The Digital Operational Resilience Act (DORA) requires financial entities to maintain oversight and control over their ICT supply chains, including any sub-outsourcing arrangements within that chain.
As an underlying ICT service provider, Databeamer forms part of this chain. The platform is therefore designed to provide the transparency and safeguards required by DORA in a demonstrable and verifiable manner:
- No dependency on non-European hyperscalers
Databeamer operates entirely within EU jurisdiction (Scaleway), without exposure to extraterritorial legislation such as the US CLOUD Act. This reduces a key legal and geopolitical risk within the ICT supply chain. - Zero-knowledge architecture
Files, messages, and metadata are end-to-end encrypted. Databeamer does not possess the keys required to decrypt the content, even upon request by third parties. This limits the risk of unauthorized access and reduces dependency on the cloud provider, in line with DORA’s objectives for effective ICT risk management. - Tamper-resistant audit trail
Every modifying action is digitally signed on the client side and periodically recorded in Merkle-sealed epochs. This creates a verifiable evidence trail that supports incident analysis, classification, and reporting. - Transparent ICT supply chain
Our sub-processor register can be directly used as input for your Register of Information, as required under Chapter V of DORA.