# Databeamer for DPOs and privacy officers How Databeamer protects confidential information and personal data, who has access to which data, which metadata remains visible, how to use the audit trail and what your organisation arranges itself. How does Databeamer protect confidential information and personal data? Who has access to which data? Which metadata remains visible and which exceptions exist? This page gives you the information you need to assess Databeamer from a privacy and confidentiality perspective and to determine what your organisation has to arrange itself. ## In short: four points of attention - **The content is encrypted.** Files, messages and other substantive data are encrypted on the user's device. Databeamer cannot read the content, except through the specific exception for guest access by email code. - **Metadata remains partly visible.** Think of names, group memberships, statuses and timestamps. Metadata too can contain personal data or reveal information about the collaboration. - **Access depends on group membership and keys.** Organisation administrators do not automatically have access to the content of every group. - **Your organisation remains responsible for the set-up.** Think of access rights, retention periods, the use of metadata, guest access and the handling of data subject requests. This page is for data protection officers (DPOs), privacy officers and others who assess, from a privacy and confidentiality perspective, whether their organisation can work with Databeamer. For the technical and security side there is a separate overview for [security officers and CISOs](https://databeamer.eu/en/docs/privacy-security-it/security-officers). If you are carrying out a DPIA, also use the [DPIA support](https://databeamer.eu/en/docs/privacy-security-it/dpia-support). There you find the facts about Databeamer you need for it. Our privacy statement, data processing agreement (DPA) and security policy are on the [legal page](https://databeamer.eu/en/legal). Information about standards and certification is on the [compliance page](https://databeamer.eu/en/compliance). ## 1. The starting point: Databeamer cannot read the content Databeamer was built to exchange and jointly use confidential information, including when people work together from different organisations. The architecture is set up so that we, as the provider, have no access to the substantive information. We call this _zero-knowledge_. Four principles matter for your privacy assessment. **1. Encryption on the user's device** Files, messages, answers and journal content are encrypted on the user's device and decrypted at the recipient's. The server stores and relays the data in encrypted form. **2. Key custody with the user** A user's master key is generated on the device and split into three shares. One share is on the device and is protected by the PIN, one is on the server and one can only be opened with the recovery phrase. Two of the three shares are needed. Databeamer holds one share and therefore cannot read the content on its own. Nor can we recover the keys on the user's behalf. **3. Access per group** Access to shared information is arranged through group membership and cryptographic keys. Administrative rights at organisation level do not automatically give access to the content of every group. **4. Verifiable events** Changes and actions are recorded in an audit trail of digitally signed events. This allows actions to be investigated afterwards. ### What does this mean for your assessment? The starting point is that Databeamer cannot read the content, with one specific exception described in section 4. This does not mean that all data the platform processes is invisible. A limited amount of metadata remains readable. Section 3 describes which data that is. The cryptographic detail, including key exchange and hybrid post-quantum cryptography, is in the overview for [security officers and CISOs](https://databeamer.eu/en/docs/privacy-security-it/security-officers) and on the [technology page](https://databeamer.eu/en/technology). The [Security Policy](https://databeamer.eu/en/legal/security-policy), chapter 4, contains the normative description the DPA and the privacy statement refer to. ## 2. Who has access to which information? An important question in a privacy assessment is who has access to which data. In Databeamer this depends on a user's role and the available cryptographic keys, not only on administrative rights. | Who? | Access to the content | What does this mean? | | ---------------------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Group members** | Yes, within the groups they are a member of | Access runs through group membership and group keys. A new member can read the group's entire history. | | **Organisation administrators** | Not automatically | They manage accounts, groups and roles, among other things. They can see which groups exist, what they are called and who belongs to them, but without group membership have no access to the content. | | **Databeamer as service provider** | No, with one exception | The service stores and relays encrypted data and processes the metadata from section 3. The exception concerns guest access by email code; see section 4. | | **Guests without an account** | Only the information that has been shared with them | The chosen access method determines how the key becomes available. A guest who answers a request cannot open their own submission after sending it. | ### Signing in is not the same as access to content Authentication establishes who a user is, but by itself yields no keys. Multi-factor authentication is mandatory for every account. In addition, a PIN or passkey is needed to unlock the keys on a device. The actual access to information is then determined by rights and group membership. Databeamer supports single sign-on (SSO) through OpenID Connect and SAML 2.0. The organisation owner can set this up, depending on the subscription. A new SSO user only gains access to organisation data after an administrator has approved them. That administrator's device then makes the keys available. With SSO, the organisation itself remains responsible for the authentication policy in its own identity provider, including multi-factor authentication. More information is at [Groups](https://databeamer.eu/en/docs/groups/groups) and [Organisations](https://databeamer.eu/en/docs/groups/organizations). ## 3. Which data is visible to Databeamer? The zero-knowledge architecture protects the content of information. A limited amount of metadata remains readable, because Databeamer needs it to make accounts, groups, access and data exchange work. Part of this metadata is personal data. The table below gives an overview of the main categories. | Data | What does this mean for the privacy assessment? | | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | Names, email addresses, usernames, account status and organisation names | Identities and the organisation structure are visible. | | Group names, member lists, roles and membership labels | It is visible who belongs to which group and which role someone has. | | Classifications, types, statuses and labels at organisation level | These attributes of groups, cases or journals can reveal information about the subject or the progress. | | Title, sender, recipients, status and expiry date of transfers and requests | It is visible who sends what to whom. The message and the files themselves are encrypted. | | Events and timestamps in the audit trail | It is visible who performed which action on which object and when. | | Volume and usage data, such as numbers of files, encrypted sizes and the shape of the folder tree | This data is available for capacity management and contractual arrangements. The names of folders and files are not visible. | | Communication data, such as channel, sender, timestamps, read status and presence in chat and Secure Mail | The communication pattern is visible, but the content is not. | | Email addresses of guests, delivery status and access events | A guest's email address is not encrypted. | | Technical data, such as IP address, sign-in times, browser and device characteristics and security events | This data supports security and incident investigation. The privacy statement describes the processing on the basis of legitimate interest. | | A SHA-256 hash of the content of every uploaded file | The hash is used for the check for known malware. See section 4. | ### Which data is not visible? The following data is not readable by Databeamer: - The content of files, file names, file types and exact file sizes. - Folder names. - Chat messages and Secure Mail messages and attachments. - Journal entries and answers to requests. - The message accompanying a transfer or request. - Tags and descriptions inside encrypted data blocks. - Passwords, PINs, recovery phrases, passphrases and keys. The precise metadata differs per feature. This overview contains the main categories, but is not a complete technical inventory. The [technology page](https://databeamer.eu/en/technology), under _What we can and cannot see_, gives the current list. The [privacy statement](https://databeamer.eu/en/legal/privacy), chapter 4, describes the purpose of the various processing operations. Also use the DPA and the other documentation on the [legal page](https://databeamer.eu/en/legal) to determine which data is processed as personal data. ### What does this mean for your organisation's privacy policy? **Keep visible attributes neutral.** Use group names, titles, classifications, statuses and labels for neutral categories. Do not include names of clients, case numbers, diagnoses or other confidential details. Record this in a naming guideline. **Take traffic data into account.** Even when the content is encrypted, usage patterns can say something about who works with whom, when that happens and how intensive the contact is. **Assess metadata as part of the processing.** Look not only at the encryption of the content, but also at which metadata is needed, who can see it and how your organisation governs its use. More information is at [Groups](https://databeamer.eu/en/docs/groups/groups), [Journals](https://databeamer.eu/en/docs/files/journals) and [Set up your organisation](https://databeamer.eu/en/docs/administrators/set-up-your-organisation). ## 4. Exceptions and points of attention Not every feature works in exactly the same way. The following topics therefore deserve separate attention in your privacy assessment. ### Guest access by email code For transfers and Secure Mail to recipients without an account, the sender can choose per delivery between two ways of granting access. **Option 1: passphrase** The sender passes the passphrase on outside Databeamer. The key is derived from this phrase on the guest's device. The server does not know the passphrase. Through this route Databeamer cannot decrypt the content. **Option 2: email code** The key of the delivery is kept encrypted under a non-exportable key in a European key management service: Scaleway Key Manager, in the Amsterdam region. The key is only released after the guest has proven access to the mailbox with a one-time code. The code consists of six digits, can be used once and is valid for ten minutes. The number of attempts is limited. On this second route a technical path exists along which Databeamer could decrypt the files concerned during a verified access. Every release is recorded in the audit trail. When the sender recalls the delivery or the delivery expires, the stored key is destroyed and this path is closed too. **What does this mean for your privacy assessment?** Guest access by email code is the only route on which we, as the provider, could technically gain access to the content. The DPA (§ 4.3) and the Security Policy (§ 4.5) describe this exception explicitly. Include this difference in the DPIA and when determining appropriate measures. **What does your organisation have to arrange?** Determine which access route fits which type of information. Record when guest access by email is allowed and when a passphrase or another way of working is required, for example for special categories of personal data or highly confidential documents. See [Send a transfer](https://databeamer.eu/en/docs/transfers/send-a-transfer) and [Secure Mail](https://databeamer.eu/en/docs/transfers/secure-mail) for how both options work. ### Revoking access and key rotation When someone is removed from a group, the device of the administrator who performs the removal renews the key set. As a result, the removed person can no longer decrypt new information once the key rotation is complete. Information obtained earlier is beyond the reach of this measure. Files someone has already downloaded or decrypted cannot be removed from their possession remotely. Earlier chat messages and journal entries are not re-encrypted on removal. **What does this mean for your privacy policy?** Removing a group member is not the same as retrieving information that this person has already received. Therefore make agreements on removing group members, revoking access and handling previously received information with care. Where needed, include this in confidentiality agreements with employees and external partners. See [Groups](https://databeamer.eu/en/docs/groups/groups) and [End a colleague's access](https://databeamer.eu/en/docs/groups/offboard-someone-who-left). ### Check for known malware When a file is uploaded, the browser computes a SHA-256 hash of the original content before encrypting. This hash is sent along with the upload and looked up by the server in an external hash reputation service (OPSWAT MetaDefender). Only the hash is sent, never the content of the file. The outcome is advisory: downloads are not blocked on the basis of it. Only on a confirmed hit can the file not be stored in a Drive. The hash is kept with the file record for as long as the file exists. A hash can reveal information. For instance, it can become visible that two users have the same file or that a file matches a known public document. About a unique file the hash says nothing by itself. Include this processing in your assessment of the privacy consequences. See [Upload and organise files](https://databeamer.eu/en/docs/files/upload-and-organise). ### Loss of devices and recovery data A user can have a device revoked from another available device. The recovery phrase is important to keep access when devices are lost. If all devices and the recovery phrase are lost, the account cannot be recovered in the usual way. If Databeamer resets the account in that situation, the existing keys and personal data are destroyed. A reset therefore does not restore the original content. Group content does remain reachable once an administrator adds the user to the group again. The reset is recorded as a security event in the audit log. **What does your organisation have to arrange?** This touches on both availability and retention obligations. Information that only exists in an account whose keys are lost cannot be recovered. Therefore determine how employees keep their recovery phrase safely, how loss is reported, who is involved in a reset and how you prevent information that must be retained from existing in one place only. See [Recovery phrase and shares](https://databeamer.eu/en/docs/account/recovery-phrase) and [No device and no recovery phrase](https://databeamer.eu/en/docs/account/no-device-no-phrase). ### Identity verification by Databeamer Databeamer can verify the identity of an organisation and, at its administrator's request, of its users, and show the result as a verification mark next to the name. No identity documents are inspected or stored. What is checked is the data already in the profile. For this processing Full Join is an independent controller, on the basis of legitimate interest. The processing falls outside the DPA. A data subject can object and have the mark withdrawn. See the [privacy statement](https://databeamer.eu/en/legal/privacy), § 4.9 and § 14.1, and [Contacts](https://databeamer.eu/en/docs/chat/contacts). ## 5. Audit trail and evidence The audit trail records events and changes at account, group and system level. Users' actions are digitally signed by their own device and stored in the same transaction as the action itself. About every hour the records are sealed into chained epochs. As a result, changes to the record are detectable afterwards. The audit trail helps you investigate who performed which action, for example on suspicion of a data breach, a complaint or a request from a data subject. Users can view the audit trail of their own account. Organisations can view and export the audit data of their own organisation and groups (DPA § 13.6). Audit data remains after the underlying content or account has been deleted. Where possible, this is done in anonymised form. If the audit trail disappeared together with the content, it would have no evidential value. ### The audit trail itself also contains personal data Because the audit trail records who performed which action and when, it is itself a source of personal data. Therefore make sure that access to audit data is bound to a clear purpose and the right authorisation. The audit trail does not replace all organisational measures. Agree: - Who reviews events and when further investigation is needed. - How findings are recorded and retained. - When the privacy officer, the security officer and others are brought in. - How you assess whether an event is a notifiable data breach. ### Examples of situations and first actions | Situation | First points of attention | | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | A device is lost or stolen | Revoke the device from another available device. Also assess whether the recovery phrase may have been exposed and regenerate it if needed. See [I lost my phone](https://databeamer.eu/en/docs/account/lost-my-phone). | | An employee leaves the organisation | Remove the person from the relevant groups and transfer group or organisation ownership where needed. See [End a colleague's access](https://databeamer.eu/en/docs/groups/offboard-someone-who-left). | | A transfer or Secure Mail went to the wrong person | Check whether the exchange can still be recalled or deleted. Bear in mind that information already collected cannot be taken back remotely. Assess whether this is a data breach. See [Track and receive transfers](https://databeamer.eu/en/docs/transfers/track-a-transfer). | | A passphrase may have become known to unauthorised people | Recall the exchange concerned where possible and resend the information through a new, secure exchange. Assess whether this is a data breach. | | There is suspicious activity on an account | Review the available audit data and security notifications and follow the internal incident procedure. Report a suspected security incident to Databeamer at security@databeamer.io. | These are first leads. The right follow-up depends on the situation, the data involved and the agreements within the organisation. In case of a possible data breach, also assess whether notification duties and other legal obligations apply. If Databeamer itself establishes a breach affecting personal data of your organisation, we inform the security contact you designated within 24 hours of discovery at the latest (DPA chapter 9). This lets your organisation assess within its own 72-hour deadline whether notification to the supervisory authority is needed. See [Audit log](https://databeamer.eu/en/docs/account/audit-log) and the relevant account and transfer guides for the available functions. ## 6. Processors, agreements and compliance A secure technical architecture is one part of the assessment. Your organisation must also determine which personal data is processed, for which purpose, on the basis of which agreements and for how long the data is retained. ### Who is responsible for what? For the personal data your organisation processes through Databeamer, your organisation is the **controller**. Full Join B.V., the provider of Databeamer, is the **processor** for that processing under the DPA. For its own operations, including accounts, invoicing, security, support and the identity verification from section 4, Full Join is an independent controller. These processing operations are described in the privacy statement. The production environment runs at Scaleway in the Amsterdam region. The sub-processors are listed in chapter 10 of the DPA and are all European. You are informed in advance of changes in sub-processors. You can object within thirty days. ### Which documents do you use for the assessment? - **[Legal page](https://databeamer.eu/en/legal)**: the privacy statement, data processing agreement (DPA), the security policy, the terms of service and the cookie policy. - **[Compliance page](https://databeamer.eu/en/compliance)**: relevant standards, the status of our certification and the technical and organisational measures Databeamer takes. - **[DPIA support](https://databeamer.eu/en/docs/privacy-security-it/dpia-support)**: information about retention periods, access by Databeamer, sub-processors, data subject rights and the data breach procedure, ordered by the steps of a DPIA. Always assess this information in conjunction with the application within your own organisation. Your organisation remains responsible for its own processing purposes, the chosen set-up, access to information and the applicable retention periods. ## 7. What does your organisation have to check and arrange? Use the checklist below to translate the assessment into concrete agreements. Which topics take priority depends on the data you process and the way you use Databeamer. | Topic | What do you check or arrange? | Who do you align with? | | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | | **Purpose and legal basis** | Which personal data is processed through Databeamer, for which purpose and on which legal basis? Does this fit the records of processing activities? | Programme manager, process owner | | **DPA and privacy statement** | Do the DPA and the privacy statement fit the intended use? Are the arrangements for processors and sub-processors acceptable? | Procurement, legal | | **DPIA** | Is a DPIA needed? Use the [DPIA support](https://databeamer.eu/en/docs/privacy-security-it/dpia-support) and in any case include metadata, guest access and the audit trail. | Security officer, process owner | | **Visible metadata** | Which metadata remains visible? Could it reveal sensitive information in the chosen set-up? Is a naming guideline needed? | Organisation administrator, users | | **Guest access** | Which guest access options are allowed for which type of information? Is guest access by email allowed for special categories of personal data? | Security officer, programme manager | | **Access and group membership** | Do people only have access to the groups they need? How do joiners, movers and leavers flow? | IT manager, HR, organisation administrator | | **Retention and deletion** | How are retention periods, deletion and archiving arranged, also in case of key loss and changes in group membership? | Records management/archive, IT manager | | **Audit data** | Who may view audit data, for which purpose and how long are findings retained? | Security officer | | **Data breaches** | Is it clear when an incident is a data breach and who assesses the notification? Are roles and notification deadlines recorded? Is the security contact at Databeamer up to date? | Security officer, management | | **Data subject rights** | How are requests for access, rectification and erasure handled, taking encrypted content and visible metadata into account? | Organisation administrator, legal | | **Recovery policy** | How are lost devices, recovery phrases and requests for an account reset handled? | IT manager, security officer | ## 8. Where to find more information | Topic | Documentation | | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | Privacy statement, data processing agreement, security policy and cookie policy | [Legal page](https://databeamer.eu/en/legal) | | Relevant standards, certification and associated measures | [Compliance](https://databeamer.eu/en/compliance) | | Outline of the technology | [Technology](https://databeamer.eu/en/technology) | | Your own DPIA | [DPIA support for Databeamer](https://databeamer.eu/en/docs/privacy-security-it/dpia-support) | | Security and technology | [Databeamer for security officers and CISOs](https://databeamer.eu/en/docs/privacy-security-it/security-officers) | | Assessment before adoption | [Assess Databeamer before adoption](https://databeamer.eu/en/docs/privacy-security-it/adoption-review) | | Account, key generation and recovery | [Create your account](https://databeamer.eu/en/docs/getting-started/create-your-account) and [Recovery phrase and shares](https://databeamer.eu/en/docs/account/recovery-phrase) | | Devices and unlocking | [Devices and unlocking](https://databeamer.eu/en/docs/account/devices-and-unlock) | | Group keys and group membership | [Groups](https://databeamer.eu/en/docs/groups/groups) | | Organisation, roles and SSO | [Organisations](https://databeamer.eu/en/docs/groups/organizations) | | Files and malware check | [Upload and organise files](https://databeamer.eu/en/docs/files/upload-and-organise) | | Transfers and guest access | [Send a transfer](https://databeamer.eu/en/docs/transfers/send-a-transfer) and [Track and receive transfers](https://databeamer.eu/en/docs/transfers/track-a-transfer) | | Secure Mail | [Secure Mail](https://databeamer.eu/en/docs/transfers/secure-mail) | | Requests and submissions | [Create a request](https://databeamer.eu/en/docs/requests/create-a-request) and [Manage submissions to requests](https://databeamer.eu/en/docs/requests/manage-submissions) | | Chat | [Chat and direct messages](https://databeamer.eu/en/docs/chat/messaging) | | Journals | [Journals](https://databeamer.eu/en/docs/files/journals) | | Audit trail | [Audit log](https://databeamer.eu/en/docs/account/audit-log) | | Introducing it to users | [Roll Databeamer out to your users](https://databeamer.eu/en/docs/administrators/roll-out-to-your-users) | **Questions about privacy, compliance or support with a DPIA?** [Contact us](https://databeamer.eu/en/contact?topic=support) or email compliance@databeamer.io.