Auditors
Applies to: Germany
Encrypted file exchange for auditors
Request documents from clients, deliver reports: encrypted and with proof of delivery, without the client needing an account.
- Developed & operated in Germany
- End-to-end encrypted
- Contractual confidentiality (§ 203 StGB)
- Signed proofs of delivery
What your professional rules require and how TEPHIA SECURE meets them
| Requirement | How it is met |
|---|---|
| § 43 Abs. 1 WPO, § 203 StGB Confidentiality regarding everything that becomes known to you in the practice of your profession. | Encrypted, with no key held by the provider AES-256-GCM in the browser; the server holds no key. |
| § 50a WPO For service providers, a contract in text form with a duty of confidentiality, notice of criminal liability, limitation of access and rules for further parties involved; abroad only where the protection of secrets is comparable. | The contract under § 50a Abs. 3 WPO The duty of confidentiality and the notice of criminal liability are set out in clause 5a of the data processing agreement, which you conclude electronically, in text form, with a copy as a PDF. |
How your proofs are secured
| In every planSignature with our certificate | Add-on · coming soonQualified electronic seal | |
|---|---|---|
| Any change to the PDF invalidates the signature | included | included |
| Timestamp from an independent authority | included | included |
| Hash chain with daily chain seal | included | included |
| Checksum (SHA-256) of every file, confirmed by the recipient | included | included |
| Verifiable online, without an account | included | included |
| Display in Adobe Reader | “Validity unknown”1 | Valid |
| Legal presumption of authenticity (Art. 35(2) eIDAS) | not included | included |
| Useful for | Your records, clients | Courts, authorities, the other party |
1 Not an error: our certificate is not on the EU trust list that Reader recognises. You can check integrity online or using the certificate fingerprint.
- Signature: any change is detected
- Timestamp from an independent authority
- Hash chain with daily chain seal
- Checksum of every file, confirmed by the recipient
- Verifiable online, without an account
- Adobe Reader shows “Valid” instead of “Validity unknown”
- Legal presumption of authenticity (Art. 35(2) eIDAS)
- Useful for courts, authorities, the other party
What else TEPHIA SECURE offers
Requesting documents
An upload box receives files from the client, encrypted in the client’s browser. You are notified as soon as something arrives.
Proof for the working papers
A signed PDF/A with a timestamp from an independent time-stamping authority.
Frequently asked questions
Is a particular transmission technology required?
No. No professional statute and no chamber prescribes a particular technology. What is required is confidentiality, safeguards appropriate to the risk and, as soon as a service provider is involved, a contract under § 50a WPO. Here, files are nevertheless encrypted end to end, with no key held by the provider.
What must the contract with the service provider contain?
Under § 50a Abs. 3 WPO, a contract in text form: a duty of confidentiality with notice of criminal liability, access only as far as the assignment requires, and rules for further parties involved. This is in clause 5a of the data processing agreement, which you conclude electronically during setup. Choosing the provider with care remains your duty.
What does the provider see of my documents?
Not the contents: they are encrypted in the browser, and the server holds no key. What is readable is the information the proof of delivery needs: file names, sizes, times, IP addresses and, if the service sends the link, the recipient’s address. A file name can itself be a secret.
There is no certification of services like this by a professional body, and carefully selecting a service provider remains your responsibility under your professional rules.
The information on the legal position on this page is general information, without any warranty as to completeness or currency, and does not constitute legal advice. Only our contracts are binding.