Tax advisers
Applies to: Germany
Encrypted file exchange for tax advisers
Annual accounts, tax returns, management accounts (BWA), payroll documents: you send them encrypted, your client downloads them with a link and password, and you receive proof of delivery for your records. Your client needs neither software nor an account.
- Developed & operated in Germany
- End-to-end encrypted
- Contractual confidentiality (§ 203 StGB)
- Signed proofs of delivery
What your professional rules require and how TEPHIA SECURE meets them
| Requirement | How it is met |
|---|---|
| § 57 Abs. 1 StBerG, § 5 BOStB, § 203 StGB Confidentiality regarding everything that becomes known to you in the practice of your profession — under both professional and criminal law. | Your core duty. The other rows show what TEPHIA SECURE contributes. |
| § 62a StBerG Anyone who engages a service provider needs a contract in text form: a duty of confidentiality with notice of criminal liability, access only as far as necessary, rules for further parties involved. Choosing the provider with care remains your duty. | The contract under § 62a Abs. 3 StBerG The duty of confidentiality, the notice of criminal liability, the limitation of access and the binding of further parties involved are set out in clause 5a of the data processing agreement. You conclude it electronically during setup, in text form, and receive a copy as a PDF. |
| Hinweise der Bundessteuerberaterkammer zur E-Mail-Kommunikation (2019) Encryption is recommended. Unencrypted transmission only with the client’s consent — for annual accounts, tax returns and management accounts only with specific consent for exactly these documents, and for third-party data such as payroll documents not at all. | More than the Chamber recommends End-to-end rather than just transport encryption: the file is encrypted in your browser and stored on the server without a key. Because nothing is sent unencrypted, you do not need individual consent — not even for payroll documents. |
How your proofs are secured
| In every planSignature with our certificate | Add-on · coming soonQualified electronic seal | |
|---|---|---|
| Any change to the PDF invalidates the signature | included | included |
| Timestamp from an independent authority | included | included |
| Hash chain with daily chain seal | included | included |
| Checksum (SHA-256) of every file, confirmed by the recipient | included | included |
| Verifiable online, without an account | included | included |
| Display in Adobe Reader | “Validity unknown”1 | Valid |
| Legal presumption of authenticity (Art. 35(2) eIDAS) | not included | included |
| Useful for | Your records, clients | Courts, authorities, the other party |
1 Not an error: our certificate is not on the EU trust list that Reader recognises. You can check integrity online or using the certificate fingerprint.
- Signature: any change is detected
- Timestamp from an independent authority
- Hash chain with daily chain seal
- Checksum of every file, confirmed by the recipient
- Verifiable online, without an account
- Adobe Reader shows “Valid” instead of “Validity unknown”
- Legal presumption of authenticity (Art. 35(2) eIDAS)
- Useful for courts, authorities, the other party
What else TEPHIA SECURE offers
Nothing needed on your client’s side
No software, no account, no certificate — just a link, and a password sent through a separate channel. For documents coming the other way, you set up an upload box.
Proof for your records
When and by whom files were downloaded is recorded in a signed PDF/A with a timestamp from an independent time-stamping authority — verifiable even without us.
Frequently asked questions
Do I need my client’s consent?
Not for encrypted transfer. Under the guidance of the German Federal Chamber of Tax Advisers (Bundessteuerberaterkammer) on e-mail communication (2019), consent is needed for unencrypted transmission, and for annual accounts, tax returns and management accounts (BWA) specifically for those documents. Nothing is sent unencrypted here, so no individual consent is needed, not even for payroll documents and other third-party data.
Isn’t transport encryption enough?
According to the Chamber’s guidance, yes. No chamber requires end-to-end encryption. Here, files are nevertheless encrypted end to end: the file is encrypted in your browser, and the server holds no key. That is more than the Chamber recommends.
What must the contract with the service provider contain?
Under § 62a Abs. 3 StBerG, a contract in text form: a duty of confidentiality with notice of criminal liability, access only as far as the assignment requires, and rules for further parties involved. This is in clause 5a of the data processing agreement, which you conclude electronically during setup. Choosing the provider with care remains your duty.
There is no certification of services like this by a professional body, and carefully selecting a service provider remains your responsibility under your professional rules.
The information on the legal position on this page is general information, without any warranty as to completeness or currency, and does not constitute legal advice. Only our contracts are binding.