> For the complete documentation index, see [llms.txt](https://docs.rubica.au/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rubica.au/households/secure-files/security-and-data.md).

# Security and Data Handling

Where Secure Files stores documents, how each firm is kept separate, how people prove who they are, and what is logged.

## Where files are stored

* Documents are stored in **Google Cloud Storage (Firebase) in Sydney** (`australia-southeast1`).
* Files go **straight from the browser to storage** and back, using links that work for a few minutes only. They don't pass through Salesforce or through Rubica's integration layer.
* Salesforce keeps the record of each share: who it went to, file names and sizes, opens, downloads and uploads. It doesn't keep the files themselves.
* Deleted files are recoverable for 7 days.

## How each firm is kept separate

Every firm has:

* **its own storage bucket**, and
* **its own service identity**, which is allowed to reach that bucket and nothing else.

Every upload and download link is issued **as the firm's own identity**. One firm's identity has no permission to touch another firm's bucket, so a mistake in the software can't expose one firm's documents to another. The integration layer has no direct access to any bucket; it can only act as the firm the request belongs to. Which firm a request belongs to is fixed by Salesforce (for staff) or by the private link itself (for clients), never by anything the caller sends.

Buckets block public access entirely, and every access to them is recorded in Google Cloud audit logs.

## How people prove who they are

* Each recipient has their own private link. The link alone shows nothing but your firm's branding and a partly hidden mobile or email.
* To see anything, they enter a 6-digit code sent to the mobile or email on their record. Text codes are sent by Twilio Verify; email codes come from Rubica email, last 10 minutes, and are stored only as a one-way hash.
* After 5 wrong codes, a new code is needed. Codes can be resent only every 30 seconds.
* A verified session lasts about 45 minutes. "Remember this device" lasts 7 days, applies to that one link on that one device, and ends early if the share is stopped or expires.
* Links expire (30 days by default) and can be stopped at any time.

## What is logged

For each recipient: when the link was sent and how, when they opened it and confirmed their code, each download and each upload. Staff actions are recorded too: who kept or declined each upload and when.

## Wording we use

We describe Secure Files as *private links, verified access, expiring access, every download logged*. Files are protected in transit (HTTPS) and at rest (Google-managed encryption).