Assess Databeamer before adoption

The situation. Your organisation wants to use Databeamer for confidential documents and personal data. Before you sign off, you need to know what it protects, what it does not, and which choices are yours to make. This guide walks that review in order; each step points to the page that holds the evidence.

What you will use. Databeamer for security and privacy officers, the Security details blocks on the feature pages, and the compliance page.

1. Confirm the protection model #

Read the overview and check it against your requirements:

• Content is encrypted on the device and the provider holds no keys. Confirm what "content" covers in the table of what the server can see.
• Algorithms are current standards with post-quantum hybrids. Confirm these meet your cryptographic policy.
• Key custody is with the user, split 2-of-3. Confirm your organisation accepts that the provider cannot recover an account.

2. Walk the data flows you will actually use #

For each feature your organisation will use, open its page and read the Security details:

You will use	Read	Decide
Drive and shared folders	Upload and organise files, Groups	Whether the hash-based threat scan is acceptable for your data.
Transfers to people without an account	Send a transfer, Open a transfer	Which guest unlock mode is allowed for which data class; passphrase has no escrow.
Requests and intake forms	Create a request, Manage submissions	Retention and deadline defaults; who may be a reader.
Secure Mail	Secure Mail	Whether guest access and recall meet your needs.
Chat	Chat and direct messages	Whether metadata visible to the server (who talks to whom, when) is acceptable.
Journals with labels	Journals, Set up your organisation	A label policy: categories only, never personal data.

3. Review identity and access #

• Decide on single sign-on and whether password login stays enabled; see Organisations.
• Note that SSO grants no keys and that a new SSO user is approved by an administrator's device. Decide who approves.
• Map your roles onto owner, admin, member and reader, and record that administration is not access to content; see Your role as organisation administrator.

4. Set the device and recovery policy #

• Where do staff store their recovery phrase? A password manager, a sealed envelope, or both. Write it down.
• Is passkey unlock required, allowed or discouraged on managed devices? See Devices and unlocking.
• Who may request an account reset, and under which conditions? A reset destroys the user's personal data; see Roll Databeamer out to your users.
• Require at least two devices per user where practical, so losing one is not an emergency; see Set up a second device.

5. Check the audit and incident side #

• The audit log is per account and per group, signed by the acting device and sealed into hash-chained epochs. Confirm it covers the events your policy needs and decide who reviews it, how often.
• Walk the incident pointers in the overview: lost device, departure, misdirected transfer, exposed passphrase.
• Agree an offboarding order with the administrators; see Offboard someone who left.

6. Record the residual risks #

Write down, so nobody rediscovers them later:

• Metadata is visible to the provider: identities, names of groups, labels, who exchanges with whom.
• Code-by-email guest access places the key in escrow for that transfer.
• Key rotation protects future content, not content a removed member already decrypted.
• Lost devices plus a lost recovery phrase mean a lost account.

7. Confirm hosting and compliance #

Hosting, processors, certifications and the standards Databeamer is assessed against are maintained on the compliance page, not in these docs. Check it against your supplier requirements and ask for the documents you need through contact.

What you end up with #

A short record of which features are in scope, which guest unlock mode is allowed for which data, the label policy, the recovery-phrase and reset policy, who approves SSO users and reviews the audit log, and the accepted residual risks. Hand it to the organisation administrators: it is the input for Set up your organisation.