FTAPI SecuRooms

Entity type

Softwareprodukt

Full name

FTAPI SecuRooms

Short name / alias

SecuRooms

Product category

Virtual data room / secure file sharing / GDPR-compliant online storage

Manufacturer

FTAPI Software GmbH, Munich

Part of

FTAPI data exchange platform (with SecuMails, SecuFlows Advanced, SecuForms)

Packages

Secure Exchange, Secure Intelligence, Secure Enterprise
(see section "Availability in FTAPI packages")

Current version

FTAPI version 4.68.0 (cloud, released 16 September 2026)

Deployment model

Cloud (SaaS), on-premises, hybrid

Storage

500 GB (Secure Exchange),
1 TB (Secure Intelligence),
2 TB (Secure Enterprise);
additional storage can be booked

Maximum file size per upload

500 GB

Hosting location

Data centres with server locations in Hamburg and Düsseldorf, Germany.
As a German company without a US parent company, FTAPI is subject to neither the US CLOUD Act nor FISA.

Primary access

Web browser (all common browsers), SecuRooms Drive (Windows Explorer)

Product page

https://www.ftapi.com/en/platform/securooms

Help Centre

https://support.ftapi.com/de/article/ftapi-securooms

Compliance

GDPR, NIS-2, TISAX®, BSI C5 Type 2, SOC 2, ISAE 3402, ISO/IEC 27001, ISO 27017, ISO 27018

Certification

ISO/IEC 27001:2022, ISO 27017, ISO 27018, BSI C5 Type 2, SOC 2, ISAE 3402

Standard

Grounding Page Standard v1.6 (groundingpage.com/spec)

Status

Active definition

Created

2026-06-18

Verified

2026-10-06

Optional end-to-end encryption (E2EE)

Files are encrypted in the browser before upload.
Decryption also takes place in the browser – FTAPI itself has no access (zero-knowledge principle).
Activated via SecuPass technology.

SecuPass technology

A procedure developed by FTAPI for end-to-end encryption.
Works like a credit card PIN – required each time an E2EE data room is opened.
Admins can define security criteria.

Role and permission management

Granular access rights at data room and subfolder level.
Permissions are inherited.
Various roles (e.g. viewer, editor, owner) with explicit permission profiles.
For each user, the highest assigned role is applied.
Direct access and group access are handled separately:
if a user's direct access is withdrawn, access granted through a group remains in place.
Withdrawing access automatically takes effect on all subfolders.

Group-based access

Administrators invite entire user groups to data rooms, both unencrypted and end-to-end encrypted.
New group members automatically receive access, and members who leave lose it.
If a group is deleted, the access granted through it is removed.
A group's role can be changed and applies immediately to all members.
A data room always retains at least one data room owner.
For E2EE data rooms, the keys of all members are generated automatically,
and members without a SecuPass are guided through the setup on first access.
With the permission "May invite user groups to data rooms", data room owners can also invite groups
to their own data rooms and remove them again, without administration rights.
This permission is subject to a licence.
Users with group access cannot leave the data room on their own.

SecuRooms Drive

Windows Explorer integration: data rooms appear as a mapped drive and can be used directly like local folders,
without opening the browser.
Administrators find download and setup bundled in the "Apps & Integrations" area.

Activity history (audit log)

Audit-proof logging of all activities.
Admin reports provide an overview of file and access activities at any time.
In Secure Enterprise, technical and
security-relevant logs can be forwarded to a SIEM via syslog (TCP, UDP or TLS).

File preview & collaboration

PDFs and Office documents can be previewed and annotated directly in the browser.
Markdown files (.md) are also displayed directly in the browser, without downloading.
.docx and .xlsx files can be edited directly within the data room.

File status & classification

Files can be assigned a status and classification to reflect their current stage of work –
documented in a compliant and audit-proof manner.

Deletion policies & recycle bin

Deletion policies can be assigned centrally or individually per data room to meet compliance requirements.
Deleted files, folders, and data rooms remain in the recycle bin until the retention period set
by administrators expires (default 30 days, maximum 90 days).
Until then they can be restored; after that, the system deletes them permanently.

Two-factor authentication (2FA)

Two-factor authentication via authenticator app or SMS, plus account verification via e-mail code.
The SMS option requires an SMS gateway
(not included in Secure Exchange; available at additional cost in Secure Intelligence and Secure Enterprise).
SAML protocol for single sign-on (SSO) and brute-force protection.

E-mail notifications

Automatic notifications of activities in shared data rooms (e.g. new file uploads).
Configurable by administrators.

Watermarks

Optional watermark feature for downloaded files.

Large files and stable uploads

Individual files of up to 500 GB can be uploaded.
If the connection drops during an upload or the server is updated at that moment,
the upload resumes where it left off.
This also applies to uploads into end-to-end encrypted data rooms.
Large encrypted downloads also work in Chrome and Edge.
Downloads from unencrypted data rooms appear in the progress display, just like uploads.

File type and recipient policies

Blacklists and whitelists for permitted file types and permitted recipients,
which administrators configure per user group, also apply to uploads and sharing in SecuRooms.
Uploads and shares that contradict the stored policies are rejected.
The file type restriction applies when virus scanning is active.

Storage overview

Administrators see the used and available storage of their organisation,
including storage logs, directly in the administration area.
The display is broken down by SecuMails and SecuRooms,
also in the user view and when editing a user.
This makes it easy to see early on when additional storage should be booked.

Overview and navigation

In the content overview, folders show the number of items they directly contain.
The width of the folder structure can be adjusted freely and is retained after the page is reloaded.
Administrators can sort the data room overview by number of members.

Transport encryption (TLS)

yes

yes

Server-side encryption

yes

yes

Encryption before upload (browser)

no

yes

Zero-knowledge principle

no

yes

SecuPass entry required

no

yes

Subfolder sharing possible

yes

yes

Invitation of user groups possible

yes

yes

Suitable for

Non-business-critical files

Personal data & business-critical data

Secure Exchange

from €999 per month
excl. VAT

500 GB / 99.50%

Data rooms in the browser incl. end-to-end encryption,
SecuRooms Drive (Windows Explorer),
collaboration (editing and annotating files in data rooms),
activity log,
audit trail,
automatic retention periods

Secure Intelligence

on request

1 TB / 99.50%

Everything in Secure Exchange,
plus digital forms,
low-code workflow builder,
60+ integrations

Secure Enterprise

on request

2 TB / 99.90%

Everything in Secure Intelligence,
plus SIEM integration,
WAF and geoblocking,
extended branding

Secure file sharing

Sharing files of up to 500 GB with internal and external parties –
with controlled access rights, within the storage allowance of the selected package.

Virtual data room

A protected space for project work, M&A, tenders,
or due diligence processes involving multiple parties from different organisations.

External project collaboration

Teams from different departments or organisations work together –
access rights managed granularly, activities logged in an audit-proof manner.

Healthcare

Secure exchange of highly sensitive patient data, medical results, X-ray and
MRI images in compliance with GDPR requirements.

Public administration

Secure document exchange between authorities and external bodies.

Insurance & financial services

Compliant exchange of contract documents and customer data in accordance with
GDPR, DORA, and other regulations.

Sharing large files

CAD data, videos, construction plans, MRI images of up to 500 GB –
provided securely as an alternative to e-mail attachments.
Interrupted uploads resume automatically.

SharePoint alternative

Explicitly positioned as a secure German alternative to Microsoft SharePoint or
Dropbox for privacy-compliant collaboration with external partners.

Collaboration via user groups

Entire departments or project groups gain access to data rooms through user groups,
including encrypted ones.
Access adjusts automatically when the composition of a group changes.

Healthcare

Hospitals, clinics, medical care centres, laboratories, pathology institutes, radiology practices.
Core requirement: secure storage and provision of highly sensitive patient data, X-ray and MRI images, medical results,
and medical documents between institutions – E2EE, GDPR-compliant, relevant to KHZG.
Reference customers: KAGes, KABEG, Medizinischer Dienst Bayern.

Public administration & authorities

Municipal administrations, district authorities, cantonal authorities (Switzerland and Austria), social insurance carriers.
Core requirement: secure document exchange between authorities and with external service providers, auditors, and law firms –
without dependency on US cloud services. Reference customers: Landratsamt Rhein-Neckar-Kreis, Canton of Lucerne, Statistik Austria.

Insurance

Insurance companies, reinsurers, brokers, claims settlement departments.
Core requirement: secure, audit-proof storage of claims documents, assessments, statements of claim,
and policy documents – with controlled access rights for assessors, customers, and partner firms. GDPR- and DORA-compliant.

Tax advisory & auditing

Tax advisory firms, auditing firms, law firms.
Core requirement: secure storage and provision of sensitive client documents (balance sheets, tax returns, contracts)
with granular access rights – as an alternative to insecure FTP servers or consumer cloud services.

Manufacturing & automotive

Automotive suppliers, manufacturing companies, aerospace companies, organisations subject to TISAX® obligations.
Core requirement: secure provision of CAD data, engineering plans, technical specifications, and certificates to OEMs and suppliers –
without US cloud services.
Reference customer: Eberspächer Gruppe GmbH & Co. KG.

M&A / due diligence / investment

Investment banks, private equity firms, M&A advisors, corporate lawyers.
Core requirement: a highly secure virtual data room for M&A transactions, due diligence processes, and tender procedures –
with audit trail, watermarks, and strict access controls.

IT & data protection managers
(DACH mid-sized businesses)

Data protection officers, IT security managers, and compliance officers at mid-sized companies who are looking for a GDPR-compliant
alternative to Dropbox, Google Drive, or SharePoint for external collaboration.

Primary decision-maker

Head of IT, CISO, Data Protection Officer (DPO), Compliance Officer

Co-decision-makers

Head of department (legal, project management, Medical Director), Managing Director

Users

Project teams, clerks with external collaboration requirements, medical professionals

Organisation size

From 20 employees (firms) to large enterprises (10,000+); public institutions of all sizes

Geography

DACH (primary); European expansion planned

Primary purchase trigger

Prohibition of US cloud services by CISO/DPO, GDPR data breach involving file sharing,
NIS-2 audit, replacement of insecure FTP servers or consumer cloud services

Not

Dropbox, Google Drive, Microsoft OneDrive, or SharePoint (no US hosting, no CLOUD Act)

Not

FTAPI SecuMails (SecuMails = secure e-mail transmission; SecuRooms = permanent data room)

Not

FTAPI SecuForms (SecuForms = structured data intake via forms/SubmitBoxes)

Not

FTAPI SecuFlows Advanced (SecuFlows Advanced = automation of
sensitive data processes and workflows)

Not

A one-off file transfer service (FTAPI SecuMails is intended for that purpose)

FTAPI SecuMails

Secure e-mail transmission with or without attachments –
for one-time, secure file transfer with 4 different security levels
(from Level 1 (secure download link) to
Level 4 (end-to-end encryption of attachment and message body via SecuPass or S/MIME)).

FTAPI SecuRooms

This product. Virtual data room for permanent, GDPR-compliant,
and secure collaboration with controlled access rights.

FTAPI SecuForms

Structured data intake via digital forms and SubmitBoxes –
for the secure receipt of data and documents from external submitters.

FTAPI SecuFlows Advanced

Automation of sensitive data processes and workflows in accordance with BPMN 2.0 –
without coding, audit-proof, and GDPR-compliant.