File transferwith a DPA.Encrypted and logged.
GDPR Art. 32 requires appropriate measures in line with the state of the art. SecureFiles provides encryption, integrity control, access control and logging. Storage in Germany, contracting party in Germany.
Where standard file transfer reaches its limits
Four questions that come up when sending personal data.
Unencrypted email
GDPR Art. 32 names encryption as an appropriate measure. With special categories under Art. 9, such as health data, the requirements rise. What is sufficient in a given case is for the controller to assess.
Clarify provider and location
Storage location alone says little. Contracting party, subprocessors and data flows matter too, because depending on where a provider is based, foreign law may apply, such as the US CLOUD Act.
Evidencing deletion
GDPR Art. 17 governs the right to erasure. Without set retention and automatic deletion, it is hard to show that files were removed.
Traceability
With standard transfer it is often impossible to trace who sent what and when. That makes accountability under GDPR Art. 5(2) harder.
Logs, retention and DPA in one place
Traceable and erasable: SecureFiles logs downloads and uploads, deletes automatically when retention ends, and provides a DPA and audit exports.
Servers in Germany, data held in the EU.
DPA (GDPR Art. 28) and supplementary clauses prepared.
Audit log with downloads, uploads, IP hash and retention events.
Retention periods configurable, enforced automatically instead of manually.
What SecureFiles contributes to Art. 32
Technical and organizational measures translated into concrete features.
1. Encryption in-transit and at-rest
TLS 1.3 during upload and download, AES-256 at rest. Key management in the EU, optionally stored in your own S3 bucket in Germany.
2. Storage in Germany
Default storage with Impossible Cloud GmbH in Frankfurt am Main, certified to ISO/IEC 27001. The contracting party is Conbool GmbH in Hamburg. The DPA names every subprocessor and location, including those based outside the EU.
3. Audit log
Every transfer, every download, every policy violation in the central, exportable audit log. IP hashing protects log privacy.
Compliance features in the standard
Not as an add-on, included in every SecureFiles license.
Measures under GDPR Art. 32
Encryption, pseudonymization, integrity control and resilience. The technical and organizational measures are described in the DPA.
Designed for NIS-2
Audit log, access control and retention support measures under Art. 21 of the NIS-2 directive. The obligations themselves remain with your organization.
DPA publicly available
Data processing agreement per GDPR Art. 28 at conbool.com/en/dpa, with every subprocessor and location.
Retention set per rule
Automatic deletion after the retention that the rule sets.
Storage in Germany
Default storage in Germany. Data processing agreement with the storage provider Impossible Cloud (Hamburg).
Overview per organization
Overview per organization of active transfers and retention per rule.
End-to-end on request
The browser encrypts files, file names and the cover text before they leave the computer. The server stores only ciphertext and cannot read it. The malware scan then no longer applies.
Central rules and protection
Central rules are set by your administration, for everyone or per user, group or domain. They cover access level, password, end-to-end and retention. The server enforces every rule on every send.
Confirmation and log
If required, anyone who opens a public link confirms their address with a code. The sender then sees who has retrieved the file. The log records every significant action, including those of guests.
What matters in file transfer
What SecureFiles delivers, and what to check with any provider.
SecureFiles | Check with the provider | |
|---|---|---|
| Encryption | TLS 1.3, AES-256, optional end-to-end | At rest as well? End-to-end available? |
| Contracting party and storage location | Conbool GmbH, storage in Germany | Where is the data held, who is the contracting party? |
| DPA per GDPR Art. 28 | Public at conbool.com/en/dpa | Is there a DPA, and does it fit your use? |
| Audit log | Standard | Is every download logged, can the log be exported? |
| Subprocessors | Named in the DPA, including outside the EU | Are all named, with location and role? |
| Retention | Set per rule | Can you set the period yourself? |
| Third-country links | Stated in the DPA | Does foreign law apply to the provider, such as the US CLOUD Act? |
FAQ on GDPR and file transfer
How does SecureFiles support GDPR requirements?
What exactly does GDPR Art. 32 say?
What does the US CLOUD Act govern?
Is a free service enough for file transfer?
What is a DPA and do I need one?
Must I encrypt file transfer under GDPR?
How does SecureFiles help with NIS-2?
Where do I find the DPA?
Related solutions
Dateien aus SharePoint versenden
Aus SharePoint Online an Externe senden, ohne anonymen Freigabelink und ohne Gastkonto.
WeTransfer-Alternative
Dateiversand mit AVV, verschlüsselt und protokolliert.
Cryptshare-Alternative
Modulare deutsche Alternative mit Verschlüsselung und Schlüsselverwaltung in der EU.
FTP-Alternative
Sicherer Dateitransfer statt FTP — Outlook-Add-in, Audit-Log, NIS-2.
Sicherer Posteingang
Dateien sicher empfangen — persönlicher Upload-Link für Externe.
Große Dateien per Outlook
Outlook-Anhang zu groß? Direkt aus Outlook verschlüsselt versenden.
Datei-Upload-Formular
Dokumente strukturiert anfordern, geführte Checkliste statt E-Mail-Ping-Pong.
SharePoint-Alternative
Sichere gemeinsame Dateiräume für Externe, ohne Microsoft-Cloud.
Cloud als Netzlaufwerk
Pools im Explorer und Finder einbinden, ohne VPN und ohne Software.
File transfer with clear contracts.
Demo including a look at the DPA. EU hosting from day one.