GetSafeDocs Security Summary

Enterprise & Government Executive Security Overview

Document Classification: Public
Version: 2.0
Date: November 2026
Prepared By: GetSafeDocs Inc.

Executive Summary

GetSafeDocs provides a secure document sharing and document intake platform engineered for government agencies, legal and financial firms, healthcare organizations, and enterprises. Hosted on a serverless Google Cloud Run architecture in Toronto, Ontario, Canada (northamerica-northeast2), GetSafeDocs combines Canadian data residency, defense-in-depth upload validation, real-time malware analysis, isolated browser-sandbox document previews, and phishing-resistant authentication.

Key Security Metrics

Compliance Alignment

• ✅ PIPEDA (Canada): Compliant — 100% Canadian data residency for all files and database records
• ✅ SOC 2 Type II: Architecture and Trust Services Criteria controls implemented
• ✅ ISO/IEC 27001:2022: Annex A technical controls and ISMS policies active
• ✅ PCI-DSS v4.0 Level 1: Compliant payment processing via Stripe Checkout & verified webhooks
• ✅ GDPR (EU): Aligned under Canada's EU adequacy decision + full data subject rights

1. Split-Tier Serverless Architecture

GetSafeDocs separates public informational browsing from sensitive document operations:
- Public Marketing & Documentation (https://getsafedocs.com): Stateless web tier with zero database credentials, zero session cookies, and zero cloud keys.
- Serverless Application, API & Database (https://getsafedocs.cloud.run): Runs on Google Cloud Run in Toronto (northamerica-northeast2) connected to Google Cloud Firestore (northamerica-northeast2) and Google Cloud Storage (northamerica-northeast2) using keyless IAM service account authentication—eliminating static cloud credentials on disk and external database passwords over the public internet.

2. Authentication & Access Control

• Password Security: Argon2id (64 MB memory [65536], 4 iterations, 3 threads, per-account 16-byte random salt) with password complexity enforcement, Have I Been Pwned (HIBP) k-anonymity breach screening, and legacy bcrypt compatibility.
• Phishing-Resistant Passkeys (FIDO2 / WebAuthn): Hardware security key and biometric login (Touch ID, Face ID, Windows Hello, YubiKey).
• Multi-Factor Authentication (MFA): RFC 6238 TOTP Authenticator Apps (/mfa_setup), Email OTP codes (mfa_codes), and 10 single-use Backup Codes (mfa_backup_codes).
• Bot & Brute-Force Defense: reCAPTCHA Enterprise behavioral risk scoring, database-backed rate limiting, and automatic 60-minute account lockout after 5 consecutive failed login attempts.
• Session & API Key Hardening: 256-bit (64 hex char) CSPRNG database-backed session tokens (user_sessions) with HttpOnly, Secure, SameSite=Lax cookies, IP/User-Agent tracking, and 24-hour sliding expiration refreshed every 30 minutes of activity, plus SHA-256 hashed personal Developer API Keys (gsd_... via X-API-Key / Authorization: Bearer) with configurable expiration and instant revocation.

3. Data Protection & Cloud KMS Encryption

• 100% Canadian Data at Rest: All uploaded files in Google Cloud Storage (northamerica-northeast2) and all 30 application, account, session, and security audit collections in Google Cloud Firestore (northamerica-northeast2) reside exclusively in Toronto, Ontario, Canada.
• Encryption at Rest: All files in Google Cloud Storage (northamerica-northeast2) are encrypted with AES-256-GCM using Google Cloud KMS Customer-Managed Encryption Keys (projects/poised-eye-457101-b8/locations/northamerica-northeast2/keyRings/GetSafeDocs/cryptoKeys/GetSafeDocs_Toronto1), and all database collections in Google Cloud Firestore (northamerica-northeast2) are encrypted at rest with AES-256, Delete Protection, and 7-day Point-in-Time Recovery (PITR).
• Isolated Browser-Sandbox Document Viewing: Senders can enforce Preview-Only (preview_only = 1) mode so recipients view PDFs, Office files, images, and Markdown inside isolated browser viewers (/pdf_viewer, /msview, /markdown_viewer) without raw file download access.
• Direct V4 Signed Transfers: Uploads and downloads occur directly between the browser and Google Cloud Storage over TLS 1.3 using short-lived (15-minute) HMAC-SHA256 V4 Signed URLs.

4. Seven-Layer Upload Validation & Malware Quarantine

Every file uploaded to GetSafeDocs passes through seven security layers:
1. Client Pre-Validation (file size, count, and extension checks)
2. Server Extension Blocklist (blocks 30+ executable/script formats: exe, bat, cmd, msi, dll, js, vbs, sh, ps1, apk, etc.)
3. Tier Quota Enforcement (5 MB Free / 128 MB Premium / 200 MB Enterprise max file size; 10 / 300 / 300 per seat monthly messages)
4. Signed Content-Type Binding (enforced by the GCS V4 PUT signature)
5. Cryptographic Upload Token Verification
6. Post-Upload Magic-Byte MIME Verification
7. QuickSand Cloud Run Malware Analysis (stopmalware.cloud.run) (static & structural analysis of macros, embedded scripts, PDFs, and archives with MD5/SHA1/SHA256/SHA512 hashing)

Four-Bucket Physical Isolation:
- getsafedocs_canada: Verified clean active message files (scan_rating < 2)
- getsafedocs_canada_temp: Ephemeral upload staging (uploads/, doc_requests/) and temporary multi-file ZIP archives (zips/)
- getsafedocs_canada_quarantine: Isolated quarantine bucket for malicious (scan_rating >= 2) uploads
- getsafedocs_canada_quicksand: QuickSand analysis staging (new/<uuid>) and CMEK-encrypted JSON threat analysis reports (report/<sha256>.json)
(Plus getsafedocs_static for non-sensitive public static assets)

5. Audit Logging, Monitoring & Incident Response

• Dual-Layer Audit Trail: Security events are recorded in structured Google Cloud Firestore audit collections (audit_logs, authentication_logs, malware_detections, csp_violations, message_activity) in Toronto (northamerica-northeast2) and centralized Google Cloud Logging.
• Admin Security Consoles: Dedicated dashboards for User & Lockout Management (/admin_panel), Comprehensive Audit Logs (/admin_audit_logs), 7-Day Security Telemetry (/security_recent), Shared IP Correlation (/security_audit), Malware Detections (/malware_detections), Scan Retry Queue (/admin_scan_queue), CSP Violations (/admin_csp_violations), Deleted Accounts (/admin_deleted_accounts), and Cloud IAM Health (/admin_wif_health).
• Disaster Recovery: Firestore Delete Protection, 7-day Point-in-Time Recovery (PITR), and automated daily backups in Toronto (RTO: 4 hours, RPO: 24 hours).

Contact & Documentation

• Contact Portal: https://getsafedocs.cloud.run/contact
• Application & API Base URL: https://getsafedocs.cloud.run
• Website: https://getsafedocs.com
• Security Documentation: https://getsafedocs.com/security-documentation.html
• User & API Documentation: https://getsafedocs.com/user-documentation.html

Document Classification: Public
Copyright: © 2026 GetSafeDocs Inc. All rights reserved.