Privacy Policy
For the TEPHIA SECURE service. Last updated: 22 October 2026
This translation is provided for information only. Only the German version is legally binding: Datenschutzerklärung (German).
1. Controller
bitnacs GmbH, Humboldtstr. 18, D-65189 Wiesbaden
Represented by the Managing Director: Jascha Mettmann
Phone: +49 611 2368210 · Email: connect [at] tephia [dot] com
Please send any questions about data protection to privacy [at] tephia [dot] com.
2. Two distinct roles
For the content you transfer — files, file names, details of recipients — the organisation using the service is responsible. We process this data exclusively on its instructions as a processor under Art. 28 GDPR. The basis for this is the data processing agreement we conclude with every customer. If you have any concerns regarding this data, please contact the organisation from which you received the link.
For the data of the contractual relationship — registration, accounts, billing, abuse prevention — we ourselves are the controller within the meaning of Art. 4(7) GDPR. The following applies to this data.
3. What we process
Account and sign-in
Email address, name (where provided), role, sign-in method and time of the last sign-in. When
signing in via Microsoft Entra ID, additionally the identifier of your account and of your
directory. When signing in with a password, we store its hash value (scrypt), never the
password itself, as well as the encrypted key for two-factor sign-in or the public parts of
your security keys.
Purpose: Provision of the service and access protection. Legal basis:
Art. 6(1)(b) GDPR (contract).
Records of transactions
For each transaction we record: time, type of transaction, addresses involved, file name and
size, the checksum (SHA-256) of each file, IP address and the approximate location derived from
it (country and city). These
entries are linked by a hash chain and cannot subsequently be altered without detection — this
is the core of the service: a robust proof of delivery.
Purpose: Proof of sending and download to courts, clients and supervisory
authorities. Legal basis: Art. 6(1)(b) GDPR, for external recipients
Art. 6(1)(f) GDPR (legitimate interest in being able to prove delivery).
Password of an upload box. When you create an upload box, your browser
transmits its password to us once, and we send it by email to your own address — via our
email delivery, i.e. Microsoft and Hornetsecurity (Section 5). We do not store the password and
do not write it to any log; we only record when and to which address the email was sent. The
email itself is neither filed in our mailbox nor archived; it is stored only on your side.
Microsoft and Hornetsecurity merely forward it for delivery.
Purpose: The password should not get lost; without it, the stored files can no longer
be opened, not even by you. Legal basis: Art. 6(1)(b) GDPR.
Opening a link from an email. When the service sends a download or upload box
link by email, each link contains its own identifier. When the recipient opens the page, we
record the time, IP address, approximate location and the recipient address to which this link
was sent — even if the file is not subsequently downloaded. This is only recorded when the page
is loaded, not when the email is opened; we do not use tracking pixels.
Purpose: Proof for the sender of whether and when their message arrived.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the sender in proof of
delivery).
Checking the recipient domain. Before the service sends a link by email or
approves addresses for a shared link, we query via DNS whether the domain of the recipient
address accepts emails. Only the domain name is queried, not the address; the query runs via
the name servers of our hosting provider (Section 5). We keep the result in memory for no more
than one hour and do not store it. Whether an address contains a typo in a common email
domain is checked solely by your browser.
Purpose: Avoiding misdelivery caused by typos. Legal basis: Art. 6(1)(b)
GDPR, for external recipients Art. 6(1)(f) GDPR.
Undeliverable emails. Every email that the service sends to a recipient
carries a random identifier. If it is returned as undeliverable, the mail server's notification
goes to our sender mailbox. There we read such notifications automatically and match them to
the dispatch using the identifier or, failing that, the recipient address. For the dispatch,
we store the time, recipient address and delivery status (“undeliverable”, error code, the
shortened response of the receiving mail server); the sender receives a notification, and the
event is noted in the record. We do not store the remaining content of the notifications.
Purpose: The sender should learn that their link did not arrive and be able to send it
to the correct address. Legal basis: Art. 6(1)(b) GDPR, for external recipients
Art. 6(1)(f) GDPR (legitimate interest of the sender in proof of delivery).
Files
Encrypted data blocks, file name, size and expiry time. We cannot decrypt the content. As soon
as all recipients have downloaded the file, it is deleted; if unused, at the latest when the
period expires. Large files arrive in parts; an aborted upload is deleted after no more than
25 hours.
Legal basis: Processing on behalf of the customer, see Section 2.
The encrypted files are kept in the object storage of our hosting provider (Section 5). On retrieval, the recipient's browser downloads the file directly from there, via an address that is valid for only a few minutes. In doing so, the hosting provider sees the recipient's IP address and the file as ciphertext, but not its content and not the file name.
Billing
Organisation name, billing address, VAT identification number, plan and payment history.
Payment details — bank account or card — are neither collected nor stored by us; they are
entered exclusively on the pages of our payment service provider.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with the
retention obligations under commercial and tax law.
Referral programme
If an organisation registers via another organisation's referral link, we record which
organisation made the referral. As soon as the referred organisation pays for the first time,
and regularly thereafter, we compare an identifier of the payment method generated by our
payment service provider (not the card or account number), the VAT identification number
and the billing address with those of the referring organisation in order to rule out abuse. The referring organisation only learns
numbers and its discount, no names.
Legal basis: Art. 6(1)(b) GDPR (operation of the programme) and
Art. 6(1)(f) GDPR (protection against abuse).
Abuse prevention
Reports of abusive use, counters for rate limiting and an irreversible checksum of the
reporting person's IP address. We do not store the address itself in this context. We may
reject requests from certain countries to protect the service; for this purpose, we derive the
country from the IP address when the service is accessed and count rejected requests per
country, without addresses.
Legal basis: Art. 6(1)(f) GDPR (protection of the service and of third parties).
Server logs
When the service is accessed, technical information is logged: IP address, time, requested
address, status code, browser identifier.
Purpose: Operation, troubleshooting and defence against attacks. Legal basis:
Art. 6(1)(f) GDPR.
Audience measurement
To find out how our pages are used and into which languages we should translate them, we
count visits to our public pages on our own server — without cookies, without third-party
scripts and without storing anything on your device. We store the page visited (without
identifiers from download and upload links), the time, the first language requested by your
browser, device type, browser and operating system, the page you came from (only its address),
campaign information from the link, and the country, region and city that we derive from your
IP address when the page is accessed. We do not store the IP address itself for this purpose. In
order to count the visitors of a given day, we create an irreversible checksum from the IP
address and browser identifier together with a random value that is newly generated every day
and deleted on the following day; this means that nobody can be recognised across days. We do
not count search engines and other programs. The data does not leave our server.
Legal basis: Art. 6(1)(f) GDPR (improvement of our offering and planning according to
demand). You may object to this (Art. 21 GDPR); to do so, please write to us.
4. Cookies and browser storage
We use only technically necessary cookies: one for your session after sign-in, and one for the language if you choose it yourself. In your browser's storage, we only place what you trigger yourself: the chosen display mode (light or dark), the intermediate state of a sign-in with Microsoft while it is in progress, and your sign-in in the Outlook add-in. All of this is strictly necessary for the service you have requested within the meaning of § 25(2) TDDDG (German Telecommunications and Digital Services Data Protection Act); consent is not required for this. Audience measurement (Section 3) works without cookies and without browser storage. We do not use any third-party analytics or advertising services, no cross-site tracking and no third-party embedded content.
5. Recipients and processors
We work with the following service providers to provide the service:
| Service provider | Purpose | Place of processing |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen | Operation of the servers and the database, object storage for the encrypted files, encrypted backups, name resolution (DNS) | Data centres in Germany (Falkenstein/Vogtland and Nuremberg); German company without a parent company outside the EU |
| Microsoft Ireland Operations Ltd. | Sign-in via Microsoft Entra ID, sending of our emails via Microsoft Graph | EU, group of companies with possible access from third countries on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Hornetsecurity GmbH, Am Listholze 78, 30177 Hannover | Delivery of our outgoing emails (forwarding, virus and spam scanning) | Data centres in Germany |
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | Delivery of the send check of the Outlook add-in (two program files that Outlook loads on every send; Cloudflare sees the IP address and browser identifier, no content, files or recipients), name servers for our domains | Global network, for users in Europe usually from European data centres; transfer to the USA on the basis of the EU-US Data Privacy Framework and the EU Standard Contractual Clauses |
| Stripe Payments Europe Ltd., Dublin | Payment processing, invoicing, tax calculation | EU, with transfer to the USA on the basis of the EU Standard Contractual Clauses |
Contracts pursuant to Art. 28 GDPR are in place with all processors. IP addresses are mapped to an approximate location using a local database on our server (IP Geolocation by DB-IP, licensed under CC BY 4.0); no data is transmitted to third parties in the process.
Beyond this, we only disclose data if we are legally obliged to do so or if you have given your consent.
6. Retention period
| Data | Duration |
|---|---|
| Encrypted files | Until all recipients have downloaded them, at most until the expiry of the period chosen by the customer (default: 7 days) |
| Parts of an aborted upload | No more than 25 hours |
| Identifier of a sent email; note of which notifications have been read | 30 days |
| Response of the receiving mail server for undeliverable emails | Same as the records of transactions (next row) |
| Records of transactions | 6 to 120 months, as chosen by the customer (default: 12 months). After that, the personal content is cleared; the chain itself remains as proof of completeness — at most until deletion after the end of the contract |
| Accounts and all data of a customer after the end of the contract | After the end of the contract (including after a trial period that is not extended), sign-in and records remain accessible for a further 30 days so that the customer can back them up. After that, we completely delete accounts, files, upload boxes and records; the owner receives an announcement and a reminder beforehand and a confirmation afterwards |
| Invoice and accounting data | 10 years pursuant to § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code) |
| Server logs | No more than 14 days |
| Audience measurement | Visits without IP address: 400 days; the random value for the checksum is deleted on the following day |
| Abuse reports | 12 months after completion of the review |
7. Your rights
You have the following rights against us:
- access to the data stored about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- objection to processing based on a legitimate interest (Art. 21 GDPR).
You may withdraw any consent you have given at any time with effect for the future.
If your request concerns content that an organisation has sent or received via the service, please address it to the organisation itself — we may only act there on its instructions and will forward your request without undue delay.
8. Right to lodge a complaint
You may lodge a complaint with a supervisory authority at any time, for example with the authority responsible for you in your country of residence or with the authority responsible for us:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163, 65021 Wiesbaden
datenschutz.hessen.de
9. Security
Data is transmitted exclusively in encrypted form (TLS). Files are additionally end-to-end encrypted in the browser (AES-256-GCM, key derivation with Argon2id). Accounts are protected by two-factor sign-in, and access to records is logged. Customers receive further information on the technical and organisational measures as an annex to the data processing agreement.
10. Changes
We adapt this policy when the service or the legal requirements change. The version published here at the relevant time applies.
Guide · Security · Imprint · Privacy · Terms · Back to the application
