Securely send and receive · from Germany

Send and receive
confidential data securely.

Write a message or attach a file, send the secure link, and you’re done. SchlüsselBot encrypts everything on your device. Only the encrypted version is stored on the server. The recipient can open the message once; it is then deleted automatically. It is free and requires no account, even for the recipient.

Send securely now → How it works

Regularly receiving documents? Clients, patients or applicants can securely send documents to you via a dedicated SchlüsselBot secure inbox without needing their own account.

✓ Servers in Germany ✓ Encrypted on your device ✓ Deletes itself ✓DSGVO-readyAVV according to Art. 28 in the Business plan

Do you process business data from customers, clients, or patients? With the AVV in the Business plan, you meet a core GDPR requirement when using a service provider.

What the law says about email

Sending unencrypted data can be really expensive

The GDPR expressly identifies encryption as a security measure (Article 32 GDPR). For personal data, supervisory authorities require at least transport encryption; for high-risk data such as health information or professional secrets, they generally require end-to-end encryption. If email cannot meet those requirements, a different communication channel must be used.1

up to €10 millionor 2% of global annual turnover in the event of data security violations - also for processors (Art. 32, 83 Para. 4 GDPR).
up to €20 millionor 4% for violations involving particularly protected data, such as health data (Art. 9, 83 Para. 5 GDPR).
+ damagesThose affected can also claim material and immaterial damages (Art. 82 GDPR).

What this means for your sector At a glance – click for details

Tax advisers & bookkeepingClient confidences are protected by criminal law and professional rules.

Tax advisers are bound by professional secrecy. Unauthorised disclosure of a client's confidential information can result in a fine or imprisonment of up to one year. If the offence is committed for personal gain or to cause harm, the maximum rises to two years (Section 203 German Criminal Code). Professional sanctions include fines of up to €50,000 and, in the most serious cases, exclusion from the profession (Section 90 StBerG).

IT service providers & agenciesProcessors are directly responsible for data security too.

Anyone processing customer data on another party's behalf is directly accountable: the maximum fine of €10 million or 2% expressly applies to processors as well (Article 83(4) GDPR). Emailing an administrator password in plain text may also expose the provider to claims from the customer.

Law firms & notariesProfessional secrecy and professional rules apply side by side.

Lawyers and notaries are covered by Section 203 German Criminal Code (up to one year of imprisonment, or two years in serious cases). Professional sanctions range from fines of up to €50,000 and disbarment (Section 114 BRAO) to removal from office for notaries (Section 97 BNotO).

HR & recruitmentPersonnel files may contain special-category personal data.

Applications and personnel files often contain health information or details of a severe disability. Article 9 GDPR may therefore apply, with maximum fines of up to €20 million or 4%. Employees may also claim compensation under Article 82 GDPR.

Medical practices & therapistsHealth data is among the most sensitive personal data.

Section 203 of the Criminal Code applies to doctors and psychotherapists. Patient data also falls under Art. 9 GDPR and therefore under the highest fine range (up to €20 million or 4%). Professional secrets can already be an indication of high risk; then end-to-end encryption is regularly required.1

Brokers, banks & consultantsIdentity documents and income data increase the potential harm.

Financial disclosures, identity documents and proof of income can be misused for identity theft. The full GDPR fine framework applies (up to €10 or €20 million); employees of private health, accident and life insurers are additionally covered by Section 203 German Criminal Code.

Details on the legal situation

A case brought by the French data protection authority CNIL shows that regulators do enforce secure transmission requirements: €250,000 fine against Spartoo; one of the findings concerned bank-card photographs sent by unencrypted email.2

The good news: Directly below this section, a secure channel is available free of charge and without registration.

View sources and legal context

Sources: Art. 83 GDPR (fine framework; Art. 32, 9, 82 GDPR ibid) · § 203 StGB · § 90 StBerG · § 114 BRAO · § 97 BNotO · 1 Guidance by the German Data Protection Conference (DSK): “Measures for protecting personal data transmitted by email” from May 27, 2021 (Sections 1, 4.2.1–4.2.3) · 2 CNIL, Délibération SAN-2020-003 of 28 July 2020 (section D.2: copies of bank cards sent by unencrypted email). Figures shown are the statutory maximums. The actual amount in each case is determined under Art. 83(2) GDPR. Whether transport encryption suffices or end-to-end encryption is required depends on the risk of the individual case. Last reviewed: August 2026. This is not legal advice.

Try it now. No sign-up required.

Insert password, access data or file. SchlüsselBot encrypts everything in your browser. If “Simple” is selected, SchlüsselBot emails the link; with “Safer” you pass it on yourself. The person only receives the one-time code when they request it using the link. After reading it once, the message will be deleted, at the latest after 48 hours.

Optional: personal message and delivery confirmation
Delivery method: How should the person receive the message?

In both cases, encryption occurs on your device. The difference is whether your key briefly passes through our server and who sends the final link. What does this mean exactly?

Practice, law firm, or tax consultancy? If SchlüsselBot processes personal data on your behalf, a Data Processing Agreement under Article 28 GDPR is required regularly; additional obligations under § 203(4) of the German Criminal Code (StGB) may apply for professional secrecy. Business provides both documents. View contract · View obligation · to Business

Simple by design

Send securely in three simple steps

1

Type in & send

Write your message and the recipient's email address. Encryption happens directly on your browser.

2

Request code

The recipient opens the link and receives a one-time code by email. This confirms access to the specified email address.

3

Read & gone

Enter code, decrypt, done. After this, the message will be permanently deleted.

That's exactly what SchlüsselBot is for

Whenever email is too insecure

A regular email is like a postcard: it remains unencrypted with the provider, in backups and in every inbox it passes through. When that is not sufficient, whether because stronger protection is required or simply appropriate, SchlüsselBot provides a safer channel.

Tax advisers & bookkeeping

Receive invoices, payroll data and annual accounts from clients in encrypted form instead of as a ZIP file with the password in the email beneath it. If SchlüsselBot is used as a processor of personal data, a data processing agreement is generally required; Section 203 of the German Criminal Code also applies to professional secrets. Business provides both documents. Learn more.

View solution for tax consultants →

IT service providers & agencies

Server access, admin passwords, and API keys are handed over to customers: verifiably readable only once, then deleted. Optional delivery confirmation. For purely transferring your own system access, no automatic data processing agreement arises. As soon as personal customer data is processed on behalf, the AVV requirement for the specific use should be clarified.

View solution for IT & agencies →

Law firms & notaries

Receive confidential documents such as pleadings, powers of attorney, and ID copies, for example, protected by a one-time code and the same Passkey used for login. For use with client data, Business provides AVV and § 203 obligations. Learn more

View solution for law firms →

HR Department & Recruitment

Job applications, payslips and employment contracts containing social security numbers and bank details do not belong in an open inbox. If SchlüsselBot processes these data on your behalf, Business provides the data processing agreement that is generally required.

View solution for HR →

Medical practices & therapists

Receive patient reports, intake forms, and lab results. A link in the appointment confirmation is sufficient, no separate practice portal required. For use with patient data, Business provides the AVV and § 203 obligation. Learn more

View solution for medical practices →

Brokers, banks & consultants

Income statements, financial self-disclosures and ID documents are among the most sensitive records that other people may need to send you, and you do not want them sitting permanently in your inbox. If SchlüsselBot processes these client data on your behalf, Business provides the data processing agreement.

View solution for consultants & brokers →
Your receiving secure inbox

A link through which anyone can send you encrypted passwords, files or messages

Everything described above is a single send: write it, send it, done. A Secure inbox reverses the process. You create one permanent link and share it wherever needed. Anyone who opens it can send you encrypted information without an account or additional software: ideal for documents you receive regularly rather than just once.

1
Set up

You receive a fixed address you can store anywhere.

2
Forward

On the website, in the email signature, or in the appointment confirmation.

3
The sender sends

Open the link and, depending on your plan, add files of up to 50 or 100 MB or write a message, then send it. No account is required.

4
You open

The submission remains encrypted and only opens after the access control you have selected.

You determine the protection level per secure inbox: One-time code via email, account passkey, code plus passkey, code plus second factor, or your own end-to-end passphrase. New deliveries appear live in the inbox and can be opened directly there. In Business, you can share a secure inbox with your entire team or only with selected individuals; remote members lose their license and access immediately. Compare plans.

Of course.

Why you can trust SchlüsselBot

You decide whether SchlüsselBot could read it

Encryption always takes place in your browser; only the ciphertext is stored on the separate vault server. In the Secure sending method, we never see your key, so reading the message is technically impossible. In the default “Simple” method, the key briefly passes through our server so we can send the link for you. We do not store it, but it is technically possible for us to read it on that route. For client, patient and personnel data, use "Secure".

Deletes itself

Once read, it is gone for good. Not even SchlüsselBot can restore it. If it is not retrieved, it is deleted automatically when the selected period expires. The default is 48 hours in Free and Pro, and 7 days in Business.

Separate systems · German servers

Your data never leaves the European Union and currently resides exclusively in Germany: the interface, encrypted data, email dispatch, and analysis all run here on separate servers. Only payment processing goes through PayPal (Luxembourg); see Privacy for details.

Official foundations: Art. 28 GDPR via EUR-Lex Passkeys explained by the BSI

Pricing

Start free. Upgrade to Pro or Business anytime

Free

€0
permanent · usable without account · account optional
  • 10 messages per day (3 per minute, 8 per hour)
  • Attachments up to 2 MB
  • One-time read · 48-hour expiry
  • Delivery confirmation by email
  • Optional account with encrypted address book
  • Passkey login and two-factor protection
  • Not included: Your own receiving secure inbox
Start immediately
FOR INDIVIDUALS

Pro

€4.90 / month
inclusive of VAT · cancel monthly
  • Everything from Free
  • Attachments up to 50 MB
  • 200 messages per day (10 per minute, 60 per hour)
  • Expiry time selectable up to 7 days
  • Personal receiving secure inboxes with fixed link
  • Not included: access templates, personalised customer forms and website embedding (included in Business)
  • Five selectable protection levels: from email code and Passkey to end-to-end passphrase
  • New incoming items open live in the account, in addition to email
  • Not included: Data Processing Agreement (DPA). If SchlüsselBot processes personal data on your behalf, select the Business plan.
Start Pro

Business

from €19 / month
inclusive of VAT · 1 seat €19 · from 2 onwards €15 each · from 5 onwards €12 each · from 10 onwards €10 each · from 20 onwards €8 each
  • Everything from Pro
  • Attachments up to 100 MB instead of 50 MB in Pro
  • Shared team secure inboxes for the whole team or selected individuals
  • Smart access templates and personalised customer forms
  • Responsive website embedding with an explicitly authorised HTTPS origin
  • Invite, pause or remove team members; license and team access end immediately
  • AVV according to Art. 28 GDPR and §-203 Obligation at the click of a button
  • API for sending status, withdrawal and contacts · reliable webhooks
  • Direct send: 500 messages per day per slot (20 per minute, 150 per hour),
Start with Business Pre-check, without account: AVV templates · § 203 Declaration
Calculate Business price directly A place is a person from your company. External senders do not need a place or account.

The tiered pricing is automatically applied; final price and net value are displayed.

Invoice address outside the EU? For billing addresses outside the EU, we check the country and create a custom offer. Self-booking will be enabled per country only after tax and consumer protection issues have been professionally clarified.

SchlüsselBot uses your details solely to process your request. No advertising and no disclosure to third parties. Privacy policy

The prices listed are final prices inclusive of 19% VAT for Germany and EU private customers. EU businesses with confirmed VAT ID pay the net price via reverse charge. For billing addresses outside the EU, an individual request is currently required. · Cancellable monthly at the end of the paid period: cancel here. · Passkey, two-factor login, and encrypted address book are available in each plan.

Frequently asked questions

Everything you need to know before you start

Brief and free of marketing jargon. Missing something? Contact us .

What is SchlüsselBot?
SchlüsselBot is a German service for securely sending and receiving passwords, login details and confidential files. Content is encrypted in the sender’s browser and stored on the separate vault server only as ciphertext. Whether the key also remains technically outside SchlüsselBot depends on the selected delivery or secure-inbox mode. The message deletes itself after it is read. Neither sender nor recipient needs software or an account for direct sending. People submitting content through a secure-inbox link need no account either; registration is required only to create and manage your own secure inboxes, contacts or teams.
How secure is it really? Can SchlüsselBot read your messages?
Encryption happens in the browser (AES-256-GCM). In the sending method Secure, the key never reaches us technically. Reading it is impossible, not just promised. In the "Simple" sending method, it briefly passes through the server so SchlüsselBot can deliver the final link; it is not logged. For secure inboxes with code or passkey, the key fragment for direct live retrieval is additionally encrypted and temporarily stored on the edge server, then removed after retrieval, expiry or hiding. Only in the secure inbox with your own E2E passphrase does the key never reach SchlüsselBot. Through the Business API, plaintext can be passed; in that case, SchlüsselBot encrypts server-side. For a technically blind API path, the application must encrypt itself and distribute the key independently.
Does the recipient need an account or a program?
No. The recipient opens the link in the browser, requests a one-time code to their email address, enters it, and reads the message. No account, no app, no installation, not even on a mobile phone.
How long is a message available for retrieval?
After it has been read once, it is deleted immediately. If it is not retrieved, an automated process deletes it when the selected period expires. The default is 48 hours in Free and Pro, and 7 days in Business. In Pro and Business, the period can be set to 24, 48 or 72 hours, or up to 7 days. We never retain anything for longer. Attachments are delivered immediately when opened and are then available in the recipient's browser. They should be saved straight away because they disappear when the page is closed. In any case, we delete them from the server no later than 10 minutes after they are opened. After that, they are gone for good.
How much does SchlüsselBot cost?
The free plan allows 10 messages per day with attachments up to 2 MB and requires no account. An optional free account adds an encrypted address book, Passkey login and two-factor protection. Pro costs €4.90 per month and includes attachments up to 50 MB, 200 messages per day, selectable expiry periods of up to 7 days and personal secure inboxes with five protection levels. Business starts at €19 per month for one seat, raises the file limit to 100 MB and adds shared secure inboxes, smart access templates, personalised client forms, website embedding, team management, a data processing agreement, a Section 203 confidentiality undertaking, plus API access and webhooks. EU businesses with a confirmed VAT ID pay the net price under the reverse charge mechanism. For billing addresses outside the EU, SchlüsselBot currently provides an individual quote after review; self-service booking is offered only after the relevant country has been approved. All prices shown for Germany and EU consumers are final prices including 19% VAT. You can cancel at any time at the end of the paid period.
What is the maximum file size?
2 MB per message in the free plan, 50 MB with Pro, and 100 MB with Business. Multiple files can be combined into one message; they are encrypted together.
What is a secure inbox?
A permanent link such as schluesselbot.de/i/1234567/mandanten that you can place on your website, in your email signature or in an appointment confirmation. Anyone who opens it can send you encrypted messages and files, without account and without software. This is ideal for receiving documents in tax advisory firms, law firms and medical practices. The standard secure inbox is included in Pro and Business. Business adds searchable templates that guide senders through the required access details, for example for Instagram, FTP/SFTP or SSH, as well as personalised customer forms with a prepared name, email address, introduction, subject and template. These personal forms can be sent as secure-inbox links or embedded on an authorised website. Values entered into a template are encrypted in the browser as part of the message. New submissions appear live in the account inbox and can be opened there directly; the notification email is not required. Submissions are available by default for 48 hours in Pro and 7 days for new Business secure inboxes; each secure inbox can be set to 24, 48 or 72 hours, or 7 days. You configure the desired Receiving capacity separately for each secure inbox. Important for law firms and medical practices: if SchlüsselBot processes personal data on your behalf, a data processing agreement under Article 28 GDPR will generally be required; Section 203(4) of the German Criminal Code may additionally apply to professional secrets. Business provides both documents; Pro does not.
How do I secure my secure inbox?
When creating a secure inbox, choose the protection level that fits: One-time code by email, the existing Account passkey only, code plus passkey, code plus a second factor, or your own passphrase with true end-to-end encryption. If a user cannot use passkeys, the code and passphrase options remain available. Nobody can reset a forgotten end-to-end passphrase.
Can multiple team members share a secure inbox?
Yes, in the Business plan. An inbox can be shared with the entire team or only with selected individuals; personal inboxes remain private. Each person logs in using their own account and their own security factor. The first person to successfully confirm a submission takes over and opens it. If a team member is paused or removed, access to shared inboxes ends immediately.
Who needs a place in the Business plan?
A place is a person from your company with their own access, including the team administrator. External senders such as clients, patients, applicants, or others do not need a place or an account. When a team member is removed from the company, their Business license and team access end immediately; their personal account continues as a Free account.
Can I change the number of Business seats later?
Yes. The group admin can change a running PayPal subscription in the account. After confirmation via PayPal, additional seats become available immediately; the new recurring price applies from the next regular billing cycle, with no prorated adjustment for the current period. A reduction is scheduled for the next billing period and displayed with date and new price. The next charge will reflect the lower amount accordingly. Reduction is not possible under paid seats and pending invitations.
How are contacts in the address book protected?
Names and email addresses are stored in the database using AES-256-GCM encryption and are decrypted only for a successfully authenticated session or an explicitly authorised Business API key. Stealing the database alone would therefore not expose the address book in plaintext or reveal matching contacts across different accounts. The encrypted address book, passkey login and optional two-factor protection are available with every account plan.
Is there an API and webhooks?
Yes, with the Business plan. The API can send messages, check their status, withdraw pending messages and manage the encrypted address book. Each key receives only the permissions it needs; approved HTTPS origins also support external browser applications. Signed webhooks report creation, retrieval, withdrawal, expiry and failed email delivery, with automatic retries after errors. API keys and webhook secrets are shown in full only once. Each account can have up to 10 active API keys and 5 webhooks. The public documentation and an OpenAPI file explain every endpoint.
Can I use SchlüsselBot in compliance with GDPR?
Yes. SchlüsselBot is designed for GDPR-compliant use: the production servers are located in Germany, the interface and encrypted content are separated, and messages are processed with minimal data and retained only briefly. Where SchlüsselBot acts as a processor, the Business plan lets you generate the data processing agreement under Article 28 GDPR directly in your account; an additional Section 203 confidentiality undertaking is available for regulated professionals. SchlüsselBot is one technical and organisational component. Your organisation remains responsible for purpose, legal basis, transparency duties and permissions.
Why not just send a password-protected ZIP via email?
Because the password is almost always sent in the same email or the next one, it ends up in the same email inbox, the same backup and with every provider that handled the message. A ZIP password also does not prevent unlimited copies of the file. With SchlüsselBot, the content can be read only once and then deletes itself.
Can I see whether the recipient has read the message?
Yes. When sending, enter your own email address under "Delivery confirmation". You will then receive a message with the date and time of retrieval. The confirmation contains no message content.
Do I need another Passkey for a secure inbox?
No. The secure inbox uses exactly the passkey that already belongs to your SchlüsselBot account. If you add another passkey as a backup, it can also be used for confirmation after login.
Operator & Responsibility

Behind SchlüsselBot are real people you can reach

SchlüsselBot is developed and operated in Berlin by MessingerDesign, Philipp Messinger & Werner Messinger GbR. The responsible provider, address for service and direct contact channels are clearly stated, so you know who you are entrusting with processing your data before you use the service.

View operator and contact details →

  • Developed in Berlin

    Product development and technical operations are managed by a clearly identified German provider.

  • Real people, easy to reach

    Not an anonymous platform: questions about contract, data protection or security are directed to the operator.

  • Documentation before you buy

    AVV templates, §203 templates, security description and sub-contractor information are publicly verifiable.