Security Policy

Version 2.0 — 23 September 2026

1. Introduction

Information security is a fundamental part of Databeamer.

Databeamer is a secure communication and collaboration platform provided by Full Join B.V. ("Full Join", "we", "us" or "our"):

Full Join B.V.
Philitelaan 57, unit 404B
5617 AK Eindhoven, the Netherlands
Chamber of Commerce (KvK) number: 71160620
Telephone: 040 209 4163
Email: hello@databeamer.io

The platform is designed to enable organizations and individuals to securely store and share confidential information and to communicate with one another.

This Security Policy describes the principal technical and organizational measures with which Full Join protects the confidentiality, integrity and availability of Databeamer and the data processed within it.

These measures are aligned with the nature and scale of Full Join, the architecture of Databeamer, and the risks we identify.

This Security Policy is a public summary of our internal security policy. Not all internal security measures are described publicly, because disclosing them could weaken the security of our systems.

2. Scope

This Security Policy applies to:

the Databeamer web application;
the Databeamer infrastructure;
Databeamer APIs and supporting services;
the production, development and test environments, to the extent relevant;
security and management processes relating to Databeamer;
employees, contractors and other persons who have access to relevant systems on behalf of Full Join;
suppliers and sub-processors, to the extent they are part of the service.

This policy covers both technical and organizational security measures.

For the processing of personal data on behalf of customers, the Data Processing Agreement additionally applies.

For a description of the cryptographic architecture and the cryptographic techniques used, please refer to the Technology page.

3. Organizational security

Information security is part of Full Join's day-to-day business operations. Roles, responsibilities and processes are structured to protect the security of Databeamer and the data processed through the service.

3.1 Responsibility for information security

Ultimate responsibility for information security within Full Join lies with the management board. Day-to-day coordination and oversight of security measures is assigned to the CISO.

Security is a shared responsibility within the team and forms part of the development, management and operation of Databeamer.

3.2 Information security management and continuous improvement

Full Join maintains a formal Information Security Management System (ISMS) with an accompanying information security policy. The ISMS is established in accordance with ISO/IEC 27001:2022 and the Annex A controls. The external certification process has been completed; formal finalization is pending the certification body's report.

Within the ISMS, among other things:

information security risks are identified and assessed;
controls are established and assigned to an owner;
the operation of controls is monitored;
improvements are identified and followed up;
the security policy is periodically reviewed.

Information security is a continuous process. We regularly review our measures and adjust them based on:

new threats and vulnerabilities;
changes to our services and architecture;
developments in cryptography and the state of the art;
developments in laws and regulations;
the results of audits and security testing;
incidents and the lessons learned from them.

3.3 Awareness and expertise

Full Join ensures that employees and other persons who carry out work for the organization have appropriate knowledge of, and awareness regarding, information security.

Security principles, responsibilities and relevant procedures form part of onboarding and are periodically reinforced.

3.4 Access management within Full Join

Full Join applies the principles of least privilege and need-to-know to its own employees, systems and administrative functions. Access is restricted to what is necessary for the relevant work and is reviewed periodically.

Management of customer users' access to organizations and workspaces is the responsibility of the relevant customer. Databeamer facilitates this through roles, permissions and access controls. This is further described in Chapter 6.

3.5 Suppliers and sub-processors

Full Join applies a risk-based approach when selecting and assessing suppliers. This assessment takes into account, among other things:

security level and technical security measures;
privacy and data protection;
place of establishment, ownership structure and legal context;
certifications and assurance information;
continuity and the relevant risks to Databeamer and its customers.

Where a supplier processes personal data on behalf of Full Join, appropriate contractual arrangements are made, including, where applicable, a data processing agreement. Suppliers are periodically evaluated, depending on their role and risk.

Where possible, we give preference to European suppliers and to suppliers whose ownership structure aligns with our principles regarding European data sovereignty.

The current list of sub-processors, their role and their processing location, is set out in the Data Processing Agreement, Chapter 10.

3.6 Separation of responsibilities

Full Join distinguishes between the responsibilities of Full Join as the provider of Databeamer and those of the customer as a user of the service.

Full Join is responsible for the security, availability and correct functioning of the Databeamer infrastructure and for the security measures that fall within its own area of management.

The customer is responsible for the use of Databeamer within its own organization, including granting and revoking user rights, managing workspaces, and carefully handling authentication and recovery data.

This division of responsibilities forms an important part of the security of the service.

4. Client-side encryption

This chapter contains the normative description of Databeamer's encryption architecture. The General Terms and Conditions, the Data Processing Agreement, the Privacy Statement and the Acceptable Use Policy refer to this chapter and describe only the consequences that fall within their own subject matter.

4.1 Protected customer content

Databeamer uses client-side end-to-end encryption for protected customer content. This encryption takes place in the user's own environment, before protected content is transmitted to the Databeamer infrastructure.

Protected content is stored on the server exclusively in encrypted form. Full Join does not hold sufficient key material to independently decrypt protected customer content into plaintext. Full Join therefore does not have normal access to the plaintext of protected customer content.

4.2 No universal master key

Databeamer is designed without a universal master key that would give Full Join access to all customer content. Key management uses multiple independent key components. No single component is sufficient to independently reconstruct the master key.

The technical details of this architecture, including the 2-of-3 key split, are described on the Technology page.

4.3 What may be visible

Client-side encryption does not mean that every form of metadata is invisible to the server.

To enable Databeamer to function, the following operational data may, among other things, be available:

account and identity data;
access rights and workspace relationships;
login and security events;
certain routing and status data;
technical data;
audit and system data;
counts or sizes of certain objects, where necessary for the service.

The exact data that is visible differs per functionality.

4.4 No substantive inspection

Full Join has no access to the plaintext of protected customer content and cannot therefore use it for substantive inspection, commercial profiling, or training AI models.

This is not solely an organizational commitment, but a consequence of Databeamer's technical architecture.

4.5 Delivery to recipients without a Databeamer account

Transfers, Requests, Forms and Mail make it possible to share information with recipients who do not have a Databeamer account. Two modes exist for such delivery, with deliberately different security properties.

Mode with sender password (sensitive delivery). The key with which the transmission is encrypted is derived, on the recipient's device, from a password that the sender provides to the recipient outside of Databeamer. That password never reaches our servers. The same principle set out in §4.1 applies to this mode: Full Join does not hold sufficient key material to decrypt the content.

Mode with email verification (non-sensitive delivery). For recipients who cannot be given a password, a more accessible mode exists. In this case, the transmission's key is stored in encrypted form under a non-exportable key within a European key management service. That key is unlocked only at the moment the recipient has verified themselves using a one-time code sent by email, and only for that single access. Every such unlock is recorded in the audit trail.

For this second mode, the zero-knowledge property described in §4.1 therefore does not apply to the same extent: a technical path exists through which the key for that transmission can be unlocked. We describe this explicitly because it reflects a deliberate trade-off between usability and confidentiality.

The sender chooses, per transmission, which mode is used. Transmissions can be withdrawn; doing so destroys the stored key material and invalidates the access tokens.

5. Cryptographic security

Databeamer uses modern, standardized cryptographic techniques. The current cryptographic architecture is described on our Technology page.

This includes, among other things:

authenticated encryption;
hybrid classical and post-quantum cryptography;
cryptographic hashing;
key derivation;
digital signatures;
key splitting.

The cryptographic implementation is periodically reviewed and may be adjusted where developments in cryptography, security or standards give reason to do so.

We avoid the use of custom-developed cryptographic algorithms where standardized or widely reviewed alternatives are available.

6. Identity, authentication and access management

6.1 Identity and accounts

Databeamer supports individual user accounts through which users authenticate and gain access to the parts of the service for which they are authorized.

Full Join applies appropriate measures to protect accounts and authentication means. Users are themselves responsible for the careful handling of their password, PIN, recovery phrase and other authentication or recovery data.

6.2 Authentication

Multi-factor authentication (MFA) is mandatory for all Databeamer user accounts: in addition to the password, a second authentication factor is always required to access the service. An exception applies to cases where the user logs in via SSO (see §6.5).

In addition, an extra factor is required before encrypted content becomes accessible on a device: the user unlocks their key material using a PIN in combination with the key share stored on that device.

Organizations that connect Databeamer to their own identity provider (§6.5) are themselves responsible for the authentication policy within that identity provider.

6.3 Authorization and roles

Access within Databeamer is governed on the basis of roles and access rights.

Depending on the context, rights may be granted at organization level and within individual workspaces. Databeamer supports various roles with corresponding permissions.

Access to specific Requests, Forms, Transfers and Mail is additionally determined by the persons linked to these items as an involved user or recipient.

6.4 User lifecycle and Seats

Management of the user lifecycle is a shared responsibility.

For personal use, a user may terminate their own account. Full Join may deactivate accounts that have not been used for an extended period in accordance with the applicable policy.

For use under an organizational contract, the organization itself determines which users are granted access and when that access is changed or terminated. This aligns with the Seats model: depending on the contract, the organization has a certain number of Seats and determines itself to which users these are assigned.

The organization owner and organization administrator manage users at organization level. The workspace owner and workspace administrator manage access within a workspace.

Organizations are expected to incorporate Databeamer into their own onboarding and offboarding processes.

6.5 Single Sign-On

Depending on the services chosen and the configuration, Databeamer can be connected to an organization's identity provider via Single Sign-On (SSO).

When SSO is used, the organization is responsible for managing identities and the user lifecycle within its own identity provider, including granting and revoking access.

Full Join is responsible for the security and functioning of the Databeamer integration within the agreed configuration.

6.6 Recovery

Databeamer uses recovery mechanisms that form part of the cryptographic key architecture.

Users are responsible for carefully safeguarding their recovery data. Where sufficient key material is lost, protected customer content can no longer be decrypted.

Full Join cannot recover or decrypt protected customer content outside of the cryptographic access structure.

6.7 Identity verification

Identity verification is an organizational measure against identity misuse within the service. The outcome is displayed as a Verification Mark next to the name of a user or organization.

Granting and withdrawal are carried out exclusively by authorized Full Join employees, via a restricted administrative channel. The employee's identity is derived from their authentication and cannot be self-declared. Every grant and withdrawal requires a justification and is recorded together with that justification; the status change and the corresponding audit event are processed in a single transaction.

Organizations with which Full Join has concluded an agreement are eligible for a Verification Mark. Persons working for such an organization may be granted a Verification Mark at the request of that organization's administrator. The mark is withdrawn as soon as the individual leaves the organization.

No identity documents are inspected, copied or retained for the purpose of identity verification.

The Verification Mark also expires automatically as soon as a verified piece of identity data changes. This check takes place at database level, so that profile changes, changes via the identity provider, and direct changes all follow the same rule. As a result, an earlier determination never remains attached to a changed identity. Expiry and withdrawal are final; a new grant requires a new verification.

A Verification Mark does not confer any rights or permissions within the service. Authorization proceeds exclusively through roles and access rights as described in §6.3.

7. Logging, monitoring and auditability

7.1 Security logging

Relevant system and security events are logged in order to:

detect security incidents;
investigate incidents;
flag unauthorized access;
analyze system issues;
make relevant actions auditable.

7.2 Audit data

Databeamer records audit data on relevant system and user actions. The nature and scope of this data differs per functionality.

Audit data may relate to:

access;
changes to rights;
relevant actions;
timestamps;
resource identification;
security events.

Part of the audit data is cryptographically signed by the user's client, so that it can subsequently be established that an action was performed by the holder of the relevant key material and that the record has not since been altered.

7.3 Protection and retention of logs

Security and audit data is protected against unauthorized alteration and access. Retention periods are established on the basis of security, operational, contractual and statutory requirements and are further described in the Data Processing Agreement, Chapter 13.

Audit data persists after the underlying content has been deleted: an audit trail that would disappear along with the content has no evidentiary value.

7.4 No plaintext customer content in standard logs

Protected customer content is not stored as plaintext in standard server logs. Client-side encryption prevents Full Join from logging or analyzing the content of such data in plaintext.

8. Application security

Full Join develops Databeamer according to the principles of secure software development.

Our development processes include, where relevant:

code review;
automated checks;
dependency and package management;
vulnerability management;
security testing;
input validation;
secure authentication and authorization;
protection against common web application vulnerabilities;
assessment of changes for security impact.

Where appropriate, automated security scans and additional security research are carried out.

8.1 Secure Software Development Lifecycle

Security is taken into account throughout the entire software development lifecycle, from design and development through testing, deployment, maintenance and decommissioning.

8.2 Vulnerabilities

We assess reported or internally discovered vulnerabilities for risk and take measures to mitigate or remediate them where necessary.

The priority and speed of handling is aligned with the severity and potential impact of the vulnerability, in accordance with the classification set out in Chapter 13.

9. Infrastructure and network security

The Databeamer infrastructure is protected by multiple technical security layers. These include, among other things:

network segmentation;
access restrictions;
firewalls;
secure administrative connections;
protection of public endpoints;
rate limiting;
measures against automated abuse;
protection against availability attacks and DDoS;
monitoring of relevant network activity.

The production environment is logically separated from development and test environments to limit the risk of unintended data exchange.

Administrative access to critical infrastructure is restricted to authorized persons and systems.

10. Separation of environments and data

Production, development and test environments are technically and organizationally separated from one another. Production data is not used in development or test environments.

Where test data is needed, synthetic, anonymized or otherwise suitable data is used.

Access to production environments is restricted to persons for whom such access is necessary.

11. Backup, recovery, availability and continuity

Full Join has established procedures for the backup, recovery and continuity of Databeamer, set out in a business continuity and disaster recovery plan that is periodically tested.

11.1 Backup

Depending on the type of data and the technical architecture, backups are made of:

critical service infrastructure;
configuration;
operational data;
other data necessary for the recovery of the service.

Protected customer content may form part of backup and recovery mechanisms where necessary for the persistence of the relevant functionality.

Backups are appropriately secured and stored within the European Union.

11.2 Recovery

We maintain runbooks for the recovery of critical systems. Infrastructure recovery is carried out exclusively through our infrastructure-as-code pipeline; manual changes to the production environment are not permitted.

Systems are restored only once the root cause has been established. Before a restored environment is reopened, two persons independently carry out a verification test on core functions.

Recovery procedures are tested at least annually, including a full recovery and identity-restore exercise in an isolated environment.

Cryptographic constraint on recovery. Full Join can restore encrypted customer data and metadata from backups, but customers can only access their data once they enter their own, locally managed recovery key (recovery phrase). Full Join does not hold a master key to enforce this centrally.

11.3 Availability and redundancy

Where possible, Databeamer's infrastructure is deployed redundantly across multiple zones within the Amsterdam region, so that an outage affecting part of the region has limited or no impact on the availability of the application.

Full Join has established internal recovery objectives (RTO and RPO) for the production platform and the identity infrastructure. These objectives are not part of this public policy; for customers with a Service Level Agreement, they are set out contractually.

11.4 Planned maintenance

Planned maintenance is, in principle, carried out outside office hours, on business days between 22:00 and 06:00 (Dutch time).

Maintenance during which Databeamer is wholly or partly unavailable is announced at least five business days in advance via the application and, where relevant, by email to the administrators of the relevant organization.

In the event of urgent security measures or incidents, prior notice may not always be possible. In that case, we will inform customers as soon as possible afterward.

11.5 Communication during major incidents

In the event of a major disruption, we communicate proactively, even where not all information is yet known:

an initial public notice within thirty minutes of activation of the disaster recovery plan;
thereafter, a progress update at least every hour, including an estimated recovery time as soon as one can be given;
following recovery, a formal confirmation by email, with an explanation of the consequences for the confidentiality of customer data.

We do not publish unconfirmed assumptions about the cause.

12. Data minimization

We process only data that is necessary for:

the functioning of Databeamer;
security;
access management;
support;
administration;
audit;
statutory and contractual obligations.

Client-side encryption means Full Join cannot view the plaintext of protected customer content. Data minimization is likewise pursued for operational and technical data.

Where sensitive data could unintentionally end up in technical logs, measures have been implemented to prevent, mask or remove it.

13. Incident management

Full Join maintains a documented incident management process for detecting, classifying, containing, resolving and evaluating security incidents.

Each incident is classified upon report. The classification determines the response time and escalation path:

Priority	Example	Initial response
P1 — Critical	Active attack, suspected breach of customer data, outage of all production clusters, suspected compromise of cryptographic keys	within 1 hour
P2 — High	Successful unauthorized access with no indications of data exfiltration, loss or theft of a device	within 4 hours
P3 — Normal	Identified vulnerability in production that has not yet been exploited	within 8 hours on a business day
P4 — Low	Potential policy deviation with no direct impact, routine report via the vulnerability reporting procedure	next business day

For an incident, we assess, among other things, the nature and scope, the systems involved, the possible consequences, the measures taken, the need for escalation, and the statutory or contractual notification obligations.

Following the closure of an incident classified as P1 or P2, we carry out an evaluation documenting the cause, detection, remediation and preventive measures, and assessing whether the ISMS needs to be adjusted.

The functioning of the incident response process is tested at least annually.

13.1 Notification periods

The notification periods toward customers, data subjects and supervisory authorities are set out in the Data Processing Agreement, Chapter 9, which describes in one place the timeframe within which we inform each party.

13.2 Customers with their own notification obligations

Full Join itself is not subject to the notification obligations under the NIS2 Directive or the Dutch Cyber Security Act (Cyberbeveiligingswet). Some of our customers are.

Our incident process is therefore designed to ensure that an affected customer receives, in good time, the information it needs to meet its own notification and information obligations, including those under the NIS2 Directive and the GDPR. The applicable 24-hour period for this is set out in Chapter 9 of the Data Processing Agreement.

14. European data sovereignty

European data sovereignty is a key principle underlying the design of Databeamer.

14.1 Hosting

Databeamer's production environment and the customer data stored within it are hosted within the European Union. Our primary hosting environment is located in the Amsterdam region.

For hosting, we use Scaleway, a European cloud provider.

14.2 Infrastructure

We design Databeamer's primary infrastructure so that customer data is processed and stored within the European Union.

We are not dependent on a US hyperscaler for the primary hosting of customer data.

14.3 Legal exposure

We select suppliers partly on the basis of their ownership structure, place of establishment and legal context.

The ownership and UBO structure of our primary hosting supplier contains no connection that would give a party outside the European Union control over the Databeamer infrastructure or over customer data.

The combination of European infrastructure, European suppliers and client-side encryption is intended to limit, as far as possible, exposure to foreign jurisdictions and unwanted access to customer data.

For any additional services under which personal data would be processed outside the European Economic Area, the requirements of applicable privacy legislation apply.

15. Personnel and security awareness

Information security is not solely a technical responsibility.

Persons who carry out work on behalf of Full Join that is relevant to information security:

are bound by confidentiality obligations;
receive appropriate security instructions;
are informed of relevant security risks;
receive training and awareness activities where needed;
are given access only to the systems and data necessary for their work.

Security awareness is maintained on an ongoing basis. Topics include, among other things, phishing, password and authentication security, the safe handling of confidential information, incident reporting, social engineering, and the secure handling of systems and equipment.

16. Reporting vulnerabilities

We encourage security researchers, customers and other individuals to responsibly report potential vulnerabilities to us.

A vulnerability can be reported via security@databeamer.io. For sensitive reports, our PGP option is available.

A report should preferably include a clear description, steps to reproduce the issue, relevant technical information, the potential impact, and any screenshots or other supporting evidence.

16.1 Responsible research

During security research, we expect researchers to:

not access data belonging to other users;
not alter or destroy data;
not cause a denial of service;
not gain unnecessary access to systems;
not exploit the issue beyond what is necessary to demonstrate the vulnerability;
give us a reasonable opportunity to investigate and resolve the issue before it is disclosed publicly.

16.2 Our commitment

Where a researcher complies with the rules set out above, Full Join will not report the matter to the police and will not take civil action against that researcher in connection with that research.

Where a researcher unintentionally accesses third-party data, reports this immediately, does not further distribute the data, and destroys it at our request, the same commitment applies.

This commitment does not affect Full Join's obligation to comply with a legally valid request from a competent authority.

16.3 Our response

We aim to acknowledge a valid report within five business days, to assess the report, to take measures where necessary, and to keep the reporter appropriately informed of progress.

The ultimate resolution time depends on the nature and severity of the report.

17. Audits, certification and assurance

Full Join periodically assesses the operation of its security measures through internal controls, risk analyses, security testing, independent assessments, certification audits and other assurance activities.

17.1 ISO/IEC 27001

Full Join's ISMS is established in accordance with ISO/IEC 27001:2022 and the Annex A controls. The external certification process has been completed; formal finalization is pending the certification body's report. Once certification has been formally granted, this policy will be updated accordingly.

17.2 NEN 7510, 7512 and 7513

Databeamer is also used by organizations in the healthcare sector. Full Join is therefore preparing for certification against NEN 7510 (information security in healthcare) and designs its services with regard to NEN 7512 (trust framework for data exchange) and NEN 7513 (logging of access to client data).

Databeamer's audit functionality, described in Chapter 7, is partly aligned with this last standard.

17.3 Information for customers

Where relevant, customers may make use of available security documentation, certifications and other assurance information, in accordance with the provisions of the Data Processing Agreement.

We do not provide information where its disclosure could reasonably jeopardize the security of Databeamer, of other customers, or of our suppliers.

18. Limitations and user responsibility

The security of Databeamer partly depends on the actions of users and customers.

Users are responsible for, among other things:

the careful handling of account data;
securing passwords and authentication means;
the safe storage of recovery data;
not sharing authentication means;
correctly configuring access rights;
promptly reporting suspected security incidents.

In particular, due to the zero-knowledge architecture, Full Join cannot recover what cannot technically be reconstructed. Where users fail to retain sufficient key material or recovery data, protected customer content may be irrecoverably lost.

This is a direct consequence of the design of the security architecture, and not something Full Join can resolve through a backdoor or a universal recovery code.

19. Relationship to other documents

Information security and privacy are closely connected. This Security Policy describes the security measures; it does not describe the legal basis or the retention period of each individual processing activity.

This Security Policy should be read in conjunction with:

the Privacy Statement, which describes Full Join's processing of personal data;
the Data Processing Agreement, which sets out Full Join's obligations as processor, including the incident notification periods (Chapter 9), the sub-processor overview (Chapter 10), and the retention periods (Chapter 13);
the General Terms and Conditions;
the Acceptable Use Policy;
the Cookie Policy;
the Technology page, which describes the technical and cryptographic details.

20. Changes to this Security Policy

We may amend this Security Policy where:

our services change;
our technical architecture changes;
security measures are adjusted;
new security risks arise;
laws and regulations change;
changes are necessary for certification or compliance purposes.

The version number and date at the top of this document indicate which version applies and when it was last updated.

21. Contact

Do you have questions about Databeamer's information security, or would you like to report a security vulnerability?

Security reports: security@databeamer.io
Compliance and other questions: compliance@databeamer.io
General: hello@databeamer.io or 040 209 4163

Full Join B.V.
Philitelaan 57, unit 404B
5617 AK Eindhoven, the Netherlands
Chamber of Commerce (KvK) number: 71160620