Skip to content

Data flows and personal data

Which personal data Krywerk processes where, where it flows to and how long it is kept. A basis for the record of processing activities, privacy notices and data protection impact assessment of the organization that uses Krywerk. This document is not legal advice; the legal assessment is made by the controller.

As of version 0.9 (2026-10).

1. Overview

flowchart LR
  P["Person"] -->|Sign-in in the browser| IDP["Identity provider<br/>(Keycloak, Entra ID)"]
  P --> APP["Krywerk app<br/>(own computer)"]
  APP -->|"Access token, device/key data (HTTPS)"| KS["Krywerk Server<br/>(organization)"]
  KS -->|"Verify keys (JWKS)"| IDP
  APP -->|"encrypted files only"| CLOUD["Storage location<br/>(OneDrive, Nextcloud, NAS …)"]
  ADM["IT administration"] -->|Web administration| KS
  • Without team folders (personal vaults and Boxcryptor folders only), Krywerk processes personal data exclusively locally on the person's computer. There is no contact with any server of the Krywerk project.
  • With team folders, the organization's Krywerk Server and its identity provider are added.
  • No telemetry, no analytics, no crash reports, no update checks.
  • File contents and file names leave the computer only in encrypted form, and only to the place where the person stored the encrypted folder themselves (sync folder, network drive).

2. Krywerk Server (controller: the operating organization)

2.1 Stored data

Data category Fields Source Purpose Retention
Account ID (sub of the identity provider), display name, email, first/last name, picture URL, language, active/locked, last seen (to the hour) Identity provider token at every sign-in Granting access to people, display in lists Until the person is deleted (section 4)
Groups Group name, memberships Token (groups claim) or web administration Granting access to groups Until the group or person is deleted
The person's keys public keys (ECDH, ECDSA), private key encrypted with the unlock code, unlock code encrypted with device keys App during setup Access to team folders Until the person is deleted
Devices device name (default: computer name), type, public key, encrypted personal key, created on, last access, last IP address (only with audit.record_ip) App Unlocking without the unlock code, overview for the person Until the person removes the device or is deleted
Team folders name, description, members with role, encrypted vault keys per person, archived App, web administration Access control Until the folder is deleted
Emergency access council, requests (requesting person, reason as free text, timestamps), approvals App Two-person recovery Requests expire after emergency.process_max_age_days (default 14 days)
Audit log time, acting person (ID, name), action, affected folder/person/group (names), detail; IP address only with audit.record_ip Server Traceability of administrative actions audit.retention_days (default 365 days, then deleted automatically)
Web sessions hash of the session ID, roles, timestamps Web administration Sign-in of administrators Until sign-out/expiry (default max. 8 h, 30 min idle)
Access log (console) time, method, path, status code – without IP, token, contents Server Operations, troubleshooting According to Docker/journald rotation (template: 5 × 10 MB)

Not on the server: files, file names, passwords, unlock codes, decrypted keys, contents of the storage location.

2.2 Recipients

  • The organization's identity provider: receives no personal data when the public keys (JWKS) are fetched. The sign-in itself takes place between the person's browser and the identity provider.
  • Reverse proxy (e.g. Caddy): sees IP addresses and requested paths (the proxy's own logs, according to its configuration).
  • Backups of the database (krywerk-server backup) contain all data from 2.1 and must be protected accordingly (template: file permissions 0600, kept for 30 days).
  • No transfer to the Krywerk project or third parties.

2.3 Privacy-relevant settings

Option Default Effect
audit.record_ip / KRYWERK_SERVER_AUDIT_RECORD_IP off Store IP addresses in the audit log and as the last device IP
audit.retention_days / KRYWERK_SERVER_AUDIT_RETENTION_DAYS 365 Retention of the audit log in days (0 = unlimited)
oidc.groups_claim groups Take groups from the token (empty = off)
emergency.process_max_age_days 14 Expiry of open emergency requests
KRYWERK_SERVER_QUIET off Turn off the access log on the console

3. Desktop app (controller: the person or organization using it; local only)

Data Location Content
Settings Windows %APPDATA%\Krywerk\config.json, macOS ~/Library/Application Support/Krywerk/, Linux ~/.config/Krywerk/ Paths of the encrypted folders, drive names, key server address, mapping team folder ↔ folder
Remembered passwords, device keys Windows DPAPI, macOS Keychain, Linux Secret Service Only at the person's request or for team folders
Trusted servers hub-trusted-hosts.json in the settings folder Addresses of confirmed key servers
Log Windows %APPDATA%\Krywerk\log.txt, macOS ~/Library/Logs/Krywerk/log.txt, Linux ~/.local/state/Krywerk/log.txt Error messages; max. 1 MB, then started anew; no passwords, keys or contents
Sign-in in memory only Access and refresh tokens, never on disk

The app sends data only to the key server that the person or their IT entered and confirmed, and opens the browser for sign-in.

4. Rights of data subjects

Right (GDPR) Implementation in Krywerk Server
Access (Art. 15) Web administration › People › person: account, groups, devices, folders; audit log filterable by person; export as CSV
Rectification (Art. 16) Name/email come from the identity provider and are updated at the next sign-in
Erasure (Art. 17) Web administration › People › person: lock, then delete permanently – removes account, keys, devices, memberships, access grants and verifications; in the audit log the person remains only as “Deleted person” with a pseudonym. Members of an emergency council only after emergency access has been set up again. Delete the person at the identity provider as well; otherwise signing in again creates a new, empty account.
Restriction (Art. 18) Lock person
Data portability (Art. 20) Files are stored in the open Cryptomator format at the organization's storage location

5. Notes for the controller

  • The legal basis, purpose limitation and informing employees or students are determined by the organization (e.g. Art. 6(1)(b)/(c)/(e) GDPR, state data protection law for schools in Germany).
  • The storage location (e.g. OneDrive) is a separate processing activity of the organization; Krywerk ensures that only encrypted data is stored there.
  • Technical and organizational measures: see security.md and betrieb.md (TLS, backup, updates, roles).
  • When a person leaves: lock the person in the web administration and, if necessary, “Renew key” for the affected team folders (team-umstellung.md).