Databeamer for IT and application management

Databeamer is a secure communication and collaboration platform for storing, exchanging and discussing confidential information. Organisations use it, among other things, to work securely with clients, residents, suppliers and professionals from other organisations, without giving them access to their own internal IT environment.

This page gives IT managers, application administrators, architects and other people with technical responsibility insight into the technical capabilities of Databeamer, the set-up of users and groups, the available integrations and the way security, data management and governance are arranged.

1. Architecture and implementation #

Fit within the organisation #

Databeamer is intended as a complement to existing business systems. The platform provides its own environment for information that must be collected, shared, managed and discussed securely, particularly when several organisations or external people are involved.

Internal systems can keep their existing role. Databeamer provides a shared environment for information that is used jointly, without external participants having to be given access to an organisation's internal IT environment or case-file systems.

The set-up follows the way an organisation wants to collaborate. Groups can be used, for example, for a project, team, client or partnership. Within those groups, participants, access rights and the available functions are organised.

Implementation and adoption #

A good implementation covers both the technical set-up and the practical application within the organisation. The organisation administrator plays a central role in this, possibly together with a project lead or process owner. They decide, for example, how Databeamer is used, which groups are needed and who owns them.

Databeamer supports this implementation with documentation for organisation administrators. Implementation consultancy is also available for organisations that want guidance on the set-up, on translating work processes into Databeamer and on adoption.

Read on: Documentation for organisation administrators

Accounts, seats and account verification #

A Databeamer account is personal and is not shared. Organisations work with a number of seats: the number of active accounts available within the organisation at a given moment. Account management thereby follows the management of individual users, while the organisation can determine the scale of use contractually.

Under a paid organisation agreement it is also possible to have accounts marked as a verified account. Together with the client, Databeamer checks the validity of the account. This verification gives other participants, including external parties and guests, extra assurance when judging who they are communicating with.

Account management includes adding and removing users and adjusting their access. When ending an account, it is important to distinguish between revoking access and retaining data that is still needed for an ongoing process or case file.

Read on: Account and organisation management

2. Identity, authentication and devices #

Single Sign-On (SSO) #

Databeamer supports Single Sign-On for organisations that want authentication to connect to their existing identity provision, within the available configuration and the agreements made.

SSO can simplify signing in for users and connect to the organisation's central identity management. The concrete set-up depends on the supported configuration and the agreements on the connection.

Relevant to the technical assessment are, among other things, the identity provider used, the set-up of the connection and the handling of users who gain or lose access.

Read on: ask for the current SSO documentation and the available configuration options.

Devices, sessions and recovery #

Databeamer is available through the browser on desktop, laptop and mobile devices. A native app for iOS and Android is in development.

Databeamer's security rests on client-side encryption. The device someone works on therefore plays an important role in processing and decrypting protected content. The server does not independently hold the keys needed to read that content.

Databeamer also has mechanisms for account security, device-specific access and recovery. Because the service provider does not hold all the necessary key material, recovery is not simply the same as resetting a password. The available recovery options and the management of recovery data are therefore an important part of how the platform works.

Read on: Technical architecture and security and Recovery phrase.

3. Connections and integrations #

APIs and automated data exchange #

APIs make it possible to connect Databeamer to other applications and processes, insofar as the required functionality is available. Data exchange and process steps can thereby be integrated into existing ways of working.

When designing a connection, the available API functions, authentication, authorisations and the form in which data is supplied or retrieved are decisive. The client-side encryption architecture is an important starting point here: an integration must fit the way data is encrypted and the rights of the user or application involved.

Agents and data flows #

Automated data exchange can run in several directions:

• Client-to-server: data is sent from a client or application to Databeamer.
• Server-to-server: systems exchange data without a user carrying out each step manually.
• Server-to-client: data or results are made available from a server to a client or application.

These scenarios differ in how identity, authorisation and key management are arranged. A server connection or agent does not automatically have access to all content in Databeamer. The possibilities depend on the available integration, the rights granted and the way the data is processed.

For organisations that want to realise such connections, agreeing on the intended process and the technical preconditions is the appropriate first step.

Outlook and Secure Mail #

For organisations that want to combine their email workflow with secure exchange, there is an Outlook add-in for Secure Mail as additional functionality. It is part of the options for fitting confidential communication better into existing work processes.

The Outlook add-in is an additional feature to which separate agreements apply. Its availability, supported environment, set-up and any costs are therefore agreed separately.

Read on: ask for the current documentation on APIs, agents and Outlook integration.

4. Technical security and European data sovereignty #

Client-side encryption and zero-knowledge #

Databeamer applies end-to-end encryption directly on the user's device, before the data is sent to our infrastructure. Because we do not hold the cryptographic key material, it is technically impossible for us to decrypt this protected content.

This limits the risk that an incident on the server infrastructure leads directly to unauthorised access to the content of files and messages. Overall security also remains dependent on the security of user accounts, endpoints, access rights and the application itself.

Not all data is necessarily encrypted. Certain account data and technical or functional metadata may be needed for administration, routing and security logging. The technical documentation describes the architecture and the relevant boundaries.

Hybrid post-quantum cryptography #

Databeamer applies hybrid post-quantum cryptography (PQC). Classical cryptography is combined with post-quantum cryptographic techniques, with the aim of offering protection against both current threats and future developments in quantum computing.

The application of PQC is part of the broader cryptographic architecture. Key management, implementation and the security of the client also remain important.

Read on: Technology and cryptography.

European data sovereignty #

Databeamer is built on the principle that confidential data must remain under European legal and technical control.

The infrastructure for hosting and back-ups is located with a European provider. When choosing infrastructure and suppliers, we look not only at the physical location of data, but also at the legal position of the supplier and the possible influence of legislation from outside the European Union.

Client-side encryption forms an additional layer of protection: we do not hold the key material needed to independently decrypt the protected content. Databeamer thereby combines European hosting with a zero-knowledge architecture.

Certification and compliance #

Databeamer's information security management system is set up in line with ISO/IEC 27001:2022. The current certification documentation describes the formal status and scope.

Databeamer's technical and organisational measures can support organisations in meeting their own security and compliance obligations. The extent to which the platform meets specific requirements, such as the GDPR, NEN 7510, NIS2 or DORA, depends on the applicable obligations and the way Databeamer is used within the organisation.

Read on: Security and compliance.

5. Logging, audit trails and governance #

Audit trails and SIEM integration #

Databeamer offers the option to export audit trails at both the individual level and the organisation level. Relevant events can thereby be used for internal control, investigation and accountability.

SIEM integration is also possible. This offers ways to include audit data in existing processes for security monitoring and incident handling. The concrete options for export and integration depend on the available configuration and the agreements made.

Audit logging must be distinguished from access to the content of data. An event can be auditable without the administrator being able to read the content of the associated file or message.

Roles, groups and administrative boundaries #

Databeamer distinguishes between organisation administration and the administration of individual groups.

The organisation administrator has an overview of the number of groups, their status and the people who own those groups. The administrator can thereby keep insight into the organisational set-up, without gaining access to the encrypted content of the groups.

Responsibility for setting up individual groups can lie with the employees themselves. Within the organisational agreements and available options, they can create groups that fit their collaboration, for example around a project, client or team. Ownership of groups remains visible to the organisation administrator.

This model combines room for day-to-day practice with central oversight, without central administration automatically meaning that the content of all groups is accessible.

6. Retention periods, archiving and data deletion #

Retention periods #

Databeamer offers options to apply retention periods to different components. Depending on the type of data, periods can be set, for example, for groups, sent Transfers, incoming Requests and journals per type.

The applicable period can therefore differ per process and type of information. The set-up supports organisations in applying their retention policy, but does not replace the substantive assessment of which period applies to a particular processing activity or case file.

Deleting and ending use #

When ending the use of a group or deleting information, several matters play a role: the access rights of participants, the availability of data for ongoing processes and the applicable retention periods.

Deleting an account, closing a group and deleting data are different actions. They do not necessarily have the same consequences for all the information involved.

Because of the encryption architecture, it is also important that data which has been exported or stored elsewhere remains readable only when the necessary key material is available.

Archiving and data portability #

Databeamer can be part of a process in which information is managed jointly, temporarily or for an agreed period. For formal archiving, it remains important which data must be retained, in what form and within which system.

Data portability also calls for a distinction between exporting data and being able to use the content outside Databeamer. The available export options, file formats and conditions determine how data can be transferred to another environment.

These aspects are relevant both when setting up a retention policy and when ending or changing the service.

7. Subscriptions, capacity and costs #

Seats and guest accounts #

The organisation works with an agreed number of seats, based on the number of active accounts at a given moment.

Databeamer also has guest accounts for people who do not belong to the organisation but do need access to a specific group. Think of clients, residents, suppliers or people involved in a collaboration on a one-off basis. These guests do not count as a seat of the organisation.

This distinction makes it possible to let internal users and external collaboration partners participate in different ways, without every external party automatically taking up a regular organisation place.

Functionality, limits and extensions #

The capabilities and usage allowance depend in part on the chosen subscription and the agreements made. Besides seats, storage capacity, use by external people and the availability of additional functionality may also be relevant.

Specific conditions or additional agreements may apply to features such as SSO, API connections, SIEM integration and the Outlook add-in. When use is extended or the subscription is changed, the available capacity and costs may also change.

For an assessment at organisation level, both the current subscriptions and limits and any additional agreements are therefore relevant.

8. Availability, maintenance and support #

Service and agreements #

The terms of service (TOS), the acceptable use policy (AUP) and the security document describe the relevant conditions for using Databeamer and the security agreements. By using the application, the user agrees to the applicable legal documents.

For organisations that need additional agreements on, for example, availability, support, response times or service, a separate SLA can be concluded.

Outages, questions and complaints #

Reports of outages, questions and complaints go through the Databeamer contact page, unless other arrangements have been laid down in an SLA.

The agreed service determines which support and response times apply. For organisations that use Databeamer in processes with specific continuity requirements, an SLA offers the possibility of formally recording additional agreements.

Continuity and recovery #

When assessing continuity, the distinction between availability of the service and recovery of protected content is important. Databeamer can restore the service without lost key material automatically being reconstructable as a result.

The technical architecture and the service agreements together therefore form the starting point for assessing recovery options and dependencies.

9. Support with technical assessment and implementation #

Not every organisation has the same requirements for integration, administration, security or data exchange. Databeamer therefore offers room to align its capabilities with the intended application and the existing IT environment.

For organisations carrying out a technical assessment or preparing an implementation, a conversation can help to assess the available functionality, any additional agreements and the consequences of the encryption architecture together.

Implementation consultancy is also available. It can provide support with the set-up and with translating existing work processes into Databeamer, in collaboration with the organisation administrator and any project lead.

Would you like to discuss the technical possibilities for your organisation? Contact Databeamer to align on implementation, integrations, security and additional agreements.