openDesk and Data Sovereignty: Who Holds the Keys? Community, Enterprise and Customer-Held Keys (2026)

openDesk bundles open-source software for the public sector workplace: Nextcloud for files, Collabora Online for office documents, plus mail, calendar, chat, video conferencing and project management. It is published by the Center for Digital Sovereignty of the Public Administration (ZenDiS) on behalf of the German Federal Ministry of the Interior [1]. Users include the Robert Koch Institute, the Federal Maritime and Hydrographic Agency (BSH) and FITKO; BWI has signed a framework agreement to provide it to the German armed forces (Bundeswehr) [2].

That makes the software sovereign: open source code, operation in Germany or by the administration itself, no dependency on a single vendor. It does not yet answer the question of the keys. This guide shows who can decrypt documents in openDesk, how the Community and Enterprise editions differ, and how a public authority can keep the master keys of its files in its own HSM without modifying openDesk.

---

Table of Contents

1. Sovereign Software, Sovereign Data: The Difference
2. What openDesk Encrypts Today
3. Community or Enterprise?
4. Customer-Held Keys for openDesk Files
5. Deployment Models: On Your Premises, Hybrid or as a Service
6. Separation of Duties: Two Teams, Two Checks
7. Regulatory Framework
8. Sources

---

Sovereign Software, Sovereign Data: The Difference

Data sovereignty has three layers:

1. Software: the code is open, auditable and can be operated by several providers. openDesk meets this.
2. Operations: the platform runs at the administration or at a hosting provider under European law. openDesk makes this possible, self-operated or with partners that meet the BSI C5 catalog [3].
3. Keys: only the administration can decrypt the documents, even if the platform, its administrator or its hosting provider is compromised or receives an order.

The third layer determines what a vulnerability in the web platform costs. The BSI IT-Grundschutz module CON.1 requires long-lived keys to be stored outside the systems that use them [4]. In a standard Nextcloud installation, however, the server-side encryption key is on the server that displays the documents [5].

---

What openDesk Encrypts Today

The public openDesk documentation mentions end-to-end encryption for chat and OpenPGP for email, but no file encryption with keys held by the administration [3]. For files, the options are those of the bundled Nextcloud: server-side encryption, where the server can decrypt, and end-to-end encryption, which rules out editing in the browser. The article Nextcloud Encryption Compared compares these models.

---

Community or Enterprise?

openDesk is available as a Community Edition and an Enterprise Edition. Both contain the same file and office components, Nextcloud 33 and Collabora Online 26.04 [1]. The difference lies in support and security fixes.

The Enterprise Edition shortens the window during which a known vulnerability remains open. It does not change who can decrypt the files. Customer-held keys are therefore not a substitute for Enterprise but a complement: Enterprise lowers the likelihood of a compromise, and a key outside the platform limits its consequences.

---

Customer-Held Keys for openDesk Files

DuoKey SecureFolder has been validated on openDesk Community Edition v1.20.0 (Nubus, Nextcloud 33.0.9, Collabora Online 26.04.4), using the official customization options and without any change to openDesk. Sign-in uses OpenID Connect through openDesk's Keycloak; the gateway accesses Nextcloud with the user's token.

The principle:

• The files of a protected folder are stored in Nextcloud only as ciphertext in the DKSF format.
• The master key (KEK) stays in the administration's HSM or vault: generic PKCS#11, Securosys, Utimaco, Crypto4A, HashiCorp Vault, OpenBao or a cloud KMS. An HSM approved in your own country can be used through PKCS#11.
• To edit, the user opens the file with "Open with DuoKey". A gateway decrypts in memory, Collabora Online does the editing, and every save is re-encrypted.
• Every open, every save and every denial is recorded in the DuoKey Cockpit access log and can be forwarded to the SIEM.

Little changes for users: one new menu entry, the same interface, the same collaborative editing.

---

Deployment Models: On Your Premises, Hybrid or as a Service

Figure 1. Deployment models. In red: the editing zone, the only one that sees plaintext.

• On-premises: the administration runs openDesk, the gateway, Collabora and Cockpit itself. DuoKey holds no key.
• Hybrid, recommended for the public sector: the editing zone (gateway and Collabora) and the HSM stay with the administration, and DuoKey runs Cockpit in the EU or Switzerland. Plaintext and the KEK never leave the administration, and DuoKey does not hold the master keys.
• SaaS (planned): each administration gets its own editing zone in a hardware enclave (AMD SEV-SNP); Cockpit releases a key only to a gateway whose attestation it has verified.

For the SaaS model, the architecture is defined and a demo environment is in progress. Hosting in Switzerland is also planned. Organizations starting today begin with on-premises or hybrid deployment.

---

Separation of Duties: Two Teams, Two Checks

Figure 2. Separation of duties.

A document opens only if two checks pass: the Nextcloud share must exist, and Cockpit must confirm the right to the folder key. If the Nextcloud administrator does not also manage Cockpit, no single team can access confidential folders on its own. On request, the four-eyes principle applies to permissions.

---

Regulatory Framework

• BSI IT-Grundschutz, CON.1 Crypto Concept: long-lived keys belong outside the systems that use them [4]. A KEK in an HSM meets this requirement.
• BSI TR-02102-1 (2026-01): for long-term protection of confidentiality, the BSI recommends hybrid key exchange with ML-KEM [7]. SecureFolder's key handover is hybrid, with P-256 and ML-KEM-768; details in the article Post-Quantum Key Management for Documents.
• GDPR and NIS2: encryption is one of the explicitly named measures for protecting personal data and for the security of network and information systems [8][9].
• Access from third countries: if the key is not with the hosting provider, an order served on the provider can only yield ciphertext; it has to be addressed to the key holder [10].

---

Sources

1. openDesk, operations documentation: components. docs.opendesk.eu
2. European Commission, OSOR: BWI and the Bundeswehr adopt openDesk (April 2025). interoperable-europe.ec.europa.eu
3. openDesk, frequently asked questions. opendesk.eu/en/faq
4. BSI, IT-Grundschutz, module CON.1 Crypto Concept, 2023 edition. bsi.bund.de
5. Nextcloud, Administration Manual: server-side encryption. docs.nextcloud.com
6. openDesk, Enterprise Edition. docs.opendesk.eu
7. BSI, TR-02102-1, version 2026-01. bsi.bund.de
8. Regulation (EU) 2016/679 (GDPR). eur-lex.europa.eu
9. Directive (EU) 2022/2555 (NIS2). eur-lex.europa.eu
10. EDPB and EDPS, joint response on the CLOUD Act (July 2019). edps.europa.eu

Sources checked 8 to 10 November 2026.