Solution · GDPR & NIS-2

GDPR-compliantfile transfer.No ifs or buts.

GDPR Art. 32 requires ‘state of the art.' SecureFiles meets it by default: encryption, integrity control, access control, logging. European hosting, EU jurisdiction, no CLOUD-Act exposure. For businesses that don't leave compliance to chance.

Request a demoSecureFiles in detail

Why standard file transfer isn't GDPR-compliant

Four structural gaps that standard mail, WeTransfer, and US cloud solutions no longer close in 2026.

Standard email isn't GDPR Art. 32-compliant

Unencrypted SMTP does not meet ‘state of the art.' With Art. 9 categories (health, religion, ethnicity) the violation becomes fineable.

US cloud falls under CLOUD Act

The US CLOUD Act (2018) obliges US companies to disclose data regardless of storage location. Dropbox, Google, Microsoft, all affected. EU hosting alone doesn't protect.

Missing deletion proof

GDPR Art. 17 requires the right to deletion. Without a retention policy and automatic deletion, every manual promise remains unprovable.

No audit trail for Art. 30

The Records of Processing Activities (ROPA) per Art. 30 needs provable log structures. Standard email doesn't provide them.

Compliance dashboard
Realtime · DPA · audit log
EU-Region
DSGVO
Art. 32 · TOM
BDSG
§ 64
C5
BSI Kriterien
TCDP
Typ 2
Audit log (excerpt)
●10:42anna@kunde.de·download · gutachten.pdf
●10:38martin@ihrefirma.de·upload · kampagne.zip (18 GB)
●10:29system·retention · 12 files deleted
Hosting the EU, no US cloud layerADV · AV-Vertrag
Compliance at a glance · Live dashboard

Meet GDPR obligations without thinking about them

Accountable, traceable, erasable: SecureFiles meets Art. 32 GDPR via technical and organizational measures, documents downloads and uploads, deletes automatically after retention, and delivers a DPA, C5-aligned controls and audit exports.

Hosting exclusively in the EU, no US cloud intermediate layer.

DPA (GDPR Art. 28) and supplementary clauses prepared.

Audit log with downloads, uploads, IP hash and retention events.

Retention periods configurable, enforced automatically instead of manually.

How SecureFiles implements Art. 32 in the product

Technical and organizational measures translated into concrete features.

1. Encryption in-transit and at-rest

TLS 1.3 during upload and download, AES-256 at rest. Key management in the EU, optionally stored in your own S3 bucket in Germany.

2. European hosting, EU jurisdiction

Data held by Impossible Cloud in Frankfurt am Main, ISO 27001 certified. A German provider under European law, with no disclosure obligation under the US CLOUD Act.

3. Audit log Art. 30 ready

Every transfer, every download, every policy violation in the central, exportable audit log. IP hashing protects log privacy.

Compliance features in the standard

Not as an add-on, included in every SecureFiles license.

GDPR Art. 32 mapping

Encryption, pseudonymization, integrity control, resilience, every technical and organizational measure mapped to concrete features.

NIS-2 ready

Audit log, access control, incident response hooks, and retention cover the Art. 21 minimum requirements of the NIS-2 directive.

DPA template

Ready-to-sign data processing agreement per GDPR Art. 28 on request, with subcontractor list and standard clauses.

Retention 7/10/30 days

Automatic deletion after configurable retention. Deletion is cryptographically effective, not just marker-based.

No CLOUD-Act exposure

EU jurisdiction, storage in Germany. No US parent as operating entity. Data processing agreement with the storage provider Impossible Cloud (Hamburg).

Privacy dashboard

Per-tenant overview of all active transfers, retention settings, data subject rights management. Deletion requests processable by click.

What GDPR requires, and what providers deliver

Direct mapping of GDPR obligation to product feature.

 
SecureFiles
Typical US cloud service
Encryption state of the art
TLS + AES-256 + optional E2E
Often TLS only, no E2E
EU jurisdiction
Yes, the EU
Often US provider
DPA available
Ready-to-sign template
Individually negotiable or missing
Audit log Art. 30
Standard
Rudimentary or add-on
NIS-2 mapping
Documented
Not available
Retention control
Configurable per tenant
Mostly fixed, not steerable
CLOUD-Act exposure
None
Yes, even with EU hosting

As of October 2026. The right-hand column describes the usual approach without Conbool, not a specific vendor.

FAQ on GDPR and file transfer

Is SecureFiles GDPR-compliant?
Yes, with technical explanation: SecureFiles meets the technical and organizational measures of GDPR Art. 32 by default. Encryption (in-transit TLS 1.3, at-rest AES-256), pseudonymization (IP hashing in the audit log), integrity control (signed links), resilience (multi-AZ), access control (Entra ID SSO, role-based). A ready-to-sign DPA per GDPR Art. 28 is available on request.
What exactly does GDPR Art. 32 say?
GDPR Art. 32 (Security of processing) requires ‘appropriate technical and organizational measures' per the state of the art. Explicitly listed: (a) pseudonymization and encryption, (b) confidentiality/integrity/availability/resilience, (c) recoverability after incident, (d) regular review and evaluation. SecureFiles implements all four points.
What is the CLOUD Act and why does it affect us?
The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) obliges US companies to hand over data on request from US law enforcement, regardless of where the data is physically stored. Even if Dropbox, Google, or Microsoft host in the EU, the Act applies to their parent companies. For GDPR-relevant data, that's a structural problem solved only by EU providers with EU corporate structure. SecureFiles is in the EU jurisdiction.
Are WeTransfer or Dropbox GDPR-compliant?
For private individual transfers it may be tolerable. For businesses with GDPR obligations, no: the provider holds the keys without a contractual framework, CLOUD-Act exposure exists, DPA structures per GDPR Art. 28 aren't scalable. German data protection publications (DG-Datenschutz, Proliance, DRACOON blog) document the weaknesses in detail.
What is a DPA and do I need one?
A Data Processing Agreement (DPA) per GDPR Art. 28 is mandatory once you have personal data processed by a service provider. Any business use of SecureFiles requires a DPA. We provide a standard template suitable for 95 % of scenarios. Individual adjustments are possible.
Must I encrypt file transfer under GDPR?
Not literally, but effectively yes. GDPR Art. 32 explicitly names encryption as an example of an appropriate technical measure. For special data categories (Art. 9: health, religion, ethnicity, sexual orientation), encryption is practically mandatory. The GDPR recitals (Rec. 83) also emphasize encryption's role in risk minimization.
How does SecureFiles help with NIS-2?
The NIS-2 directive obligates essential entities (Art. 21) to risk management measures in information security. SecureFiles covers directly: access control (Entra ID SSO, roles), cryptography (E2E option, AES-256), incident management (audit log + alerts), backup / recoverability (multi-AZ European hosting), supply chain (data processing agreement with Impossible Cloud, storage in Frankfurt am Main). Mapping table available.
Where do I find the DPA template?
We send the DPA template by email upon request, please contact us via the contact form. We deliberately keep it non-public so we can adapt clauses to your specific structure (e.g. subcontractor list, location extensions, industry-specific TOM).

Related solutions

Dateien aus SharePoint versenden

Aus SharePoint Online an Externe senden, ohne anonymen Freigabelink und ohne Gastkonto.

WeTransfer-Alternative

DSGVO-konformer Dateiversand aus der EU, ohne CLOUD-Act-Risiko.

Cryptshare-Alternative

Modulare deutsche Alternative mit Verschlüsselung und Schlüsselverwaltung in der EU.

FTP-Alternative

Sicherer Dateitransfer statt FTP — Outlook-Add-in, Audit-Log, NIS-2.

Sicherer Posteingang

Dateien sicher empfangen — persönlicher Upload-Link für Externe.

Große Dateien per Outlook

Outlook-Anhang zu groß? Direkt aus Outlook verschlüsselt versenden.

Datei-Upload-Formular

Dokumente strukturiert anfordern, geführte Checkliste statt E-Mail-Ping-Pong.

SharePoint-Alternative

Sichere gemeinsame Dateiräume für Externe, ohne Microsoft-Cloud.

Compliance without compromise.

Demo including DPA review. European hosting from day 1.

Request a demoSecureFiles in detail