# DPIA support for Databeamer The facts about Databeamer your organisation needs for its own DPIA, in the order of a DPIA. Division of roles, categories of personal data, access by Databeamer, retention periods, sub-processors, risks and measures, data subject rights and the data breach procedure. **For whom.** DPOs, privacy officers, process owners and buyers at organisations carrying out a data protection impact assessment (DPIA) on the use of Databeamer. **What this document is and is not.** It does not replace your organisation's DPIA: that remains the responsibility of the controller and its DPO. It supplies the facts about Databeamer you need for it, in the order in which a DPIA asks for them, with a reference per topic to the document in which the arrangement is formally laid down. It belongs with [Databeamer for DPOs and privacy officers](https://databeamer.eu/en/docs/privacy-security-it/privacy-officers) and [Databeamer for security officers and CISOs](https://databeamer.eu/en/docs/privacy-security-it/security-officers). The data processing agreement (DPA), the privacy statement, the security policy and the cookie policy are on the [legal page](https://databeamer.eu/en/legal). Where this document states a deadline or arrangement, the DPA is the source; in case of a difference the DPA prevails. ## 1. About the service and the division of roles **What is Databeamer?** A Dutch SaaS service by Full Join B.V. (Eindhoven) for secure communication, file exchange and collaboration, with client-side end-to-end encryption and hosting within the EU. Files, messages, answers and journal content are encrypted on the user's device and decrypted at the recipient's. Full Join does not hold enough key material to decrypt that content on its own. **Division of roles under the GDPR** (DPA §1.2, privacy statement §1 and §8.10): | Party | Role | Explanation | | ------------------------------ | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Customer organisation | Controller | Determines the purposes and means of the processing, which information is shared, with whom, and for how long. | | Full Join (Databeamer) | Processor | Processes the personal data the organisation processes through Databeamer, exclusively in accordance with the DPA, the agreement and documented instructions (DPA chapter 4). | | Full Join for its own purposes | Controller | Account management, invoicing, security of the service, support, its own administration and the identity verification of users and organisations (the verification mark). These processing activities fall under the privacy statement, not the DPA. | For consumers who use Databeamer directly, Full Join is the controller for the account data; the content they enter is unreadable to Full Join as well. ## 2. Categories of personal data and data subjects The content of information is unreadable to Databeamer (see section 3). The categories below do remain visible to the service, because they are needed for accounts, groups, access, exchange and security. The precise metadata differs per feature; the [technology page](https://databeamer.eu/en/technology) gives the current list under "What we can and cannot see". | Category | Examples | Data subjects | Purpose | Retention (see section 5) | | ------------------------------------ | --------------------------------------------------------------------------------------------------------------- | ---------------------------------- | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Account data | Name, email address, username, account status, organisation | Employees of the customer | Account management, authentication and access | While the account is active; after deletion a 30-day grace period, then permanently erased and anonymised | | Group and organisation data | Names of organisations and groups, member lists, roles, membership labels, invitations | Employees, external members | Setting up collaboration and access management | While the group or organisation exists; on deletion of a workspace the configured retention period | | Classifications, statuses and labels | Type of a case or workspace, workflow status, organisation-level labels | Users | Operation of the feature and management reporting | While the object exists | | Transfer and request data | Title, sender, recipients, status, expiry date | Users, guests | Exchange and accountability | Until the expiry date or deletion; the record without content remains for the activity log | | Audit trail | Who did what, with which object, when; signed by the user's device | Users, guests | Accountability, security and investigation | Remains after deletion of content or account, anonymised where possible (DPA §13.6) | | Volume and usage data | Numbers of files, encrypted sizes, shape of the folder tree, quota usage | Users | Operation and capacity of the service, invoicing | While the content exists | | Communication data | Channel, sender, timestamps, read status and presence in chat and Secure Mail | Users, guests | Message handling and delivery | While the conversation or group exists | | Guest data | Guest's email address, delivery status, verification events, download receipts | External people without an account | Access for external recipients and accountability | While the delivery exists; the events remain in the audit trail | | Technical data | IP address, sign-in times, browser and device characteristics, session data, security events, error information | Users, guests | Security, fraud prevention, incident investigation | Operational logs for a limited period (in the order of one month); security events as long as needed for security and investigation | | Hash of file content | A SHA-256 hash of the original content of every uploaded file | Not directly identifiable | Check for known malware | While the file exists | **Special categories of personal data.** Databeamer does not see the content, but the customer can share special categories of personal data (Article 9 GDPR) and data relating to criminal convictions through the service. The DPA (§15.3 and §15.4) allows this and places the responsibility for the legal basis and appropriate safeguards with the customer. Full Join does not determine the content categories and cannot decrypt protected content into readable form. Note: classifications, statuses, labels and titles are readable; a label such as "psychiatry" or a title containing a client's name turns visible metadata into special-category data. See the recommendation in section 3. ## 3. Content and metadata: what does the service see and not see? **Not visible to the service:** all content users enter (files, file names, file types, folder names, messages in chat and Secure Mail, attachments, answers to requests, journal entries, the message accompanying a transfer or request, tags and descriptions in encrypted blobs) and users' passwords, PINs, recovery phrases, passphrases and keys. Databeamer never holds all the keys needed to decrypt this content and cannot recover users' keys for them. **Visible:** the metadata from section 2. It contains no user content, but even without content, patterns can be derived from it, such as who works with whom, when, and how intensively (traffic data). Searches in the transfer and request lists run on the server over the readable titles; file and chat content is never searched on the server. **Recommendation to customers:** use group names, titles, classifications, labels and statuses for neutral categories only. Do not include names of clients, case numbers, diagnoses or other confidential details. Record this in a naming guideline and include it in the instructions to users. ## 4. Access to data by Databeamer This section describes when Full Join staff or systems can view data, under which conditions and with which logging. The internal rules come from Full Join's information security management system (ISMS); the public summary is in the [Security Policy](https://databeamer.eu/en/legal/security-policy). | Situation | Access to content? | Access to metadata? | Conditions and logging | | ----------------------------------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Normal operation of the service | No | Yes, as far as needed for operation | Access to production systems is limited to the people for whom it is necessary (least privilege, need-to-know). Multi-factor authentication with an authenticator app or hardware key is mandatory. Access rights are reviewed every quarter; granting and revocation are recorded as tasks. Administrative actions are logged. | | Guest access by email code | Technically possible, only during the guest's verified access | Yes | The key sits under a non-exportable key in Scaleway Key Manager (EU) and is released per access after a one-time code; every release is in the audit trail. On expiry or recall the key is destroyed. With a passphrase this route does not exist. The sender chooses per delivery (DPA §4.3, Security Policy §4.5). | | Support questions | No | Only the account and metadata needed to answer the question | Support works with the same limited rights as regular administration; there is no separate support access to content, and content cannot be opened even with the highest administrative rights. Support requests go through the contact form (itself a secure Databeamer request) or by email. | | Technical administration and maintenance | No | Yes, as far as needed | Changes to the application and infrastructure go exclusively through the automated deployment pipeline; manual changes in production are not allowed and in emergencies require the four-eyes principle. Production data is never used in development or test environments. Every deployment is logged. | | Requests from governments and supervisory authorities | No: Full Join cannot supply protected content in readable form | Only what is legally required | Full Join checks a binding request for validity and scope and informs the customer in advance, unless that is legally prohibited; then as soon as legally possible (DPA chapter 12). What can technically be supplied is limited to the metadata in section 2. | ## 5. Retention and deletion The retention period of data within Databeamer differs per feature and is largely determined by the customer's settings and instructions (DPA chapter 13, privacy statement chapter 13). | Topic | Description | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Active data | Account data: while the account is active. Group and organisation data: while the group or organisation exists. Content in Drive, chat, Secure Mail and journals: as long as the customer does not delete it and the group exists. If the customer sets no period, content remains as long as the workspace and the agreement exist. | | Periods the customer can set | Per request a retention period from 1 day to one year (bounded by the subscription), after which submissions and their files are cleaned up automatically. Per transfer an expiry of 1, 3, 7 or 30 days (maximum per subscription), after which the files are deleted; the record and the activity remain. On deletion of a workspace a retention period tied to its classification: until it ends, the workspace is hidden, read-only and restorable, after which the content is permanently deleted. | | Deletion by the user or administrator | Moving a file to the trash is a soft delete: it remains restorable and the encrypted blocks stay. **Delete permanently** removes the file record; a background process then removes the blocks no file refers to any more. Deleting a transfer closes the group and removes the blocks immediately. A submitter can withdraw a submission within 24 hours; the encrypted submission is then deleted. | | Deleted users and group members | On removal from a group the key set is renewed; new content is no longer accessible to the removed person. Information already collected remains in their possession. If a user deletes their own account (or an administrator does so on their behalf), a 30-day grace period follows in which the deletion can be cancelled; after that the data is permanently erased, the storage cleaned up and the profile anonymised (DPA §13.3). | | Backups | Customer content in backups is always encrypted. Database backups are made daily and kept for seven days; encrypted file blocks are stored redundantly across three zones in the Amsterdam region. Deleted data disappears from the backups once that rotation has run. Backups stay within the EU. | | Audit trail | Remains after the underlying content or account has been deleted, anonymised where possible, as long as needed for security, administration, incident investigation, accountability and legal or contractual obligations. Reason: an audit trail that disappears with the content has no evidential value, and the entries are signed and sealed into chained epochs, so later deletion would break the chain (DPA §13.6). | | Technical logs | Operational infrastructure logs and error monitoring are kept for a limited period, in the order of one month, and stay within the EU. Logs contain no customer content or keys. | | Account reset | On a reset the existing keys and personal data are destroyed. A reset is not a recovery of the original content; group content becomes reachable again once an administrator adds the user back. | | Termination of the agreement | Full Join returns or deletes the personal data at the customer's choice, as far as technically possible and subject to statutory retention obligations (DPA §13.4). After termination the customer keeps access to the export function for thirty days; it produces a decrypted archive of files and metadata on the user's device (Terms of Service §12.5). A formal certificate of destruction is not a standard part; ask for it in the contract negotiations. | ## 6. Processors, sub-processors, hosting and transfers | Topic | Description | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Hosting location | European Union, Amsterdam region, at Scaleway SAS (France), redundant across three zones. No data, metadata or backups leave the EU (DPA §11.1). | | Sub-processors | Scaleway SAS (France) for hosting, transactional email and key management, all in the EU. The identity service runs on software Full Join hosts itself; there is no external identity provider (DPA §10.3). The current list is in chapter 10 of the [DPA](https://databeamer.eu/en/legal). | | Other external calls | The malware check looks up the SHA-256 hash of an uploaded file at OPSWAT MetaDefender, a US hash reputation service; the call contains only the hash, never content or account data. This service is not in the DPA's list of sub-processors; assess in your own DPIA whether to include this data flow. | | Changes in sub-processors | Full Join informs the customer in advance when a change may affect the processing. The customer can object on reasoned grounds within thirty calendar days; if no solution is found within thirty days, the customer can terminate the agreement (or the part concerned) free of charge and with immediate effect, with a pro rata refund (DPA §10.4). | | Transfers outside the EEA | Not foreseen for the primary processing and hosting. For any supporting services outside the EEA Full Join ensures an appropriate legal basis and safeguards in accordance with Chapter V GDPR (DPA §11.3). Transfers the customer initiates itself by sending to recipients outside the EEA remain the customer's responsibility (DPA §11.4). | | Control and jurisdiction | Full Join B.V. is established in Eindhoven and falls under Dutch law and the GDPR. Scaleway is a European cloud provider with no control from outside the EU (security policy §14.3); no US hyperscaler is used. Client-side encryption further limits what an infrastructure provider could see at all. | See also the [legal page](https://databeamer.eu/en/legal) for the full texts. ## 7. Risks and measures Per risk: what it is, what Databeamer does about it and what the customer arranges itself. The customer can take this section over directly into its own DPIA. | Risk | What does Databeamer do? | What does the customer arrange? | | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Visible metadata and traffic data** reveal patterns of collaboration | Limits visible data to what the service needs; encrypts file names, folder names, tags and messages. Metadata is protected with TLS, encryption at rest and access restriction; access for its own staff follows least privilege, mandatory MFA, quarterly reviews and logging. No profiling, analysis or AI training on customer data. | Neutral naming for groups, titles, labels and statuses. Assess whether the visible metadata is acceptable for the processing concerned. | | **Guest access by email code**: the service can decrypt during verification | Key under a non-exportable key in a European key management service; release only per access after a one-time code (six digits, valid ten minutes, limited attempts); every release in the audit trail; key destroyed on expiry or recall. The passphrase is the default and has no such route. | Determine for which type of information this route is allowed. Prescribe a passphrase or another way of working for special categories of personal data and highly confidential documents. | | **Wrong recipient** of a transfer or Secure Mail | Possibility to delete a transfer or recall the delivery to a guest; key material and access links are destroyed. Identity check of recipients with an account (organisations, shared groups, member since) before sending. | Procedure for recall and reporting. Assess whether this is a data breach. Information already collected cannot be taken back. | | **Previously obtained information** after removal of a group member | Key set is renewed, so new information is no longer accessible. Earlier messages and entries are not re-encrypted. | Agreements on handling previously received information, including in confidentiality agreements. Leaver management. | | **Loss of devices and recovery phrase** | Devices can be revoked from another device; the revoked device's share is unusable afterwards. The recovery phrase provides recovery. Security notifications on new device approvals and locked PINs. | Policy for keeping recovery phrases, reporting loss and account resets. Two devices per user where possible. Prevent information that must be retained from existing in one account only. | | **Passphrase with unauthorised people** | Exchange can be recalled; a new transfer gets a new passphrase generated by Databeamer. | Resend through a new, secure exchange. Assess whether this is a data breach. | | **Hash in the malware check** can reveal that two users have the same file | The server and the external service receive a hash, not the content. The outcome is supportive, not a guarantee. The hash is kept with the file record while the file exists and disappears with the file. | Include in the assessment of privacy consequences. Arrange a content-level malware scan, if required, on your own side (endpoints). | | **Audit trail itself contains personal data** | Digitally signed, coherent record without content. Access by Full Join staff only under least privilege and need-to-know, logged. The customer can view and export its own audit trail. | Arrange who may view audit data, for which purpose and how long findings are retained. | | **Key loss**: data cannot be recovered | Databeamer cannot recover keys for users; this is a design choice, not a limitation that can be bypassed through a back door. | Safeguard availability and retention obligations outside the account, for example through groups with several members or an archive export. | | **Breach on the server side** | A break-in yields encrypted content; metadata is the exposure. ISMS in line with ISO/IEC 27001:2022, separated environments, deployment only through the automated pipeline, vulnerability management and notification to the customer within 24 hours. | Keep the security contact at Databeamer up to date. Align your own reporting procedure with the 24-hour deadline. | ## 8. Data subject rights Requests from data subjects are handled by the customer as controller. If Full Join receives a request concerning personal data it processes on behalf of a customer, it informs the customer without undue delay, unless it is legally obliged to respond itself (DPA §8.1). | Right | How does Databeamer support the customer? | | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Access | The customer can itself view the content its group members have access to, and view and export the metadata and audit data of its own organisation and groups. Full Join cannot give access to the plaintext of protected content, and can on request supply the account and metadata it holds as processor about a data subject (DPA §8.2). | | Rectification | Users change their own profile data; content is corrected by the group members concerned. Full Join cannot correct protected content. | | Erasure | The customer deletes content through Databeamer's functions (trash and permanent deletion, deleting transfers, letting requests expire, deleting accounts). Full Join cannot delete protected content at the content level. Audit data remains, anonymised where possible; backups follow the rotation in section 5. | | Restriction and objection | The customer restricts access by adjusting group memberships and roles or moving content; Full Join supports within the technical possibilities. Against the verification mark (for which Full Join is itself the controller) the data subject can object to Full Join; the mark is then withdrawn. | | Portability | Files and their metadata can be exported as a decrypted archive on the user's device; request submissions can be exported to Drive. Full Join cannot transfer protected content itself. | | Response time and contact | Full Join informs the customer without undue delay and offers reasonable support within what is technically possible; a fixed response time can be agreed contractually in an SLA. Contact: compliance@databeamer.io or the [contact form](https://databeamer.eu/en/contact?topic=support). | ## 9. Databeamer's data breach procedure | Topic | Description | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Detection and assessment | Reports come in through automated alerts on the infrastructure and the deployment pipeline, through own observation, or via security@databeamer.io (responsible disclosure). Every incident is classified on report: P1 critical (first response within 1 hour), P2 high (4 hours), P3 normal (8 hours on a working day), P4 low (next working day). Reporting does not wait for full certainty (DPA §9.1). | | Notification to the customer | Without undue delay and within 24 hours of discovery at the latest for a breach affecting personal data processed on behalf of the customer, to the security contact designated by the customer, by email and by phone if needed (DPA §9.2). The deadline is deliberately shorter than 72 hours so that the customer can meet its own notification duty under the GDPR, NIS2 or the Dutch Cybersecurity Act. | | Content of the notification | Nature of the incident, systems or processing affected, categories of personal data, categories and where possible number of data subjects, possible consequences, measures taken or proposed and a contact point. The notification is supplemented as new information becomes available (DPA §9.3). | | Support with notifying the supervisory authority | Full Join reasonably cooperates in assessing the incident and in the customer's obligations towards the Dutch Data Protection Authority and data subjects (DPA §9.5). After a P1 or P2 incident an evaluation of cause, detection, recovery and prevention follows; the outcomes relevant to the customer are shared on request. | | Full Join's own notification duty | For processing for which Full Join is itself the controller: notification to the Dutch Data Protection Authority within 72 hours (DPA §9.4). | | Role of the audit trail in investigation | The audit trail helps to investigate events and changes afterwards; for guest access by email code every key release is in it. | | Communication during major disruptions | A first public notice within thirty minutes of activating the contingency plan, then an update at least every hour, and after recovery a confirmation by email explaining the consequences for confidentiality (Security Policy §11.5). | The customer remains responsible for assessing notification duties and statutory deadlines. ## 10. Security measures in summary This is a summary. The technical detail is in [Databeamer for security officers and CISOs](https://databeamer.eu/en/docs/privacy-security-it/security-officers); the contractual list is Annex B of the DPA. - Encryption on the user's side; key custody with the user (2-of-3 secret sharing). - Hybrid post-quantum cryptography for key exchange (X25519 + ML-KEM-768) and digital signatures (Ed25519 + ML-DSA-65); content encrypted with ChaCha20-Poly1305. - Access confined per group through group membership and cryptographic keys; administrative rights do not automatically give access to the content of groups. - Authentication separate from access to encrypted content; mandatory multi-factor authentication; single sign-on through OpenID Connect and SAML 2.0. - Audit trail of digitally signed events, sealed into chained epochs; viewing and export for the organisation. - Hosting in the EU (Amsterdam), European suppliers, no US hyperscaler; backups within the EU. - ISMS in line with ISO/IEC 27001:2022; the external certification process has been completed and formal completion awaits the certification body's report (Security Policy §17.1 gives the current status). Preparation for NEN 7510; set-up with regard to NEN 7512 and NEN 7513. - Secure development with mandatory code review, automated security checks in the deployment pipeline and vulnerability management; periodic penetration tests by an independent party and a responsible disclosure procedure via security@databeamer.io. Available documentation, certifications and assurance information are provided on reasonable request (DPA chapter 14). ## 11. Fill in yourself Databeamer cannot supply these parts, because they depend on the customer's use. - [ ] Description of the processing: nature, scope, context and purposes - [ ] Categories of data subjects and personal data in your own application - [ ] Legal basis for the processing - [ ] Necessity and proportionality: can the purpose be achieved with less data or in another way? - [ ] Which guest access options are allowed for which type of information - [ ] Naming guideline for groups, titles, labels and statuses - [ ] Management of joiners, movers and leavers and group memberships - [ ] Retention periods and archiving in your own organisation, and the settings per request, transfer and workspace - [ ] Procedure for loss of devices, recovery phrases and account resets - [ ] Data breach procedure, the security contact Databeamer uses, and who assesses notifications - [ ] Your own risk assessment and residual risk - [ ] Advice of the DPO and decision of the controller ## 12. When is a DPIA likely to be needed? This test depends on the use, not on the service. A DPIA is mandatory when a processing operation is likely to result in a high risk to the rights and freedoms of data subjects (Article 35 GDPR). When using Databeamer this is plausible, for example, when special categories of personal data or data about vulnerable data subjects are processed, when the processing is large-scale, or when several data sources are combined. The [Dutch Data Protection Authority](https://www.autoriteitpersoonsgegevens.nl) publishes a list of processing operations for which a DPIA is always mandatory; the European supervisory authorities also apply nine criteria of which two usually suffice. The final assessment lies with the customer and its DPO. ## About this document The owner is the CISO of Full Join B.V. The document is reviewed at least once a year, and additionally on every change of the DPA, the security policy, the list of sub-processors or the technical architecture. The date of the last change is at the bottom of the page. Questions, or walking through a DPIA together: [contact](https://databeamer.eu/en/contact?topic=support) or compliance@databeamer.io. ## Sources - [Legal page](https://databeamer.eu/en/legal): privacy statement, data processing agreement, security policy, terms of service, cookie policy - [Compliance page](https://databeamer.eu/en/compliance): hosting, processors, standards, measures - [Technology](https://databeamer.eu/en/technology): cryptographic stack and what the server can and cannot see - [Groups](https://databeamer.eu/en/docs/groups/groups), [Organisations](https://databeamer.eu/en/docs/groups/organizations), [Audit log](https://databeamer.eu/en/docs/account/audit-log) - [Send a transfer](https://databeamer.eu/en/docs/transfers/send-a-transfer), [Recovery phrase and shares](https://databeamer.eu/en/docs/account/recovery-phrase), [Upload and organise files](https://databeamer.eu/en/docs/files/upload-and-organise), [Trash and deleting](https://databeamer.eu/en/docs/files/trash), [Account settings](https://databeamer.eu/en/docs/account/settings)