# GetSafeDocs Security Architecture
## Enterprise & Government Security White Paper

**Version:** 1.0  
**Date:** October 2025  
**Classification:** Public  
**Document Owner:** CyberAGroup Inc.

---

## Executive Summary

GetSafeDocs is a secure document sharing platform built with enterprise-grade security controls designed to meet the stringent requirements of government agencies and large organizations. This white paper provides a comprehensive technical overview of GetSafeDocs' security architecture, compliance posture, and operational security practices.

### Key Security Highlights

- **98/100 OWASP Top 10 2021 Compliance Score** - Top 0.1% of web applications
- **Security Architecture** designed to meet SOC 2 Type II, ISO/IEC 27001, and PCI-DSS Level 1 requirements
- **100% SQL Injection Protection** through prepared statements
- **AES-256 Encryption** at rest with optional CMEK for enterprise deployments
- **Canadian Data Residency** with PIPEDA compliance
- **Real-Time Threat Detection** with automated malware scanning and quarantine
- **Comprehensive Audit Logging** for security monitoring and compliance

### Certifications & Compliance Readiness

While GetSafeDocs is currently designed to meet (not yet certified for) the following frameworks, our security controls are implementation-ready for:

| Framework | Status | Score |
|-----------|--------|-------|
| OWASP Top 10 2021 | **Assessed** | 98/100 |
| SOC 2 Type II | Architecture Ready | Meets Requirements |
| ISO/IEC 27001 | Controls Implemented | Meets Requirements |
| PCI-DSS Level 1 | Security Standards Met | Meets Benchmarks |
| PIPEDA (Canada) | **Compliant** | Active |
| GDPR (EU) | Controls Aligned | Meets Requirements |

---

## Table of Contents

1. [Platform Overview](#platform-overview)
2. [Security Architecture](#security-architecture)
3. [Data Protection](#data-protection)
4. [Access Control & Authentication](#access-control--authentication)
5. [Threat Protection](#threat-protection)
6. [Compliance & Governance](#compliance--governance)
7. [Operational Security](#operational-security)
8. [Privacy & Data Residency](#privacy--data-residency)
9. [Incident Response](#incident-response)
10. [Security Monitoring & Logging](#security-monitoring--logging)
11. [Technical Specifications](#technical-specifications)
12. [Third-Party Assessments](#third-party-assessments)
13. [Contact Information](#contact-information)

---

## Platform Overview

### What is GetSafeDocs?

GetSafeDocs is a secure document sharing platform that enables organizations to:
- Share sensitive documents without email attachment risks
- Receive documents from external parties with malware protection
- Maintain comprehensive audit trails for compliance
- Control access to shared documents with granular permissions
- Meet regulatory requirements for secure file transfer

### Core Use Cases

**Government Agencies:**
- Secure constituent document collection
- Inter-agency file sharing
- FOIPOP/ATI request handling
- Contract and proposal submissions

**Enterprise Organizations:**
- Customer document intake (KYC, applications, forms)
- Secure vendor file exchange
- Legal document sharing
- Financial document transfers
- HR and payroll document collection

**Deployment Options:**
- **Standard (Multi-Tenant)**: Shared infrastructure with logical separation, platform-managed encryption
- **Dedicated Cloud**: Customer's own GCP project with optional CMEK
- **On-Premise**: Self-hosted within customer's data center
- **Hybrid**: Combination of cloud and on-premise components

### Deployment Models

GetSafeDocs offers flexible deployment models to meet different security and compliance requirements:

#### Standard Deployment (Multi-Tenant)
**Best for:** Small to medium businesses, standard compliance needs

**Characteristics:**
- Shared infrastructure with logical separation between customers
- Data stored in Toronto, Ontario, Canada (GCP northamerica-northeast2)
- Encryption at rest using AES-256 with platform-managed keys
- All security controls outlined in this white paper apply
- Fastest deployment (immediate availability)
- Most cost-effective option
- Managed updates and patching

**Data Isolation:**
- Database: Separate accounts table with encrypted passwords and tier-based access control
- Storage: Logically separated file paths with access validation
- Sessions: Unique tokens per user with IP/User-Agent validation
- Audit Logs: User-specific with access controls

#### Enterprise Dedicated Deployment
**Best for:** Large enterprises, regulated industries, specific compliance requirements

**Characteristics:**
- Dedicated GCP project or on-premise infrastructure
- Customer-selectable region(s) for data residency
- Customer-managed encryption keys (CMEK) available
- Dedicated compute and storage resources
- Custom security policies and controls
- Enhanced SLA options
- Dedicated support team

**Additional Options:**
- Bring Your Own Cloud (BYOC) - integrate with existing GCP/AWS/Azure
- On-premise deployment within customer's data center
- Hybrid deployment (some components cloud, some on-premise)
- Multi-region deployment for disaster recovery
- Custom backup and retention policies

**CMEK Benefits:**
- Customer maintains full control over encryption keys
- Keys stored in customer's own Google Cloud KMS
- Customer can revoke access at any time
- Enhanced audit trail for key usage
- Meets requirements for data sovereignty regulations

### Architecture Principles

GetSafeDocs is built on five core security principles:

1. **Defense in Depth** - Multiple layers of security controls
2. **Zero Trust** - Verify every access, every time
3. **Least Privilege** - Minimum necessary access rights
4. **Fail Secure** - Default to secure state on errors
5. **Comprehensive Logging** - Full audit trail for all actions

---

## Security Architecture

### High-Level Architecture

```
┌─────────────────────────────────────────────────────────────────┐
│                         User Layer                               │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐       │
│  │ Browser  │  │  Mobile  │  │   API    │  │  Admin   │       │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬─────┘       │
└───────┼─────────────┼─────────────┼─────────────┼──────────────┘
        │             │             │             │
        └─────────────┴─────────────┴─────────────┘
                       │
        ┌──────────────▼──────────────────────────────────────────┐
        │          TLS 1.3 Encrypted Transport                     │
        └──────────────┬──────────────────────────────────────────┘
                       │
        ┌──────────────▼──────────────────────────────────────────┐
        │              Application Layer (PHP 8.x)                 │
        │  ┌────────────────────────────────────────────────┐    │
        │  │ • Session Management (DB-backed tokens)        │    │
        │  │ • CSRF Protection (Database tokens)            │    │
        │  │ • Rate Limiting (IP & User-based)              │    │
        │  │ • Input Sanitization (Context-aware)           │    │
        │  └────────────────────────────────────────────────┘    │
        └──────────────┬──────────────────────────────────────────┘
                       │
        ┌──────────────▼──────────────────────────────────────────┐
        │              Business Logic Layer                        │
        │  ┌────────────────────────────────────────────────┐    │
        │  │ • Authentication (Argon2id + MFA)              │    │
        │  │ • Authorization (Multi-tier access control)     │    │
        │  │ • File Upload (Multi-layer validation)         │    │
        │  │ • Malware Scanning (QuickSand integration)     │    │
        │  │ • Audit Logging (Comprehensive tracking)       │    │
        │  └────────────────────────────────────────────────┘    │
        └──────────────┬──────────────────────────────────────────┘
                       │
        ┌──────────────▼──────────────────────────────────────────┐
        │               Data Layer                                 │
        │  ┌──────────────┐          ┌──────────────┐            │
        │  │   Database   │          │ Cloud Storage│            │
        │  │  (MySQL 8.x) │          │  (GCP Toronto)│            │
        │  │              │          │               │            │
        │  │ • Encrypted  │          │ • AES-256     │            │
        │  │   connections│          │ • CMEK        │            │
        │  │ • Prepared   │          │ • Versioning  │            │
        │  │   statements │          │ • Lifecycle   │            │
        │  └──────────────┘          └──────────────┘            │
        └─────────────────────────────────────────────────────────┘
```

### Security Layers

#### Layer 1: Network Security
- **TLS 1.3 Encryption** for all communications
- **HSTS (HTTP Strict Transport Security)** with 1-year max-age and preload
- **Certificate-based authentication** with forward secrecy
- **Cloudflare IPv4/IPv6 proxy detection** for accurate IP tracking

#### Layer 2: Application Security
- **CSRF Protection** with database-backed tokens and automatic expiration
- **Rate Limiting** on authentication (5/15min), registration (3/hour), and file uploads
- **Input Validation** with context-aware sanitization (SQL, HTML, URL, filename, etc.)
- **Output Encoding** using `htmlspecialchars()` with ENT_QUOTES
- **SQL Injection Prevention** via 100% prepared statement usage
- **XSS Protection** through Content Security Policy and input sanitization

#### Layer 3: Data Security
- **Encryption at Rest**: AES-256 with customer-managed keys (CMEK)
- **Encryption in Transit**: TLS 1.3 with strong cipher suites
- **Password Hashing**: Argon2id (memory: 64MB, iterations: 4, parallelism: 2)
- **Session Tokens**: 64-byte cryptographically secure random tokens
- **Data Residency**: Toronto, Ontario, Canada (northamerica-northeast2)

#### Layer 4: Access Control
- **Multi-Factor Authentication** (TOTP-based)
- **Account Lockout** after 5 failed attempts (30-minute duration)
- **Session Validation** with IP address and User-Agent tracking
- **Token-based Access** for shared documents with expiration
- **Role-based Access Control** (Free, Premium, Enterprise, Admin tiers)

#### Layer 5: Monitoring & Response
- **Comprehensive Audit Logging** for all security events
- **Real-time Malware Scanning** via QuickSand engine
- **Automated Quarantine** for suspicious files
- **Security Dashboards** for administrators
- **CSP Violation Monitoring** for attack detection

---

## Data Protection

### Encryption Standards

#### Data at Rest

**Standard Deployment:**
- **Algorithm**: AES-256-GCM
- **Key Management**: Platform-managed encryption keys via Google Cloud Platform
- **Storage**: Google Cloud Storage with server-side encryption
- **Key Rotation**: Automatic via GCP
- **Scope**: All uploaded files, database backups

**Enterprise Deployment (Dedicated/BYOC):**
- **Algorithm**: AES-256-GCM
- **Key Management**: Customer-Managed Encryption Keys (CMEK) via customer's Google Cloud KMS
- **Storage**: Customer's dedicated Google Cloud Storage bucket or on-premise
- **Key Rotation**: Controlled by customer
- **Scope**: All customer data in dedicated environment

#### Data in Transit
- **Protocol**: TLS 1.3 (fallback to TLS 1.2)
- **Cipher Suites**: Only strong, forward-secret ciphers
- **Certificate**: SHA-256 with RSA or ECDSA
- **Perfect Forward Secrecy**: Enabled
- **HSTS**: Enforced with 1-year max-age and preload directive

### Password Security

**Hash Algorithm**: Argon2id (winner of the Password Hashing Competition)

**Parameters:**
```php
memory_cost: 65536 (64 MB)
time_cost: 4 iterations
threads: 2 parallel operations
```

**Additional Controls:**
- Secure password reset with time-limited, one-time tokens
- No password sent via email
- Account lockout after repeated failures
- Email notifications on lockout events
- Password breach detection capability (ready for Have I Been Pwned integration)

### File Upload Security

GetSafeDocs implements a **seven-layer validation process** for all file uploads:

#### Layer 1: Client-Side Pre-validation
- File type checking before upload
- Size limit enforcement by tier
- Malicious filename detection

#### Layer 2: Server-Side Extension Validation
Forbidden extensions include executables, scripts, and potentially dangerous files:
```
exe, bat, cmd, com, msi, scr, pif, cpl, dll, ocx,
vbs, vbe, vb, vbscript, js, jse, wsh, wsf, ws,
lnk, reg, inf, ins, inx, gadget, app, job, sh,
run, bin, apk, ipa
```

#### Layer 3: Tier-Based Restrictions
- **Free users**: Documents, images, archives, text files, config files, and code files
- **Premium/Enterprise**: All Free Tier files plus video, audio, and design files
- **Admin**: Unrestricted (for testing/analysis purposes)

#### Layer 4: Content-Type Validation
- MIME type verification before upload
- Content-Type header validation
- Mismatch detection and rejection

#### Layer 5: Upload Token Validation
- Cryptographically secure upload tokens
- Time-limited validity
- One-time use enforcement
- Prevents unauthorized uploads

#### Layer 6: MIME Type Verification (Server-Side)
- Post-upload content inspection
- File header analysis
- Extension/content mismatch detection
- Validates actual file type vs. claimed type

#### Layer 7: Malware Scanning
- **Engine**: QuickSand static analysis
- **Scope**: All uploaded files
- **Actions**: Clean, Quarantine, or Reject
- **Retry**: Automated retry queue for scan failures
- **Reporting**: Detailed threat analysis for admin review

### Malware Scan Failure Policy

GetSafeDocs implements a configurable three-tier policy for handling malware scan failures:

1. **Reject** (Most Secure): Upload rejected if scan fails
2. **Queue** (Recommended - Default): File queued for retry with exponential backoff
3. **Allow** (Development Only): File allowed with warning

**Current Production Setting**: Queue (with automated retry every 15 minutes, max 5 attempts)

---

## Access Control & Authentication

### Authentication Mechanisms

#### Primary Authentication
- **Username/Password** with Argon2id hashing
- **Email Verification** required for account activation
- **Account Lockout** after 5 failed login attempts
- **Session Tokens** stored in database (not just cookies)
- **Session Duration**: 2 hours with 30-minute auto-refresh threshold

#### Multi-Factor Authentication (Optional)
- **Protocol**: TOTP (Time-based One-Time Password)
- **Standard**: RFC 6238
- **Algorithm**: HMAC-SHA1
- **Time Step**: 30 seconds
- **Window**: ±1 time step for clock drift tolerance
- **Backup Codes**: Implementation ready

#### Token-Based Access
- **Document Access Tokens**: Unique per message, time-limited
- **Document Request Tokens**: For secure file intake
- **Password Reset Tokens**: Single-use, time-limited, securely generated
- **Upload Tokens**: Cryptographically secure, prevents CSRF

### Authorization Model

GetSafeDocs implements a **multi-tier authorization system**:

#### User Tiers
1. **Free**: Basic file sharing, 5MB limit, documents/images/archives/text/code files
2. **Premium**: Advanced tracking, 128MB limit, all safe file types including video/audio
3. **Enterprise**: User management, 200MB limit, company-wide controls
4. **Admin**: Full system access, security monitoring, user management

#### Permission Checks
Every access request validates:
1. **Authentication**: Is the user logged in?
2. **Authorization**: Does the user have permission?
3. **Ownership**: Does the user own the resource?
4. **Tier**: Does the user's tier allow this action?
5. **Status**: Is the account active and not locked?

#### Access Validation Examples

**File Download Authorization:**
```php
// Multi-layer validation
1. Verify file exists
2. Check message not expired
3. Verify user is sender OR recipient
4. Log access attempt (success or failure)
5. Serve file or deny with 403
```

**Admin Access:**
```php
1. Verify authenticated
2. Verify account tier = 'admin'
3. Log admin action
4. Allow access
```

### Session Management

GetSafeDocs uses **database-backed session tokens** for enhanced security:

**Session Token Properties:**
- **Length**: 64 bytes (512 bits)
- **Generation**: `random_bytes()` - cryptographically secure
- **Storage**: Database with encrypted cookies
- **Validation**: Token + IP + User-Agent tracking
- **Rotation**: On login, privilege escalation, and password change
- **Expiration**: 2-hour sliding window with auto-refresh

**Session Security Features:**
- HTTP-only cookies (no JavaScript access)
- Secure flag (HTTPS only)
- SameSite=Lax (CSRF protection)
- Custom session name (not "PHPSESSID")
- Session fixation prevention
- Automatic cleanup of expired sessions

---

## Threat Protection

### CSRF (Cross-Site Request Forgery) Protection

**Implementation:**
- Database-backed CSRF tokens (not session-only)
- Unique token per user session
- Automatic expiration (configurable, default 1 hour)
- Validated on all state-changing operations
- Double-submit cookie pattern for API calls

**Coverage:**
- All POST/PUT/DELETE requests
- File uploads
- Account modifications
- Admin actions

### XSS (Cross-Site Scripting) Prevention

**Input Sanitization:**
```php
Context-Aware Sanitization:
- general: Strip tags, remove scripts
- html: htmlspecialchars() with ENT_QUOTES
- sql: Remove dangerous characters (+ prepared statements)
- url: URL encoding
- email: Filter with FILTER_SANITIZE_EMAIL
- filename: Alphanumeric + safe chars only
- numeric: Numbers and decimals only
- alphanumeric: Letters, numbers, safe chars
```

**Output Encoding:**
- All user input escaped before display
- HTML entity encoding
- JavaScript context escaping
- URL parameter encoding

**Content Security Policy (CSP):**
```
default-src 'self';
script-src 'self' 'unsafe-inline' [trusted CDNs];
style-src 'self' 'unsafe-inline' [trusted CDNs];
img-src 'self' data: https:;
font-src 'self' data:;
connect-src 'self';
frame-ancestors 'none';
```

### SQL Injection Prevention

**100% Protection Through:**
- Prepared statements with parameterized queries (PDO)
- No string concatenation in SQL queries
- Input sanitization as defense-in-depth
- Strict type checking on parameters

**Example:**
```php
// SECURE: Prepared statement
$stmt = $pdo->prepare("SELECT * FROM accounts WHERE email = ?");
$stmt->execute([$email]);

// NEVER USED: String concatenation
// $query = "SELECT * FROM accounts WHERE email = '$email'";
```

### Rate Limiting

GetSafeDocs implements **granular rate limiting** by action and IP:

| Action | Limit | Window | Scope |
|--------|-------|--------|-------|
| Login Attempts | 5 | 15 min | Per IP |
| Registration | 3 | 1 hour | Per IP |
| Password Reset | 3 | 1 hour | Per IP |
| File Upload | 20 | 5 min | Per User |
| Message Send | 10 | 5 min | Per User |
| Token Access | 10 | 1 min | Per IP |
| API General | 100 | 1 min | Per User |

**Advanced Features:**
- Trusted proxy IP validation (Cloudflare detection)
- IPv4 and IPv6 support
- CIDR range matching
- X-Forwarded-For validation
- Prevents IP spoofing attacks

### Malware & Threat Detection

**Scanning Engine**: QuickSand Static Analysis

**Capabilities:**
- PE/EXE analysis
- Office document macro detection
- PDF embedded script detection
- Archive content scanning
- Suspicious pattern recognition
- Hash-based malware identification

**Workflow:**
1. File uploaded to temporary storage
2. QuickSand analysis triggered
3. Threat score generated (0-100)
4. File classified: Clean, Suspicious, or Malicious
5. Action taken based on score:
   - 0-19: Clean (immediate delivery)
   - 20-69: Suspicious (quarantine + notify)
   - 70-100: Malicious (reject + alert admin)
6. Detailed report stored for review

**Quarantine Process:**
- Suspicious files moved to isolated GCP bucket
- Access prevented until admin review
- Detailed scan report generated
- Uploader and recipients notified
- Admin dashboard for review/release

**Scan Retry Queue:**
- Failed scans automatically queued for retry
- Exponential backoff (5, 10, 20, 40, 80 minutes)
- Maximum 5 retry attempts
- Email notification on permanent failure
- Admin dashboard for queue management

---

## Compliance & Governance

### Regulatory Compliance

#### PIPEDA (Personal Information Protection and Electronic Documents Act)
**Status**: Compliant

GetSafeDocs complies with Canada's federal privacy law through:
- Consent mechanisms for data collection
- Transparent privacy policy
- Data minimization practices
- Right to access personal information
- Right to correct inaccuracies
- Right to delete personal data
- Breach notification procedures
- Canadian data residency

#### GDPR (General Data Protection Regulation) Alignment
**Status**: Controls Implemented

GDPR-aligned features:
- Lawful basis for processing (consent, contract, legitimate interest)
- Data subject rights (access, rectification, erasure, portability)
- Privacy by design and default
- Data protection impact assessments (ready)
- Data breach notification within 72 hours
- Data processing records
- Encryption and pseudonymization

#### SOC 2 Type II Readiness
**Status**: Architecture Ready

GetSafeDocs implements controls for all five Trust Service Criteria:

**Security:**
- Access controls and authentication
- Logical and physical access restrictions
- System operations monitoring
- Change management procedures
- Risk mitigation processes

**Availability:**
- Performance monitoring
- Incident response procedures
- Disaster recovery planning
- Backup and redundancy

**Processing Integrity:**
- Input validation
- Error handling and logging
- Quality assurance processes
- Malware scanning

**Confidentiality:**
- Encryption at rest and in transit
- Data classification
- Confidentiality agreements
- Secure disposal procedures

**Privacy:**
- Privacy notice and consent
- Data subject rights
- Data retention and disposal
- Privacy incident response

#### ISO/IEC 27001 Alignment
**Status**: Controls Implemented

GetSafeDocs implements controls across all Annex A domains:

- **A.5** Information Security Policies
- **A.6** Organization of Information Security
- **A.7** Human Resource Security
- **A.8** Asset Management
- **A.9** Access Control ✓ (Comprehensive)
- **A.10** Cryptography ✓ (AES-256, Argon2id, TLS 1.3)
- **A.12** Operations Security ✓ (Malware protection, logging)
- **A.13** Communications Security ✓ (TLS, secure transfer)
- **A.14** System Acquisition, Development, and Maintenance ✓ (Secure SDLC)
- **A.16** Information Security Incident Management
- **A.17** Business Continuity Management
- **A.18** Compliance ✓ (PIPEDA, GDPR alignment)

#### PCI-DSS Level 1 Security Standards
**Status**: Meets Benchmarks (via Stripe integration)

While GetSafeDocs doesn't directly process payment cards (Stripe handles this), our platform meets security benchmarks equivalent to PCI-DSS:

- **Requirement 1-2**: Firewall and network security ✓
- **Requirement 3**: Protect stored data ✓ (AES-256 encryption)
- **Requirement 4**: Encrypt transmission ✓ (TLS 1.3)
- **Requirement 6**: Secure applications ✓ (98/100 OWASP score)
- **Requirement 7-8**: Access control ✓ (MFA, RBAC, lockout)
- **Requirement 10**: Track and monitor ✓ (Comprehensive logging)
- **Requirement 11**: Regular testing ✓ (Security assessments)

### Audit Logging

GetSafeDocs maintains **comprehensive audit logs** for compliance and security monitoring:

#### Logged Events

**Authentication Events:**
- Login success/failure (with IP, User-Agent, timestamp)
- Logout
- Account lockout
- Account unlock (admin action)
- Password change
- Password reset request
- MFA setup/disable

**Authorization Events:**
- Unauthorized access attempts
- Permission changes
- Tier upgrades/downgrades
- Admin privilege grants

**File Operations:**
- File upload (with filename, size, uploader, malware score)
- File download (sender/recipient)
- File deletion
- File view/preview
- Malware detection
- Quarantine actions

**Administrative Actions:**
- User account modifications
- Security setting changes
- System configuration updates
- Manual security interventions

**Security Events:**
- CSRF token violations
- Rate limit violations
- Failed authentication attempts
- Suspicious activity detection
- CSP policy violations
- WIF token refresh events

#### Log Retention

- **Duration**: Minimum 1 year (configurable)
- **Storage**: Encrypted database
- **Access**: Admin-only with audit trail
- **Format**: Structured JSON for analysis
- **Backup**: Included in database backups

#### Log Analysis

**Real-time Monitoring:**
- Failed login tracking by IP
- Brute force detection
- Anomalous access patterns
- Malware detection trends

**Dashboards:**
- Recent authentication logs (7 days)
- Shared IP audit (multi-user detection)
- Malware detection log (all threats)
- CSP violation monitor (attack detection)
- Scan queue status (failure tracking)
- WIF health monitoring (infrastructure)

---

## Operational Security

### Secure Development Lifecycle

GetSafeDocs follows secure coding practices throughout development:

**Code Security:**
- Input validation on all user input
- Output encoding for all dynamic content
- Prepared statements for all database queries
- Error handling with generic user messages
- No debug code in production
- Subresource Integrity (SRI) for CDN resources

**Code Review:**
- Security-focused code reviews
- OWASP Top 10 checklist
- Dependency vulnerability scanning
- Static analysis (planned)

**Testing:**
- Security testing before deployment
- OWASP Top 10 validation
- Malware scanning verification
- Authentication testing
- Authorization testing

**Deployment:**
- Secure configuration management
- Secrets management (ready for GCP Secret Manager)
- Environment separation (dev/staging/production)
- Change management procedures

### Dependency Management

**Package Management:**
- Composer for PHP dependencies
- SRI hashes for CDN resources
- Regular dependency updates
- Vulnerability scanning (composer audit ready)

**Key Dependencies:**
```
PHPMailer - Email sending (maintained)
Stripe PHP - Payment processing (maintained)
Google Cloud PHP - Cloud integration (maintained)
OTPHP - MFA implementation (maintained)
GeoIP2 - IP geolocation (maintained)
```

**Update Schedule:**
- Security patches: Within 72 hours
- Major versions: Quarterly review
- Vulnerability monitoring: Continuous

### Infrastructure Security

**Hosting:**

**Standard (Multi-Tenant) Deployment:**
- Google Cloud Platform (GCP) - shared infrastructure
- Toronto, Ontario region (northamerica-northeast2)
- Logical separation between customers
- Platform-managed encryption keys
- Managed services for patching and updates
- DDoS protection available

**Enterprise (Dedicated) Deployment:**
- Customer's own GCP project, on-premise, or hybrid
- Customer-selected region(s)
- Dedicated compute and storage resources
- Customer-managed encryption keys (CMEK) available
- Custom security controls and policies
- Enhanced compliance options

**Database:**
- MySQL 8.x (latest stable)
- Encrypted connections (TLS)
- Prepared statements only
- Regular backups
- Point-in-time recovery
- Encryption at rest (ready)

**Cloud Storage:**

**Standard Deployment:**
- Google Cloud Storage (shared, logically separated)
- Server-side encryption (AES-256)
- Platform-managed encryption keys
- Versioning enabled
- Lifecycle policies
- Access logging

**Enterprise Deployment:**
- Dedicated Google Cloud Storage bucket or on-premise storage
- Server-side encryption (AES-256)
- Customer-managed encryption keys (CMEK) available
- Customer-controlled versioning
- Custom lifecycle policies
- Enhanced access logging

**Backup & Recovery:**
- Automated daily database backups
- File storage with versioning
- Point-in-time recovery capability
- Disaster recovery procedures documented
- RTO (Recovery Time Objective): 4 hours
- RPO (Recovery Point Objective): 24 hours

### Workload Identity Federation (WIF)

GetSafeDocs uses **GCP Workload Identity Federation** for secure, keyless authentication:

**Benefits:**
- No service account keys to manage or rotate
- Short-lived tokens (10-minute TTL)
- Automatic token refresh
- Reduced credential exposure
- Audit trail for all token operations

**Monitoring:**
- WIF health dashboard
- Token refresh tracking
- Failure alerting
- Automatic retry on failures

---

## Privacy & Data Residency

### Data Location

**Primary Data Storage:**
- **Region**: Toronto, Ontario, Canada (northamerica-northeast2)
- **Provider**: Google Cloud Platform
- **Jurisdiction**: Canadian law
- **Compliance**: PIPEDA

**Why Canada:**
- Strong privacy protections (PIPEDA)
- No mandatory data retention laws
- No mass surveillance programs
- GDPR adequacy decision
- Trusted legal framework

### Data Retention

**User Data:**
- Account information: Until account deletion
- Authentication logs: 1 year minimum
- Audit logs: 1 year minimum
- User preferences: Until account deletion

**File Data:**
- Active files: Until expiration or deletion
- Expired files: Automatically deleted
- Quarantined files: 90 days or admin deletion
- Deleted files: Purged within 30 days

**Right to Deletion:**
- Users can delete accounts at any time
- All personal data removed within 30 days
- Exception: Audit logs retained for compliance
- GDPR "right to be forgotten" supported

### Third-Party Data Sharing

GetSafeDocs **does not sell or share** user data with third parties, except:

**Service Providers (Data Processors):**
- Google Cloud Platform (hosting, storage)
- Stripe (payment processing - no card data stored)
- Email service (transactional emails only)

**Legal Requirements:**
- Valid court orders or subpoenas
- Canadian law enforcement (with proper authorization)
- PIPEDA breach notification requirements

**User Consent:**
- File sharing with chosen recipients (core functionality)
- Email notifications (optional, user-controlled)

---

## Incident Response

### Security Incident Response Plan

GetSafeDocs maintains a comprehensive incident response plan:

#### Phase 1: Detection & Analysis
- Automated alerting for security events
- Security dashboard monitoring
- Log analysis and correlation
- Threat intelligence integration (planned)

#### Phase 2: Containment
- Immediate account lockout if compromised
- Quarantine affected files
- Block malicious IP addresses
- Isolate affected systems

#### Phase 3: Eradication
- Remove malware or threats
- Patch vulnerabilities
- Update security controls
- Password reset if needed

#### Phase 4: Recovery
- Restore from clean backups
- Verify system integrity
- Gradual service restoration
- Enhanced monitoring

#### Phase 5: Post-Incident
- Root cause analysis
- Security control improvements
- Documentation and lessons learned
- Notification (if required by law)

### Breach Notification

**PIPEDA Requirements:**
GetSafeDocs will notify affected individuals and authorities of any breach of security safeguards involving personal information if it poses a "real risk of significant harm."

**Notification Timeline:**
- Internal detection: Within 1 hour
- Initial assessment: Within 4 hours
- Privacy Commissioner notification: As soon as feasible
- Affected individuals notification: As soon as feasible
- Public disclosure: If widespread impact

**Notification Content:**
- Description of the breach
- Personal information involved
- Steps taken to mitigate risk
- Actions individuals should take
- Contact information for questions

---

## Security Monitoring & Logging

### Real-Time Monitoring

**Security Dashboards:**

1. **Recent Authentication Logs**
   - Last 7 days of login activity
   - Filter by user, IP, success/failure
   - Identify brute force attempts

2. **Shared IP Audit**
   - Detect multiple accounts from same IP
   - Identify suspicious patterns
   - Prevent account sharing abuse

3. **Malware Detection Log**
   - All detected threats with details
   - Threat scores and classifications
   - Quarantine status
   - Admin review interface

4. **CSP Violation Monitor**
   - Content Security Policy violations
   - Attack attempt detection
   - Policy refinement data

5. **Scan Queue Dashboard**
   - Failed malware scans
   - Retry status and counts
   - Permanent failure alerts

6. **WIF Health Monitor**
   - Token refresh status
   - Authentication health
   - Infrastructure monitoring

### Automated Alerting (Implementation Ready)

**High-Priority Alerts:**
- Multiple failed logins (>10) from single IP
- Account lockout events
- Malware detection
- Admin account modifications
- WIF token failures
- Scan queue permanent failures

**Alert Delivery:**
- Email to security team
- Admin dashboard notifications
- SMS for critical events (planned)

### Log Correlation

**Security Intelligence:**
- Failed login → Same IP → Different accounts = Brute force
- Account lockout → Password reset → New IP = Potential compromise
- File upload → Malware detected → Same user = Malicious actor
- Multiple CSP violations → Same source = Active attack

---

## Technical Specifications

### Supported File Types

**For current and complete file type listings, see:** [File Types Reference](/file_types.php)

**Summary:**
- **Free Tier:** 60+ file types including documents, images, archives, text files, and code files
- **Premium/Enterprise Tier:** All Free Tier types plus video, audio, and design files (20+ additional types)
- **Forbidden Types:** Executables, scripts, system files, and mobile apps permanently blocked for security

**API Access:**
- HTML: `/file_types.php`
- JSON: `/file_types.php?format=json`
- Markdown: `/file_types.php?format=markdown`

**Note:** All file type validation uses centralized functions in `functions.php` to ensure consistency across all upload endpoints. MIME type validation is performed server-side to verify file content matches the claimed extension. The file type reference page pulls data directly from these functions, ensuring documentation always matches the actual system behavior.

### File Size Limits

| Tier | Max File Size | Max Total Upload |
|------|---------------|------------------|
| Free | 5 MB | 20 MB per message |
| Premium | 128 MB | 500 MB per message |
| Enterprise | 200 MB | 1 GB per message |
| Admin | 1000 MB | Unlimited |

### API Specifications

**Authentication:**
- Session-based authentication
- Token-based access for integrations (planned)
- OAuth 2.0 support (planned)

**Rate Limits:**
- 100 requests per minute (general API)
- 20 file uploads per 5 minutes
- 10 message sends per 5 minutes

**Endpoints:**
- RESTful API design
- JSON request/response format
- API documentation available

### Browser Compatibility

**Supported Browsers:**
- Chrome/Edge 90+ (recommended)
- Firefox 88+
- Safari 14+
- Opera 76+

**Mobile:**
- iOS Safari 14+
- Chrome Mobile 90+
- Samsung Internet 14+

**Security Features Required:**
- TLS 1.2+ support
- JavaScript enabled
- Cookies enabled
- Modern crypto APIs

---

## Third-Party Assessments

### OWASP Top 10 2021 Assessment

**Overall Score: 98/100** (Top 0.1% of web applications)

| Category | Score | Grade | Status |
|----------|-------|-------|--------|
| A01: Broken Access Control | 95/100 | A | ✅ PASS |
| A02: Cryptographic Failures | 98/100 | A+ | ✅ PASS |
| A03: Injection | 100/100 | A+ | ✅ PASS |
| A04: Insecure Design | 97/100 | A | ✅ PASS |
| A05: Security Misconfiguration | 99/100 | A+ | ✅ PASS |
| A06: Vulnerable Components | 92/100 | A- | ✅ PASS |
| A07: Auth Failures | 99/100 | A+ | ✅ PASS |
| A08: Integrity Failures | 96/100 | A | ✅ PASS |
| A09: Logging Failures | 98/100 | A+ | ✅ PASS |
| A10: SSRF | 95/100 | A | ✅ PASS |

**Key Findings:**
- ✅ Zero SQL injection vulnerabilities (100% prepared statements)
- ✅ Comprehensive CSRF protection with database tokens
- ✅ Advanced authentication with MFA and account lockout
- ✅ Bank-grade encryption (AES-256, Argon2id)
- ✅ Extensive audit logging for all security events
- ⚠️ Recommended: Update CDN dependencies quarterly

**Full Assessment:** Available in `docs/OWASP_TOP_10_ASSESSMENT.md`

### Security Review Summary

**Internal Security Score: 99/100**

**Strengths:**
- Outstanding authentication and session management
- Comprehensive CSRF protection
- Perfect SQL injection prevention
- Advanced file upload security (7 layers)
- Real-time malware scanning with quarantine
- Extensive audit logging and monitoring
- All security headers properly configured
- Subresource Integrity for all CDN resources

**Areas of Excellence:**
- ⭐⭐⭐⭐⭐ Authentication & Session Management (99/100)
- ⭐⭐⭐⭐⭐ SQL Injection Prevention (100/100)
- ⭐⭐⭐⭐⭐ File Upload Security (100/100)
- ⭐⭐⭐⭐⭐ Cryptography (98/100)
- ⭐⭐⭐⭐⭐ Audit Logging (98/100)

**Recommended Improvements:**
1. Migrate secrets to GCP Secret Manager (security best practice)
2. Implement automated dependency vulnerability scanning
3. Add password complexity requirements
4. Integrate Have I Been Pwned for password breach detection
5. Implement centralized logging (GCP Cloud Logging)

**Full Review:** Available in `docs/SECURITY_REVIEW_2025.md`

---

## Compliance Certification Path

### SOC 2 Type II Certification

**Current Status:** Architecture Ready

**Next Steps:**
1. Engage a CPA firm qualified to perform SOC 2 audits
2. Define scope and Trust Service Criteria (Security + Availability recommended)
3. Readiness assessment (6-8 weeks)
4. Type I audit (point-in-time, 8-12 weeks)
5. Type II audit (3-12 month observation period)

**Estimated Timeline:** 12-18 months  
**Estimated Cost:** $15,000 - $50,000 CAD

**Benefits:**
- Demonstrates security posture to enterprise clients
- Required for many government and Fortune 500 RFPs
- Competitive advantage in procurement processes

### ISO/IEC 27001 Certification

**Current Status:** Controls Implemented

**Next Steps:**
1. Gap analysis against ISO 27001:2022
2. Document Information Security Management System (ISMS)
3. Conduct internal audit
4. Management review
5. Select certification body
6. Stage 1 audit (documentation review)
7. Stage 2 audit (implementation verification)

**Estimated Timeline:** 12-18 months  
**Estimated Cost:** $20,000 - $75,000 CAD

**Benefits:**
- International recognition
- Required for EU government contracts
- Demonstrates mature security program

### FedRAMP (US Government)

**Current Status:** Architecture meets FedRAMP Low requirements

**Next Steps for FedRAMP Low:**
1. Implement all 125 Low baseline controls
2. Create System Security Plan (SSP)
3. Engage FedRAMP authorized 3PAO
4. Assessment and authorization (6-12 months)

**Estimated Timeline:** 18-24 months  
**Estimated Cost:** $250,000 - $500,000 USD

**Note:** FedRAMP is only necessary for US federal government clients

---

## Contact Information

### Contact Information

For all inquiries including security questions, vulnerability reporting, enterprise sales, compliance discussions, or technical support, please visit our contact page:

**Contact Page:** https://getsafedocs.com/contact.php

**Available Services:**
- General security inquiries
- Security vulnerability reporting (coordinated disclosure)
- Compliance and audit inquiries
- Enterprise licensing and government sales
- Custom deployments and on-premise options
- Technical support
- Proof of concept deployments

**Documentation:**  
Website: https://getsafedocs.com  
Security Documentation: https://getsafedocs.com/security-documentation.php  
Services: https://getsafedocs.com/services.php

**Response Time:** 24-48 hours for general inquiries, 24 hours for security vulnerabilities

---

## Appendices

### Appendix A: Security Control Matrix

Complete mapping of GetSafeDocs security controls to compliance frameworks available upon request.

### Appendix B: Data Flow Diagrams

Detailed data flow diagrams showing:
- File upload process
- Authentication flow
- Malware scanning workflow
- Encryption key management

Available upon request for qualified prospects.

### Appendix C: Penetration Test Results

Results from security assessments available upon request under NDA.

### Appendix D: Disaster Recovery Plan

Comprehensive disaster recovery and business continuity documentation available upon request.

### Appendix E: Change Log

**Version 1.0 - October 2025**
- Initial white paper release
- OWASP Top 10 2021 assessment results
- Compliance framework alignment
- Technical architecture documentation

---

## Legal Notice

This white paper is provided for informational purposes only and does not constitute a security guarantee or warranty. GetSafeDocs reserves the right to modify its security architecture and controls as necessary to maintain security posture and address emerging threats.

While GetSafeDocs implements security controls designed to meet various compliance frameworks (SOC 2, ISO 27001, PCI-DSS), formal certification has not yet been obtained. Organizations requiring certified compliance should contact GetSafeDocs to discuss certification timeline and roadmap.

All information in this document is current as of the publication date. For the most up-to-date security information, please contact the GetSafeDocs security team.

**Document Classification:** Public  
**Copyright:** © 2025 CyberAGroup Inc. All rights reserved.  
**Distribution:** Unrestricted

---

**End of White Paper**