into organization-wide usage on /enterprise_admin:

  • Enterprise Overview Metrics:
  • Real-time active seat count vs. licensed seat capacity (Total Users: X of Y).
  • Total messages sent across all Enterprise seats (Total Messages Sent).
  • Recent Enterprise Messages Table:
  • Displays the 100 most recent messages sent by members of your organization, including:
    • Date: Exact timestamp in UTC (YYYY-MM-DD HH:MM UTC)
    • Sender: The Enterprise team member's email address
    • Subject: Message subject line
  • Detailed Per-Message Tracking:
  • Every Enterprise member can also inspect granular recipient view/download logs (message_view, file_view, office_view, file_download, file_download_zip) with IP addresses, timestamps, and User-Agent strings on /message_activity_details.

Security Management

Identity & Access Controls

  • Passkeys (FIDO2 / WebAuthn) & Two-Factor Authentication (2FA): All Enterprise users have full access to hardware/biometric Passkeys and Authenticator App (TOTP) or Email 2FA in Profile (/profile and /mfa_setup).
  • Developer API Keys (gsd_...): Team members and administrators can generate named, scoped personal API keys with optional expiration (30, 90, 365 days, or never) in Profile (/profile). Only the SHA-256 hash is stored at rest, last-used timestamps and IP addresses are tracked, and keys can be revoked immediately.
  • Automated Brute-Force Lockout: Accounts automatically lock for 60 minutes after 5 consecutive failed login attempts, protecting corporate accounts from credential stuffing.
  • Session Security: Authenticated sessions use 256-bit (64 hex char) cryptographic tokens with a 24-hour sliding expiration (refreshed every 30 minutes of activity) and automatic session invalidation upon password change.

Data Protection, Malware Defense & Compliance

  • 100% Canadian Data Residency: All data at rest—both uploaded files in Google Cloud Storage and all 30 database collections in Google Cloud Firestore—is stored in Google Cloud's Toronto, Ontario (northamerica-northeast2) region under PIPEDA jurisdiction (and aligned with GDPR under Canada's EU adequacy decision).
  • Encryption at Rest & In Transit: AES-256-GCM server-side encryption at rest with Google Cloud KMS Customer-Managed Encryption Keys (CMEK), Firestore Delete Protection & Point-in-Time Recovery (PITR), and TLS 1.3 encryption in transit with direct browser-to-GCS V4 Signed URL transfers.
  • Real-Time QuickSand Malware Quarantine: Every file uploaded by your team or submitted by external clients through Document Request portals passes through 7 validation layers and real-time static/structural malware analysis before delivery.

Enterprise Customizations & File Type Exceptions

  • Blocked File Type Exceptions: By default, 34 executable and script extensions (.exe, .bat, .dll, .js, .sh, .msi, etc.) are blocked across all tiers. If your Enterprise organization has a legitimate business requirement to exchange specific blocked formats, contact Enterprise Support to request a formal security review and exception.
  • Large Organization Deployment Options:
  • Dedicated or Bring-Your-Own-Cloud (BYOC): Isolated cloud storage and compute environments tailored to your organization's governance policies.
  • Customer-Managed Encryption Keys (CMEK): Bind your own Google Cloud KMS encryption keys in Dedicated/BYOC deployments for complete cryptographic key lifecycle control.
  • On-Premise Deployments: Deploy within your own infrastructure for specialized regulatory environments.

Billing and Subscriptions

  • 5-Seat Licensing Blocks: Enterprise subscriptions are billed via Stripe in blocks of 5 seats (1 block = 5 seats, 2 blocks = 10 seats, etc.).
  • Self-Service Billing Portal: The Subscription Owner (or Company Admin) can manage payment methods, download invoices, or adjust subscription settings by opening Profile → User Account Information and clicking Manage Subscription (or visiting Pricing).
  • Transferring Subscription Ownership: Because the Subscription Owner (💳) is tied to the active Stripe billing record, they cannot be removed or downgraded from the Enterprise Users table until ownership is transferred. Contact Enterprise Support to transfer the Subscription Owner role to another Company Admin without service interruption.

Troubleshooting

  • "You have reached your user limit":
  • Your active Enterprise seats (Total Users) have reached your licensed seat count. Either remove/downgrade an inactive user in the Enterprise Users table, or upgrade your subscription seat blocks via Profile → Manage Subscription or Contact Support.
  • "Webmail domains are not allowed for enterprise auto-enrollment":
  • Public email providers (gmail.com, yahoo.com, outlook.com, etc.) cannot be added to Auto-Enrollment Email Domains. Invite those users individually using the Invite New User form instead.
  • "Invitation email does not match account email":
  • For security, an invitation sent to user@company.com can only be accepted when signed in as user@company.com. Ask the user to sign in with (or register) the exact email address that was invited, or send a new invitation to their preferred email address.
  • Invited user accepted the link, but still appears as Free tier (⚠️ Recovery Needed):
  • If a user clicked the invitation link before verifying their email address, click Resend next to their entry in the Pending invitations tab and have them click the invitation link again while signed in.

Best Practices

  1. Configure Auto-Enrollment for Corporate Domains: Add your organization's verified domain(s) under Auto-Enrollment Email Domains for frictionless employee onboarding, and use Invite New User only for external contractors or webmail users.
  2. Mandate Passkeys & Authenticator App 2FA: Instruct all team members to register a FIDO2 Passkey and enable TOTP Authenticator App 2FA in Profile (/profile) immediately after joining.
  3. Audit Seats Monthly: Review the Enterprise Users table (checking Last Login timestamps) and the Pending Invitations tab monthly. Use Downgrade to Free or Remove immediately when personnel depart.
  4. Standardize External File Intake on Document Requests: Have your team use Document Requests (/document_requests) instead of email attachments when collecting files from clients or vendors so all inbound files are automatically validated and scanned for malware.

Contact Information