Security Documentation

Comprehensive technical documentation on GetSafeDocs security architecture, compliance, and threat protection

100% Canadian Data at Rest

Serverless Cloud Run compute, Cloud Firestore database collections, KMS keys, and isolated Cloud Storage buckets hosted exclusively in Google Cloud's Toronto region (northamerica-northeast2).

Bank-Grade Cryptography

TLS 1.3 in transit, AES-256-GCM with Cloud KMS CMEK at rest, Argon2id password hashing, and FIDO2 Passkeys.

QuickSand Cloud Run Scanner

Every upload passes 7 validation layers and real-time static/structural malware analysis with physical 4-bucket quarantine isolation.

Available Documentation

Security Architecture White Paper

Comprehensive technical white paper detailing GetSafeDocs' split-tier Google Cloud Run architecture, Cloud KMS CMEK encryption, isolated browser-sandbox document viewing, FIDO2/WebAuthn passkey authentication, QuickSand malware quarantine, and compliance frameworks.

v2.0 (Cloud Run) Technical Enterprise & Gov Ready

Best for: CISOs, Security Architects, Enterprise Evaluators, Compliance Officers, Auditors

Covers:
  • Split-tier serverless Google Cloud Run architecture, native Cloud Firestore & keyless Cloud IAM
  • 100% Canadian data residency at rest — files & database in Toronto (`northamerica-northeast2`)
  • Authentication & access control (FIDO2 Passkeys, Argon2id, TOTP/Email MFA, OAuth 2.0)
  • Encryption (TLS 1.3, AES-256-GCM with Cloud KMS CMEK, V4 Signed URLs)
  • Seven-layer upload defense, QuickSand Cloud Run scanner & 4-bucket isolation
  • OWASP Top 10 (99/100) compliance & application security controls
  • Dual-layer Cloud Firestore & Google Cloud Logging audit trail + 9 admin security consoles
  • PIPEDA, GDPR, SOC 2 Type II, ISO/IEC 27001:2022 alignment
Read Online Download MD

OWASP Top 10 (2021) Security Assessment

Detailed evaluation of GetSafeDocs against the OWASP Top 10 web application security risks on Google Cloud Run, including specific code-level controls, verification details, and compliance ratings for all 10 categories.

Score: 99/100 (A+) Pass 10/10 Technical Assessment

Best for: Penetration Testers, Security Auditors, Technical Evaluators, DevSecOps Teams

Results Summary:
  • A01: Broken Access Control - 99/100
  • A02: Cryptographic Failures - 99/100
  • A03: Injection - 100/100 ⭐
  • A04: Insecure Design - 99/100
  • A05: Security Misconfiguration - 99/100
  • A06: Vulnerable Components - 97/100
  • A07: Authentication Failures - 100/100 ⭐
  • A08: Data Integrity Failures - 98/100
  • A09: Logging Failures - 99/100
  • A10: SSRF - 99/100
Read Online Download MD

Security Summary (Quick Reference)

Concise 10-page overview of GetSafeDocs security features, compliance status, and answers to common security questions. Ideal for quick evaluations and executive briefings.

10 Pages Executive Summary Quick Read

Best for: Executives, Procurement Teams, Quick Security Reviews, Customer Inquiries

Includes:
  • At-a-glance security ratings & compliance matrix
  • Key security features explained in plain language
  • Security by account tier comparison
  • Frequently asked security questions (FAQ)
  • Third-party service providers & certifications
Read Online Download MD

Security Commitment & Continuous Improvement

Our transparent commitment to continuous security enhancement, upcoming security features, compliance roadmap (SOC 2, ISO 27001), and customer security partnership program.

Public Roadmap Transparency Future Plans

Best for: Prospective Enterprise Customers, Long-term Partners, Compliance Planning

Highlights:
  • Delivered milestones: Serverless Cloud Run & Cloud Firestore migration, Keyless IAM, FIDO2 Passkeys, HIBP screening
  • 2027 Enterprise security roadmap (Enforced MFA/Passkeys, Scoped PATs, Signed Webhooks, SAML/OIDC SSO)
  • SOC 2 Type II and ISO/IEC 27001:2022 certification timeline
  • Responsible disclosure program & 24-hour SLA
  • Customer security partnership commitments
Read Online Download MD

Supported File Types & Restrictions

Detailed list of allowed and forbidden file types across Free, Premium, and Enterprise tiers, including security rationale and MIME type validation details.

Reference All Users
View File Types

Compliance & Standards

Regulatory Compliance
  • PIPEDA (Canada): Full compliance with Canadian federal privacy law
  • GDPR (EU): Aligned with European data protection principles (Canada adequacy decision)
  • Data Residency: 100% Canadian hosting in Toronto (`northamerica-northeast2`)
Security Standards
  • OWASP Top 10 (2021): 99/100 (A+) compliance score — Pass 10/10
  • FIDO2/WebAuthn: Phishing-resistant Passkey authentication
  • PCI DSS v4.0 Level 1: Payment processing via Stripe Checkout & verified webhooks
Infrastructure Certifications (Google Cloud Platform — Toronto)

GetSafeDocs runs on Google Cloud Run, Google Cloud Firestore, and Google Cloud Storage in Toronto (`northamerica-northeast2`), which maintains: ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, PCI DSS, FedRAMP, and CSA STAR certifications.

Security Inquiries & Responsible Disclosure

Enterprise Security Questionnaires

Need custom security documentation, vendor risk assessments, or compliance questionnaires completed?

Contact Portal: Submit Enterprise Inquiry
Response Time: Within 1 business day

Report a Security Vulnerability

Discovered a security issue? We appreciate responsible disclosure from the security community.

Disclosure Portal: Report via Security Contact Form
Acknowledgment SLA: Within 24 hours

Contact Our Team View Enterprise Plans