What MySafe has built, how it was checked, and what it does not cover.

01 · Workspace

Document isolation between organizations

• Implemented
• Verified in test environment
• Not separately checked in production

What this gives you

A document uploaded into one organization's workspace is not listed, opened, downloaded or changed by members of another organization.

What was checked

• PassedA user from another organization does not see the document in their document list.
• PassedOpening, downloading or archiving the document from another organization is refused. The refused open does not include the title, and the refused download does not include the content.
• PassedDownloading the current version from another organization is refused.
• PassedAudit events of one organization are not visible to another organization.
• PassedControlled link details are hidden from users of another organization.

Limits

• Isolation is enforced by the application on shared infrastructure. Organizations do not get separate databases or separate storage.
• Checked with synthetic organizations and users in test environments, not separately in production.
• People who operate the infrastructure are outside the scope of this check.

02 · Controlled sharing

Approval by a different account, no self-approval

• Implemented
• Verified in test environment
• Verified in production (synthetic data)

What this gives you

A request to share a document through a controlled link needs approval from a different account with the owner or admin role in the same organization. The requesting account cannot approve its own request.

What was checked

• PassedThe requester's attempt to approve their own request is refused.
• PassedThe refusal still applies after the requester is given the admin role.
• PassedA member without the owner or admin role cannot approve.
• PassedAn owner of the same organization can approve. Approval returns no link and creates none.
• PassedIn an organization with a single owner, where no other account could approve, the request is refused.

Limits

• MySafe checks that a different account approves. It does not verify that two accounts belong to two different people.
• MySafe checks accounts and roles. It does not review the document's content or the stated purpose.

03 · Controlled sharing

Controlled link created as a separate step after approval

• Implemented
• Partly verified in test environment
• Partly checked in production (synthetic data)

In production: The sequence approval → link creation was confirmed: the link was created in a separate step after approval. Not every condition re-checked at link creation was tested: the cases where the approval is no longer valid, the version is no longer current or the policy no longer returns ALLOW were not part of this check.

What this gives you

Approval alone does not produce a link. The link is created in a separate step by the requester or an owner or admin, and MySafe checks the request and its policy again at that moment.

What was checked

• PassedApproval returns no link and creates no grant.
• PassedCreating the link is a separate request. It is refused without sign-in and for a member without the right role.
• PassedThe link is shown once, when it is created. Repeating the step returns the existing grant without the link, and the request history does not contain it.
• Not yet in a recorded runAt link creation, the approval is checked again: still active, not expired, and given by a different owner or admin account that is still active.
• Not yet in a recorded runAt link creation, the requested version must still be current and the fixed policy dac.default version 1 is evaluated again and must return ALLOW.

Limits

• The checks at link creation are in the code, and tests for them exist, but those tests have not run in a recorded run yet. Treat them as implemented, not verified.
• The link is a bearer link: anyone who holds it can use it. The holder is not an identified recipient, and MySafe does not verify who opens it.

04 · Controlled sharing

Access refused after the link is revoked

• Implemented
• Verified in test environment
• Verified in production (synthetic data)

What this gives you

When a link should stop working, an owner, an admin or the original requester can revoke it. After that, opening the link is refused.

What was checked

• PassedA link opens, is revoked, and the same link is then refused with a generic “not available” answer.
• PassedThe same flow works in the browser: create the link, open it, revoke it, and see the refusal. It passed in desktop Chromium, mobile Chrome and mobile Safari (WebKit) profiles.
• PassedWhen revoke and an open happen at the same moment, the outcome is consistent: if revoke completes first, the open is refused; later opens are always refused.
• PassedA member without the right role cannot revoke.
• PassedAn expired link is refused as well.

Limits

• Revoking blocks later use of the link. It does not delete copies that were already downloaded or viewed.
• An open that was authorized just before the revoke completed is not undone.
• A view link is not copy protection: the recipient's browser receives the decrypted document.
• Access that MySafe allows is recorded as authorized access. It does not prove that anyone read the document.

05 · Controlled sharing and Action control

No sharing of an outdated version

• Implemented
• Partly verified in test environment
• Not separately checked in production

What this gives you

A controlled link request has no version picker: it is tied to the version that is current when the request is made. Once a newer version becomes current, the old link stops working, so an outdated version is not passed on through a controlled link.

What was checked

• PassedControlled sharing: after a newer version becomes current, opening an existing link to the older version is refused.
• PassedControlled sharing: when a new version and an open happen at the same moment, the outcome is consistent, and once the new version is current, later opens are refused.
• Not yet in a recorded runControlled sharing: creating a link for a request whose version is no longer current is refused.
• PassedAction control: an action on an older version is evaluated as BLOCK with the reason obsolete_version, and the decision screen shows BLOCK in desktop and mobile browser profiles.
• PassedAction control: an action on the current version that needs approval is evaluated as REQUIRE APPROVAL.

Limits

• Action control records a decision: ALLOW, BLOCK or REQUIRE APPROVAL. It does not send, share or stop anything by itself, and it does not create controlled links.
• Inside the workspace, members with access can still open and download earlier versions. The restriction applies to controlled links.
• MySafe cannot stop someone from sending an old copy by email or any other channel outside MySafe.

06 · Records

Activity history and evidence receipt

• Implemented
• Verified in test environment
• Partly checked in production (synthetic data)

In production: Request history could be read and did not contain the link. The evidence receipt was not part of this check.

What this gives you

For each controlled link request, owners and admins can see its history and open an evidence receipt. The receipt lists the exact version, the request, the approval, the policy decision with its reason codes, link creation, link status and recorded access events. It can be downloaded as JSON or CSV.

What was checked

• PassedHistory is shown to owners and admins of the organization. It is refused without sign-in, for a plain member and for another organization.
• PassedReading history does not change any records.
• PassedHistory stays available after the document is archived.
• PassedHistory does not contain the link or its hash.
• PassedThe evidence receipt opens for an owner or admin.
• PassedThe audit log rejects direct database UPDATE and DELETE statements.
• PassedThe CSV export neutralizes cells that a spreadsheet would run as formulas (unit tests).
• Passed (update, 3 October 2026)Full receipt contract: the access rules for the receipt and its downloads, that no secrets are included, that reading it changes no records, link status in each case, and the cut-off after 500 access events.

Update, 3 October 2026: The full receipt contract test passed on a GitHub-hosted runner with synthetic data, and it now runs in the release gate as a required check. This is a CI check, not a check of the evidence receipt in production. On 3 October 2026, the reusable deployment gate was checked through a diagnostic workflow. It rejected the tested revisions without a successful release-gate run on main for that exact revision, including a candidate with an intentionally failing receipt contract. No production deployment was attempted for the failing candidate.

Limits

• The receipt is not signed and has no hash chain or trusted timestamp. Times come from MySafe's own server and database, so the receipt cannot be verified independently of MySafe.
• The receipt shows what MySafe allowed and recorded. An access event means access was authorized, not that the document was read.
• The receipt does not identify the person who holds or opens a link.
• The receipt currently includes internal numeric identifiers for the organization, document and users.
• Up to 500 access events are included. If there are more, the receipt says that the list is cut off.
• The receipt is a record from MySafe, not a certification or a legal opinion.