Lawyers
Applies to: Germany
Encrypted file exchange for law firms
For everything outside the beA (the special electronic lawyers’ mailbox): documents for clients, the other party or experts, sent encrypted and with proof of when they were downloaded.
- Developed & operated in Germany
- End-to-end encrypted
- Contractual confidentiality (§ 203 StGB)
- Signed proofs of delivery
What your professional rules require and how TEPHIA SECURE meets them
| Requirement | How it is met |
|---|---|
| § 43a Abs. 2 BRAO, § 203 StGB Confidentiality regarding everything that has become known to you in the practice of your profession. | Your core duty. The other rows show what TEPHIA SECURE contributes. |
| § 43e BRAO For service providers, a contract in text form with a duty of confidentiality, notice of criminal liability, limitation of access and rules for further parties involved. Choosing the provider with care remains your duty. | The contract under § 43e Abs. 3 BRAO The duty of confidentiality and the notice of criminal liability are set out in clause 5a of the data processing agreement, which you conclude electronically, in text form, with a copy as a PDF. |
| § 2 Abs. 2 BORA Technical and organisational measures to protect client confidentiality that are appropriate to the risk and reasonable — as required by data protection law, otherwise in line with the state of the art. | State of the art AES-256-GCM encryption in the sender’s browser, with the key derived from the password using Argon2id. The server holds no key and cannot read the contents. |
How your proofs are secured
| In every planSignature with our certificate | Add-on · coming soonQualified electronic seal | |
|---|---|---|
| Any change to the PDF invalidates the signature | included | included |
| Timestamp from an independent authority | included | included |
| Hash chain with daily chain seal | included | included |
| Checksum (SHA-256) of every file, confirmed by the recipient | included | included |
| Verifiable online, without an account | included | included |
| Display in Adobe Reader | “Validity unknown”1 | Valid |
| Legal presumption of authenticity (Art. 35(2) eIDAS) | not included | included |
| Useful for | Your records, clients | Courts, authorities, the other party |
1 Not an error: our certificate is not on the EU trust list that Reader recognises. You can check integrity online or using the certificate fingerprint.
- Signature: any change is detected
- Timestamp from an independent authority
- Hash chain with daily chain seal
- Checksum of every file, confirmed by the recipient
- Verifiable online, without an account
- Adobe Reader shows “Valid” instead of “Validity unknown”
- Legal presumption of authenticity (Art. 35(2) eIDAS)
- Useful for courts, authorities, the other party
What else TEPHIA SECURE offers
For the other party too
Recipients do not need an account. Clients and third parties can send you documents through an upload box, with the same protection and the same proof of delivery.
Verifiable proof of delivery
Each entry is cryptographically chained to the previous one. The proof of delivery is a signed PDF/A with a timestamp from an independent time-stamping authority.
Frequently asked questions
Does § 2 BORA require a particular kind of encryption?
No. § 2 Abs. 2 BORA requires measures that are appropriate to the risk and reasonable for the legal profession: technical measures suffice if they meet data protection law, otherwise they must reflect the state of the art. The provision does not prohibit unencrypted e-mail. Here, files are encrypted end to end with AES-256-GCM in the sender’s browser.
Do I need consent for every mandate?
As a rule, no. § 43e Abs. 5 BRAO requires the client’s consent where a service serves one individual mandate. A file exchange service is general practice infrastructure, like e-mail or cloud storage, not a service for one particular mandate. Whether anything different applies in an individual case is for you to assess.
What must the contract with the service provider contain?
Under § 43e Abs. 3 BRAO, a contract in text form: a duty of confidentiality with notice of criminal liability, access only as far as the assignment requires, and rules for further parties involved. This is in clause 5a of the data processing agreement, which you conclude electronically during setup. Choosing the provider with care remains your duty.
There is no certification of services like this by a professional body, and carefully selecting a service provider remains your responsibility under your professional rules.
The information on the legal position on this page is general information, without any warranty as to completeness or currency, and does not constitute legal advice. Only our contracts are binding.