What professional secrecy means for cloud services
Under Section 203 of the German Criminal Code (StGB), doctors, psychotherapists, lawyers, tax advisers and other professionals must not disclose secrets entrusted to them without authorisation. Since 2017, Section 203 (3) StGB allows them to involve service providers – such as cloud storage – as far as necessary.
The condition is in subsection 4: whoever involves a provider must ensure the provider is bound to secrecy, otherwise they may be liable themselves. For lawyers and tax advisers, Section 43e BRAO and Section 62a StBerG spell this out: a contract in text form, instruction on the criminal consequences, access only as far as necessary, clear rules for further providers.
Data protection applies as well: for personal data of your patients or clients you need a data processing agreement under Art. 28 GDPR. This is general guidance and not legal advice.
What SafeDoc offers
| Building block | At SafeDoc | Status |
|---|---|---|
| Storage location | Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now. | |
| Data processing agreement | On every paid plan, including individual accounts – one click, with timestamp and version, downloadable. | Built · launches with paid plans |
| Confidentiality agreement | Under Section 203 StGB, with instruction and passing the duty on to our service providers – one click in your account. | Built · launches with paid plans |
| No AI on your files | We do not use the contents of your files to train AI models and do not pass them on to providers of AI services. | |
| End-to-end vault | Files are encrypted on your device; only you hold the key. Not yet externally reviewed. | Beta invite only |
| Activity log | Important actions such as shares, role changes and deletions are logged. | |
| Two-factor requirement for teams | Organisations can require two-factor sign-in for all members. | Built · launches with Business plans |
More on technical safeguards on the security page; our service providers are listed under subprocessors.
For doctors and psychotherapists
Health data is a special category under Art. 9 GDPR. Healthcare professions have no separate service-provider rule like lawyers do; Section 203 StGB and your chamber's professional code apply. SafeDoc's confidentiality agreement is designed to document the commitment required by Section 203 (4) StGB.
The end-to-end vault is intended for particularly sensitive documents. It is a beta, not yet externally reviewed and currently invite only.
For lawyers
Section 43e BRAO requires a contract in text form that binds the provider to secrecy, instructs it on the criminal consequences, limits access to what is necessary and governs whether further persons may be involved. SafeDoc's agreement contains exactly these points.
If a service directly serves a single mandate, Section 43e (5) BRAO also requires the client's consent. You check this yourself.
For tax advisers
Section 62a StBerG is built like Section 43e BRAO: text form, commitment with instruction, access only as far as necessary, rules for further providers. For auditors Section 50a WPO applies, for notaries Section 26a BNotO, for patent attorneys Section 39c PAO. In the agreement you choose your profession; the matching rule then appears in the text.
How to conclude the agreements
- Create an account and choose a paid plan (from Plus). The free plan is intended for private use.
- Open Settings → Contracts in your account – for an organisation, its "Data processing" page.
- Enter your name or practice, address and representative, read the text, conclude.
- Save the agreements with timestamp, version and checksum as PDF or HTML and keep them with your records.
What we do not promise
Regular files are technically accessible to operations; access is restricted and logged. If you want to rule out that anyone but you can read the contents, you need end-to-end encryption – at SafeDoc that is the vault (beta).