Key Features

SecuFile provides a comprehensive feature set for secure file storage in a multi-tenant SaaS model.

End-to-End Encryption (E2E)

AES-256-GCM client-side: Files are encrypted in the browser before being sent to the server. The server never sees the plaintext data.
RSA-4096 hybrid: Each organization has an RSA-4096 key pair. The private key is encrypted by the KMS (Key Management Service) before being stored in PostgreSQL.
Chunked encryption: Large files are encrypted in blocks with derived nonces (baseNonce XOR chunkIndex) to avoid AES-GCM size limitations.
Server-Trust decryption: Optional mode where the server can decrypt files for transfers and sharing.

Organizations: Complete data isolation per organization. Each organization has its own dedicated OVH S3 bucket with unique credentials.
Plans and subscriptions: Configurable pricing plans (Free, Pro, Business) with storage limits.
Stripe billing: Full Stripe integration for subscription management, payments, invoices, and payment methods.
Invitations: Email-based invitation system to add users to an organization.
Usage metering: Per-organization storage usage tracking.

OVH S3 Cloud: S3-compatible storage hosted at OVH Canada (BHS, Beauharnois QC) and OVH France (GRA, Gravelines).
Multi-region: Storage region choice at organization creation (BHS default for Canadian compliance).
Dedicated buckets: Naming convention secufile_{env}_{msp-id}_{org-id} for data isolation.
Auto-provisioning: Automatic S3 bucket creation, OVH credentials, and default folders on organization creation.

Download links: File sharing via public links with optional password protection.
Upload links: Secure file reception via public links with Loi 25 consent.
Access tracking: Complete audit trail for every access, download, and upload via share links.
Consent text: Configurable per organization for Loi 25 compliance.
Expiration: Links with configurable expiration dates.

Secure transfers: File sending between users with email notifications.
Soft delete: Deactivated transfers preserve files while making the link non-functional.
Tracking: First consultation tracking (viewed_at).
Email verification: Verification codes for transfer access.

JWT: Token-based authentication with access tokens (15 min) and refresh tokens (7 days).
MFA (TOTP): Multi-factor authentication via TOTP applications (Google Authenticator, etc.).
Zitadel SSO: OIDC integration with Zitadel for single sign-on.
Account lockout: Locks after 5 failed attempts for 15 minutes.
Rate limiting: Distributed limiting via Redis (Auth: 20/min, Public: 60/min, API: 120/min).
CSRF protection: Content-Type validation on state-changing requests.
Strict CORS: Required explicit origin configuration.

Structured logging: JSON structured logs via log/slog with request_id, method, path, duration.
Prometheus metrics: HTTP, S3, goroutine, login, and upload metrics on /metrics.
Health probes: /health (liveness) and /ready (readiness with DB and Redis checks).