Back Print Download Markdown

GetSafeDocs User Guide

Welcome to GetSafeDocs, the enterprise-grade secure document exchange and intake platform hosted in Toronto, Ontario, Canada (northamerica-northeast2). This guide covers account creation, passkey and two-factor authentication, sending malware-scanned documents, managing recipients and activity tracking, creating document request portals, and security best practices.

Table of Contents

  1. Getting Started
  2. Account & Profile Management
  3. Sending Documents
  4. Recipient Management & Outbox Tracking
  5. Receiving, Previewing & Replying to Documents
  6. Document Requests (Client Upload Portals)
  7. Mailing Lists
  8. Passkeys, Two-Factor Authentication (2FA) & API Keys
  9. Account Tiers, File Types & Quotas
  10. Security Features
  11. Troubleshooting
  12. Best Practices

Getting Started

Creating Your Account

  1. Visit https://getsafedocs.cloud.run/register (or click Sign Up on https://getsafedocs.com).
  2. Enter your email address and create a strong password (minimum 8 characters), or choose Sign in with Google for one-click OAuth 2.0 registration.
  3. Accept the Terms of Service and Privacy Policy and submit the registration form.
  4. Check your inbox for the verification email and click the verification link (or enter the verification code on https://getsafedocs.cloud.run/verify_email) to activate your account.
  5. Didn't receive the email? Check your spam/junk folder or request a fresh code at https://getsafedocs.cloud.run/resend_verification (a 60-second cooldown applies between resends).
  6. Corporate Auto-Enrollment: If your employer has registered your company email domain in Enterprise Admin, registering with your work email address automatically enrolls you in your organization's Enterprise plan upon verification.

Logging In

Sign in at https://getsafedocs.cloud.run/login using any of the following methods:
- Passkey (FIDO2 / WebAuthn): Sign in without a password using Touch ID, Face ID, Windows Hello, or a hardware security key (such as a YubiKey).
- Email & Password: Standard login protected by Argon2id hashing, brute-force rate limiting, and optional 2FA (Authenticator App or Email OTP).
- Sign in with Google: One-click Google OAuth 2.0 authentication.
- Document Access Token (No Account Required): If you received an access token (token) to view a shared document or upload to a Document Request, enter it directly on https://getsafedocs.com or https://getsafedocs.cloud.run/access_document without needing an account.

Account Management

Profile & Usage Dashboard

Navigate to Profile (https://getsafedocs.cloud.run/profile) when signed in to view your real-time account status and manage your settings:

  • Plan & Quota Summary:
  • Account Status: Current tier (Free, Premium, or Enterprise Plan).
  • Messages Remaining This Month: Remaining monthly messages out of your tier allowance (10 Free / 300 Premium / 300 Enterprise).
  • Maximum File Size: Per-file upload cap (5 MB Free / 128 MB Premium / 200 MB Enterprise).
  • Maximum Files per Message: Attachment count cap (1 Free / 20 Premium / 20 Enterprise).
  • Maximum Recipients per Message: Recipient cap (2 Free / 30 Premium / 100 Enterprise).
  • Data Usage This Month: Total data Sent (MB) and Viewed/Received (MB) compared against your monthly received data allowance (100 MB Free / 3,000 MB Premium / 5,000 MB Enterprise).
  • Subscription & Billing Management:
  • Upgrade Your Plan: Start a 7-day free trial of Premium or subscribe to Premium/Enterprise via Stripe Checkout at https://getsafedocs.cloud.run/pricing.
  • Manage Subscription: Premium subscribers and Enterprise Company Admins can open the Stripe Billing Portal or click Cancel Subscription (which maintains access through the end of the current billing period).
  • Deleting Your Account:
  • Under User Account Information, clicking Delete Account permanently deletes your account, cancels any active Stripe subscription immediately, purges your sent messages and uploaded files from Google Cloud Storage, and logs you out.

Password Management

  • Changing or Setting a Password:
  • Go to Profile (https://getsafedocs.cloud.run/profile) → User Account Information.
  • Click Change Password (or Set Password if you originally signed up via Google OAuth) to open https://getsafedocs.cloud.run/set_password.
  • Enter your new password (minimum 8 characters) and confirm. Changing your password automatically invalidates all other active sessions.
  • Resetting a Forgotten Password:
  • Click Forgot your password? on the login page (https://getsafedocs.cloud.run/reset_password).
  • Enter your account email address to receive a time-limited cryptographic reset link.
  • Follow the link to set a new password.

Sending Documents

How to Send a Secure Document Package

  1. Sign in and click Send Documents (https://getsafedocs.cloud.run/send_message).
  2. Upload Files (Optional):
  3. Click Choose Files or drag and drop files into the upload area.
  4. Each file uploads directly from your browser to Google Cloud Storage in Toronto, Ontario (northamerica-northeast2) over TLS 1.3 using a short-lived V4 Signed URL (get_signed_url → PUT → process_cloud_upload).
  5. Progress is tracked in real time: 0–45% direct upload, 45–55% server verification, and 55–100% QuickSand Malware Analysis.
  6. Once scanning completes, each file displays a security badge (Clean, Suspicious, or Malicious) and a View Malware Scan Results button (/scan_report?uuid=...).
  7. Note: You can also send a secure text message without attaching any files.
  8. Configure Preview-Only Mode (Optional):
  9. Check Preview Only - Recipients can only view supported documents in sandbox, no downloads allowed to let recipients read documents inside GetSafeDocs' browser viewer while blocking raw file downloads.
  10. Compose Subject & Message:
  11. Enter a Subject (required, up to 200 characters) and an optional Message body (up to 5,000 characters).
  12. Enable Activity Notifications (Optional):
  13. Check Notify me when recipients view or download this message to receive an automatic email alert (including timestamp, recipient email, file name, IP address, and User-Agent) whenever a recipient views your message, previews a file in the sandbox, or downloads an attachment.
  14. Add Recipients:
  15. Comma-Separated Emails: Enter recipient email addresses (e.g., alice@example.com, bob@example.com) up to your plan's per-message limit (2 Free / 30 Premium / 100 Enterprise).
  16. Or Select a Mailing List (Premium & Enterprise): Choose one of your saved recipient groups from the Or Select a Mailing List dropdown (use the 🔄 button to refresh lists on the fly).
  17. Manual Access Code: Leave both recipient fields blank to generate a single manual access token that you can share yourself via another channel.
  18. Set Message Expiry (Premium & Enterprise):
  19. Free tier messages expire after 1 Month (Default).
  20. Premium and Enterprise users can select: 1 Day, 3 Days, 1 Week, 2 Weeks, 1 Month (Default), 2 Months, 3 Months, 6 Months, or 1 Year.
  21. Important: When a message expires, its attached files and message body are permanently purged from storage and cannot be recovered.
  22. Click Send Message.

Recipient Management

Managing Delivery & Sharing Tokens

Immediately after sending a message (or by clicking Manage Recipients from your Outbox), you arrive at Recipient Management (https://getsafedocs.cloud.run/recipient_management?message_id=...):

  • Account Holders (Account Holder badge):
  • Recipients who already have a verified GetSafeDocs account are auto-notified immediately when the message is created.
  • For maximum security, their notification email does not contain an external access token; instead, the message and attachments appear directly inside their authenticated GetSafeDocs Inbox (/inbox).
  • External Recipients (Non-Account Holders):
  • External email addresses have a checkbox in the Send Email column (checked by default; use Select All / Deselect All to toggle).
  • Click Send Selected Emails (or Resend Selected Emails) to email each selected recipient a notification containing their unique ID Token and message details.
  • Manual Token & URL Sharing:
  • Every recipient row (including manual access codes created when no email was entered) provides one-click Copy buttons for:
    • Token ID: An 8-character unambiguous access code (e.g., a7k9m2p4) that the recipient can enter on https://getsafedocs.com.
    • Full URL: Direct link (https://getsafedocs.cloud.run/access_document?token=...) to open the document access page with the token pre-filled.

Outbox, Message Details & Activity Tracking

Open Outbox (https://getsafedocs.cloud.run/outbox) to manage all messages you have sent:

  • Message Details (/message_details?message_id=...):
  • View message content, attached files, individual Malware Scan Reports, recipient read status, and threaded replies.
  • Extend Message Expiry (Premium & Enterprise): Before a message expires, you can extend its expiration date (up to 1 year) directly from the Message Details page.
  • Delete Message: Permanently delete a sent message and its stored files at any time.
  • Message Activity & Tracking Logs (/message_activity_details?message_id=...):
  • Inspect a complete chronological audit trail of every event on your message: message_sent, message_view, file_view, office_view, file_download, and file_download_zip, including UTC timestamps, recipient attribution, IP addresses, and User-Agent details.

Receiving Documents

You do not need a GetSafeDocs account to view or download documents shared with you:

  1. Visit https://getsafedocs.com (or https://getsafedocs.cloud.run/access_document) and enter your Access Token, or click the direct link provided by the sender.
  2. Check the consent box agreeing to the Terms of Service, Privacy Policy, and Cookie Policy, then click Access Document.
  3. Review the sender's message and the Malware Scan Result badge next to each file. Click View Malware Scan Results (/scan_report?uuid=...) to verify the file's SHA-256 hash, file type, and threat score before opening.

Safe Preview in Sandbox vs. Downloading

  • Safe Preview in Sandbox:
  • Click Preview / View to inspect files safely in your browser without downloading potentially untrusted files to your local disk:
    • PDF Documents (.pdf): Rendered in the built-in sandboxed PDF viewer (/pdf_viewer).
    • Microsoft Office Files (.doc, .docx, .xls, .xlsx, .ppt, .pptx): Rendered in the full-size sandboxed Office viewer (/msview).
    • Markdown Files (.md): Rendered with sanitized HTML formatting (/markdown_viewer).
    • Images & Text Files: Displayed directly via short-lived signed viewer streams.
  • Downloading Files:
  • If the sender has not enabled Preview Only mode, click Download on any individual file or click Download All as ZIP (/download_zip) to download all attachments in a single archive.

Using Your Inbox & Replying

  • Inbox (https://getsafedocs.cloud.run/inbox):
  • Registered users can view all received messages in one place, see unread badges, filter active messages, and click Archive to organize completed threads.
  • When accessing a message from your logged-in Inbox, Terms consent is applied automatically for seamless viewing.
  • Replies & Threaded Conversations:
  • Recipients can submit a reply directly from the document access page (/access_document) or message details page (/message_details), which notifies the sender by email.
  • Free Tier Users: Can send an initial reply (up to 2,000 characters) to any message they receive.
  • Premium & Enterprise Users: Can participate in full multi-turn threaded conversations (replying to replies) and mark replies as read.

Document Requests

Document Requests (available on Premium and Enterprise plans) let you create customizable, token-protected upload portals so clients, vendors, applicants, or partners can securely submit files and messages to you—without needing a GetSafeDocs account.

Creating a Document Request Page

  1. Navigate to Document Requests (https://getsafedocs.cloud.run/document_requests) and click Create New Request.
  2. Configure your request in the modal:
  3. Request Name (Required): A clear title identifying the request (e.g., Client Onboarding Documents).
  4. Expiry (days): Number of days the portal remains active (1–365, default 30), or enter 0 for no expiry.
  5. Description (Optional): Instructions explaining which documents the submitter should upload.
  6. Send Notification To (Optional): Comma-separated email addresses to immediately email the upload link and access token upon creation (up to your plan's recipient limit).
  7. Max File Size (MB): From 1 MB up to your tier maximum (128 MB Premium / 200 MB Enterprise).
  8. Max Files per Submission: From 1 up to 20 files per submission.
  9. Allowed File Types (Optional): Comma-separated list of allowed extensions (e.g., pdf,doc,docx,jpg,png). Leave blank to allow all file types supported by your plan.
  10. Required Fields To Be Provided By The Sender: Choose whether submitters must provide their Email address, Subject, and/or Message.
  11. Allow multiple submissions from the same person: Enabled by default so submitters can upload additional batches if needed.
  12. Click Create Request.

Sharing & Managing Document Requests

From your Document Requests table (/document_requests), each request provides quick actions:
- Copy Token ID (📋) & Copy Full URL (🔗): Copy the 12-character unambiguous request token or the direct upload link (https://getsafedocs.cloud.run/document_request_upload?token=...).
- View Details & Submissions (👁️ / /document_request_view?id=...): Inspect every submission, see submitter details, view malware scan reports, and preview or download submitted files.
- Test Upload (⬆️): Open the live upload portal in a new tab to preview the submitter experience.
- Share Request (📤): Email the upload portal link and access code to additional recipients at any time.
- Activate / Deactivate (⏸️ / ▶️): Temporarily pause a request portal to stop new uploads without deleting existing submissions, and reactivate it whenever needed.
- Delete (🗑️): Permanently delete the document request along with all associated submission messages and stored files.

Mailing Lists

Mailing Lists (https://getsafedocs.cloud.run/mailing_lists, available on Premium and Enterprise plans) make it easy to send documents to recurring groups of recipients:

  1. Open Mailing Lists (/mailing_lists) and click Create New List.
  2. Enter a List Name, an optional Description, and paste your Recipients (email addresses separated by commas, spaces, or newlines).
  3. Click Create List.
  4. You can Edit or Delete lists at any time, and select any saved list directly from the Or Select a Mailing List dropdown on the Send Documents page (/send_message).

Two-Factor Authentication (2FA)

GetSafeDocs supports both Phishing-Resistant Passkeys (FIDO2 / WebAuthn) for all users and Two-Factor Authentication (2FA) for Premium and Enterprise users.

Passkeys (All Account Tiers)

Passkeys let you sign in with a biometric sensor (Touch ID, Face ID, Windows Hello) or hardware security key (YubiKey) instead of typing a password:

  1. Go to Profile (https://getsafedocs.cloud.run/profile) and expand User Account Information.
  2. Under Passkeys, click Add Passkey.
  3. Enter a descriptive name for your device (e.g., MacBook Touch ID or Work YubiKey) and complete your browser/device prompt.
  4. Your registered passkeys are listed with creation and last-used dates, and can be Renamed (✏️) or Deleted (🗑️) at any time.

Two-Factor Authentication (Premium & Enterprise)

  1. Go to Profile (https://getsafedocs.cloud.run/profile) → User Account Information and click Enable Two-Factor Authentication (or visit https://getsafedocs.cloud.run/mfa_setup).
  2. Choose your preferred verification method:
  3. Authenticator App (TOTP — Recommended):
    1. Select Authenticator App and scan the on-screen QR code using Google Authenticator, Authy, 1Password, or Microsoft Authenticator (or enter the manual secret key).
    2. Enter the 6-digit verification code from your app and click Verify and Enable.
    3. Save Your Backup Codes: Record the one-time backup codes displayed upon completion in a safe place so you can sign in if you ever lose your device.
  4. Email Verification:
    1. Select Email Verification to receive a one-time verification code at your account email address.
    2. Enter the code and click Verify and Enable.
  5. Changing or Removing 2FA: Return to /mfa_setup at any time to switch between Authenticator App and Email Verification or to disable 2FA (requires verifying a code from your current MFA method first).

Developer API Keys & MCP Server (All Account Tiers)

You can generate personal API Keys directly from your Profile to automate document sharing, uploads, document requests, and tracking via the GetSafeDocs REST API or connect AI assistants via the Model Context Protocol (MCP) Server (https://getsafedocs.cloud.run/mcp)—without needing a password or browser session:

  1. Go to Profile (https://getsafedocs.cloud.run/profile) and expand User Account Information.
  2. Under Developer API Keys & MCP Server, enter a descriptive key name (e.g., CLI Script, Claude Desktop, or CI/CD Pipeline), choose an optional expiration (Never expires, 30 days, 90 days, or 1 year), and click Generate API Key.
  3. Copy your gsd_... key immediately using the Copy Key button (for security, only the SHA-256 hash is stored and the full key is shown only once).
  4. Pass your key in the X-API-Key: gsd_... or Authorization: Bearer gsd_... header when calling any https://getsafedocs.cloud.run/api/* REST endpoint or https://getsafedocs.cloud.run/mcp MCP server. You can view last-used timestamps and Revoke any key at any time from your Profile.

Account Tiers and Features

Complete Plan Comparison

Feature / Quota Free Tier Premium Tier Enterprise Tier
Max File Size 5 MB per file 128 MB per file 200 MB per file
Max Files per Message 1 file 20 files 20 files
Monthly Sent Messages 10 / month 300 / month 300 / month per seat
Max Recipients per Message 2 recipients 30 recipients 100 recipients
Monthly Viewed/Received Data 100 MB / month 3,000 MB (3 GB) / month 5,000 MB (5 GB) / month per seat
Message Expiry 1 Month (Default) Configurable: 1 Day – 1 Year Configurable: 1 Day – 1 Year
Extend Message Expiry — ✅ Up to 1 Year before expiry ✅ Up to 1 Year before expiry
Supported File Types 61 formats 82 formats (+21 media/design) 82 formats (+ custom exceptions)
Real-Time Malware Scanning ✅ Included ✅ Included ✅ Included
Safe Preview in Sandbox ✅ Included ✅ Included ✅ Included
Preview-Only (No-Download) Mode ✅ Included ✅ Included ✅ Included
Passkey Authentication (WebAuthn) ✅ Included ✅ Included ✅ Included
Developer REST API & API Keys ✅ Included ✅ Included ✅ Included
Two-Factor Auth (TOTP / Email) — ✅ Included ✅ Included
Document Request Portals — ✅ Unlimited ✅ Unlimited
Mailing Lists — ✅ Included ✅ Included
Advanced Activity & IP Tracking — ✅ Included ✅ Included
Threaded Reply Conversations Initial reply only ✅ Full back-and-forth threads ✅ Full back-and-forth threads
Enterprise Admin Console — — ✅ Included (sold in 5-seat blocks)
Auto-Enrollment Email Domains — — ✅ Included
Dedicated Cloud / BYOC / CMEK — — ✅ Available on request

Supported & Forbidden File Types

For the live, code-generated reference of every extension and MIME mapping, visit Supported File Types (also available in JSON and Markdown).

  • Free Tier (61 Supported Extensions):
  • Documents (12): .pdf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .txt, .rtf, .odt, .ods, .odp
  • Images (8): .jpg, .jpeg, .png, .gif, .bmp, .webp, .tiff, .svg
  • Archives (5): .zip, .rar, .7z, .tar, .gz
  • Text, Data & Code Files (36): .sql, .csv, .json, .xml, .html, .htm, .css, .md, .ini, .conf, .cfg, .yaml, .yml, .log, .py, .rb, .php, .pl, .ps1, .go, .rs, .cpp, .c, .h, .java, .scala, .kt, .swift, .dart, .ts, .tsx, .vue, .svelte, .env
  • Premium & Enterprise Additional Types (+21 Extensions, 82 Total):
  • Video Files (8): .mp4, .avi, .mov, .wmv, .flv, .webm, .mkv, .m4v
  • Audio Files (6): .mp3, .wav, .flac, .aac, .ogg, .m4a
  • Professional Design Files (7): .psd, .ai, .eps, .indd, .sketch, .fig, .xd
  • Forbidden File Types (34 Permanently Blocked Across All Tiers):
  • Executables & Libraries: .exe, .bat, .cmd, .com, .msi, .scr, .pif, .cpl, .dll, .ocx, .gadget, .app, .run, .bin
  • Executable Scripts: .vbs, .vbe, .vb, .vbscript, .js, .jse, .wsh, .wsf, .ws, .sh
  • System, Shortcut & Mobile Packages: .lnk, .reg, .inf, .ins, .inx, .job, .apk, .ipa
  • Enterprise Exceptions: Enterprise organizations with legitimate business requirements to exchange specific blocked file types can request a security review and exception via Contact Support.

Security Features

1. Seven-Layer Upload Validation & QuickSand Malware Analysis

Every uploaded file passes through seven sequential security checks:
1. Client-side extension, file count, and size validation
2. Server-side forbidden extension blocklist check
3. Account tier & quota enforcement
4. V4 Signed URL Content-Type cryptographic binding
5. Upload session token verification (anti-replay)
6. Post-upload magic-byte MIME content inspection
7. QuickSand Cloud Run (stopmalware.cloud.run) static & structural malware analysis (inspecting Office macros, PDF streams, archives, and embedded payloads)

Security Ratings & Four-Bucket Quarantine Isolation:
- Clean (Rating 0) / Low-Risk (Rating 1): Staged in getsafedocs_canada_temp during upload and moved to verified active storage in getsafedocs_canada upon message submission, available for recipient preview/download.
- Malicious (Rating >= 2): Automatically isolated in getsafedocs_canada_quarantine and blocked from recipient download. Detailed cryptographic hashes (MD5, SHA-1, SHA-256, SHA-512) and threat findings are stored in getsafedocs_canada_quicksand and viewable in the Malware Scan Report (/scan_report).

2. Encryption & 100% Canadian Data Residency

  • At Rest (100% in Canada): All data at rest—both uploaded files in Google Cloud Storage (encrypted with AES-256-GCM and Google Cloud KMS Customer-Managed Encryption Keys [CMEK]) and all account, message, recipient, and activity records in Google Cloud Firestore (encrypted with AES-256, Delete Protection, and Point-in-Time Recovery)—resides exclusively in Toronto, Ontario, Canada (northamerica-northeast2).
  • In Transit: Modern HTTPS (TLS 1.3) with HSTS preload and direct browser-to-GCS signed transfers.
  • Compliance: Engineered for PIPEDA compliance, GDPR alignment (under Canada's EU adequacy status), SOC 2 Type II, and ISO/IEC 27001 controls, achieving a 99/100 OWASP Top 10 security rating.

3. Account & Session Protection

  • Brute-Force Lockout: Accounts automatically lock for 60 minutes after 5 consecutive failed login attempts.
  • Sliding Session Timeout: Authenticated browser sessions use 256-bit database-backed tokens with a 24-hour sliding expiration (refreshed automatically after 30 minutes of activity).
  • Disposable Email Filtering: Known disposable/throwaway email domains are blocked from registration to prevent platform abuse.

Troubleshooting

  • "File upload failed" or "File type not allowed":
  • Check your plan's per-file size limit (5 MB Free / 128 MB Premium / 200 MB Enterprise) and attachment count limit (1 Free / 20 Premium & Enterprise).
  • Verify the file extension is supported for your tier on the Supported File Types page and that the file's actual content matches its extension.
  • "You have reached your monthly message limit" or recipient cannot view file:
  • Check Profile (/profile) to see your remaining monthly messages (10 Free / 300 Premium & Enterprise) and your monthly viewed/received data usage (100 MB Free / 3,000 MB Premium / 5,000 MB Enterprise). Upgrade your plan if you need higher capacity.
  • "Invalid or expired token":
  • Verify that you copied the complete 8-character message token (or 12-character document request token).
  • Confirm with the sender that the message or document request has not passed its expiration date or been deactivated.
  • "Account temporarily locked":
  • After 5 consecutive failed login attempts, your account locks for 60 minutes. Wait 60 minutes or use Forgot Password to reset your password.

Best Practices

  1. Register a Passkey & Enable 2FA: Add a biometric or hardware Passkey in Profile (/profile) and enable Authenticator App 2FA (/mfa_setup) on Premium and Enterprise accounts.
  2. Use Safe Preview Before Downloading: When receiving unexpected files, always inspect the Malware Scan Report and use Safe Preview in Sandbox before downloading files to your device.
  3. Enable Preview-Only Mode for Sensitive Records: Check Preview Only when sending confidential documents that recipients need to read but should not download locally.
  4. Deliver to Registered Inboxes When Possible: Encourage frequent collaborators to create a free GetSafeDocs account so documents are delivered directly to their authenticated Inbox without external token emails.
  5. Use Document Request Portals for Client Intake: Replace insecure email attachments with token-protected Document Request portals (/document_requests) whenever collecting tax, legal, HR, financial, or KYC documents.

Need Help?