Security is priority one. On every level.

1. Executive Summary

EdFiles® is a secure, cloud-native document management platform purpose-built to safeguard client data. Security is a foundational principle of the EdFiles architecture, not an afterthought. The platform employs a defense-in-depth security model, with controls applied across infrastructure, network, application, and operational layers.

Security Controls Summary

• Web Application Firewall (AWS WAF) with managed rule sets
• DDoS protection through WAF rate limiting
• TLS encryption for all communications
• Server-side encryption for S3-stored documents
• Time-limited pre-signed URLs for file access
• Role-based access control and session management
• Email OTP multi-factor authentication
• Security Groups enforcing least-privilege network access
• WAF, access, and error logging with monitoring
• Periodic backups of infrastructure and data

2. AWS Shared Responsibility Model

AWS handles physical infrastructure security; EdFiles manages secure configuration of AWS services, WAF setup, identity controls, and encryption implementation.

3. Physical & Environmental Security (AWS Data Centers)

AWS protects data centers through environmental selection prioritizing sustainability, perimeter security with guards and surveillance, infrastructure redundancy for power and telecommunications, and restricted access to data storage layers.

4. Infrastructure Security

4.1 Web Application Firewall (AWS WAF)

AWS WAF provides SQL Injection (SQLi) prevention — blocking malicious database query patterns — and protects against XSS, malicious bots, and reputation-based threats.

4.2 Application Load Balancer (ALB)

The Application Load Balancer serves as the secure entry point to the EdFiles platform for HTTPS termination and WAF attachment.

4.3 DDoS Protection

WAF rate limiting mitigates distributed denial-of-service traffic before it reaches EdFiles application infrastructure.

5. Network Security

The ALB is the only public-facing entry point. All traffic must pass through the WAF and ALB. Backend services use Security Groups restricting traffic to defined flows.

6. Data Security

6.1 Secure Document Storage (Amazon S3)

S3 buckets maintain strictly private access — no public access is permitted — with Public Access Block enforcement and IAM policy controls.

6.2 Secure File Delivery via Pre-Signed URLs

Files use time-limited pre-signed URLs, generated on demand for authenticated, authorized users, with expiration timestamps and read-only access.

6.3 Encryption in Transit

All data transmission uses TLS encryption, protecting against man-in-the-middle attacks.

7. Application Security

7.1 Authentication & Access Control

Passwords undergo cryptographic hashing with no plaintext storage. Role-based access control (RBAC) ensures least-privilege access. Sessions use secure, server-issued tokens with automatic expiration.

7.2 Multi-Factor Authentication (MFA)

MFA requires a one-time passcode (OTP) delivered via email at each login, mitigating credential compromise and phishing risks.

8. Logging, Monitoring & Auditing

The system maintains access logs — records of inbound requests and authentication events — plus application error logs and WAF traffic logs.

9. Backup & Availability

Amazon S3 provides 99.999999999% (11 nines) data durability, with regular snapshots supporting point-in-time recovery.

10. AWS Security Related Services Used by EdFiles

• AWS WAF — web application firewall & managed rule sets
• Application Load Balancer (ALB) — HTTPS termination & secure entry point
• Amazon S3 — private, encrypted document storage
• Security Groups — least-privilege network access control
• IAM — identity & access management policies

Read the full detail in our Privacy Policy & Terms of Service.