Encryption

With end-to-end encryption, the browser encrypts and decrypts a tenant's participant data; the server only stores it encrypted.

Location: Settings > Privacy > Encryption. Visible to: super admins, only in installations with tenants. Why fepli encrypts this way is explained in How fepli encrypts participant data end to end.

Encryption page

The page is called Encryption of this tenant. Below it: “Encrypts the names and dates of birth of children, health information and sensitive details of {tenant} in the browser. The tenant keeps the recovery key; fepli cannot reset it.”

beispiel.fepli.eu/admin/einstellungen/datenschutz/verschluesselung

☀️

Settings/Privacy/EncryptionNew⌘ ↵

Settings

GeneralRegistrationOffersPaymentsPrivacyIntegrationsApp-Store

Deletion periodsRetentionPrivacy statementEncryption

Encryption of this tenant

Encrypts the names and dates of birth of children, health information and sensitive details of Ferienpass Elmsbrück in the browser. The tenant keeps the recovery key; fepli cannot reset it.

EncryptedActiveSince 01.03.2027 · names, dates of birth, health information

Fingerprint4F2A 9C1E 77B0 D3A5 0E6C 18F9(from the key this account knows)Emergency kitCreated on 01.03.2027 by Robin Beispiel

Create new emergency kit …Creates a new recovery key. The previous kit becomes invalid.

Recover with the emergency kit …If none of your passkeys unlocks any more, or on a new device without a key.

Element	Meaning	Effect
Status	Whether the tenant encrypts, with a badge and a sentence below	See Status. With Off, Activate … stands here; with Running, after an interruption, Resume.
Fingerprint	Identifier of the team signing key in 6 blocks, e.g. `4F2A 9C1E 77B0 D3A5 0E6C 18F9`	Visible from Running on. At first it is followed by “(as the server says; unlock to check)”. After unlocking, the page shows the fingerprint of the key your account knows, with “(from the key this account knows)”. A new emergency kit prints this fingerprint.
Emergency kit	“Created on {date} by {name}”	Visible from Running on.
Create new emergency kit …	“Creates a new recovery key. The previous kit becomes invalid.”	Opens the dialog titled Create new emergency kit. Only with Active.
Recover with the emergency kit …	“If none of your passkeys unlocks any more, or on a new device without a key.”	Opens the recovery. Only with Active and as long as the kit has not been used.

Status

Status	Badge	Sentence	Meaning
Not encrypted	Off	“Personal data is stored in plain text in the database.”	Below, How it works lists the 4 steps of the activation, with the note “If no admin has access any more and the emergency kit is lost, the data cannot be recovered.”
Encrypting	Running, the progress in per cent while the browser works	“Runs in this window. Keep it open; you can keep working in another tab.”	The browser encrypts the stored data in batches, with a progress bar. If the window was closed, Resume carries on. The status also appears when a tenant that is on still has unencrypted records.
Encrypted	Active	“Since {date} · names, dates of birth, health information”	Everything stored is encrypted. The page has no way to switch the encryption off.

Once access has been recovered with the emergency kit, Active shows “The emergency kit was used on {date} by {name} and opens nothing any more. Create a new one now and destroy the old one.” Create new emergency kit … is then highlighted, and Recover with the emergency kit … is missing.

From Running on, Integrations with access to participants lists every active service account with the role Participants, with the badge of its key: Pseudonyms only, Waiting or Active. The name leads to the service account's page (Settings: Encryption of a service account).

Dialog

Activate … and Create new emergency kit … open the same dialog with two steps, “Step 1 of 2” and “Step 2 of 2”.

Element	Meaning	Values	Effect
Title	Activate encryption or Create new emergency kit, in the second step Save emergency kit	–	–
Integrations	When activating, the active service accounts with the role Participants	–	“This integration reads the participants. Afterwards it sees pseudonyms only, until it holds a key of its own:” (for several, “These integrations …”), below it their names
Person	Name, “Super admin” and the number of the account's passkeys	“no passkey”, “one passkey”, “{count} passkeys”	Without a passkey, it says “The encryption needs a passkey. Add one first:” with the link Add passkey.
Confirm with passkey	Confirmation with one of the account's passkeys	–	While the passkey asks: “Waiting for passkey …”. The browser then creates the recovery key.
Download emergency kit (PDF)	Opens the emergency kit in a new window and the print dialog	–	“A4, one page. Choose “Save as PDF” in the print dialog – or print it right away.” The button is then called Download again. The key is created only in this dialog and shown nowhere else.
Characters	“To confirm, enter characters {positions} of the recovery key (without “R1-” and dashes).”	4 fields for 1 character each	Visible only after the download. The dialog picks the 4 positions at random.
Start encryption or Activate new kit	Finish	–	Selectable only once the 4 characters match. Start encryption switches the encryption on and starts encrypting. Activate new kit makes the previous kit invalid.

At the bottom left, the dialog says what is missing: “Download first, then continue.” or “Enter the characters from the kit.”

Emergency kit

The emergency kit is an A4 page that the browser fills in and opens for printing. It is called “Emergency kit · {tenant}” and is in the admin panel language of the person who downloads it.

fepliEmergency kit

Created on 01.03.2027 · Ferienpass Elmsbrück

Access details of the tenantOrganisationFerienpass ElmsbrückTenant IDelmsbrueckSign-in addresshttps://beispiel.fepli.eu/adminRecovery keyR1-7K3QD-MX9TA-2PHVB-WN4CE-8RJ6F-GZ5SYFingerprint of the team signing key4F2A 9C1E 77B0 D3A5 0E6C 18F9

QR codeNeed help?docs.fepli.eu or your contact at fepli. fepli does not know this key.

Whoever has this key can read all encrypted data of the tenant.Print it, keep it in two places, do not send it by e-mail.

What is protected?No key, no access.Keep it safe.Created a new kit?

Kept by (name, role)PlaceDate

Confidential · belongs to the tenant Ferienpass ElmsbrückKit 2027-03-01 · checksum 3E9A-71C4

Part	Content
“Access details of the tenant”	“Organisation”, “Tenant ID”, “Sign-in address” of the admin panel, “Recovery key” and “Fingerprint of the team signing key”, on a new kit that of the key the account knows. The key starts with `R1-` and has 6 blocks of 5 characters.
“QR code”	The same key as a QR code, without a link: “Scan it in the admin under Settings → Privacy → Encryption → Restore. It holds the same key as above. You also confirm a link that fepli sends to the e-mail address of your account.”
“Need help?”	“docs.fepli.eu” or the contact at fepli, plus “fepli does not know this key.”
Warning	“Whoever has this key can read all encrypted data of the tenant.” and “Print it, keep it in two places, do not send it by e-mail.”
Notes	“What is protected?”, “No key, no access.”, “Keep it safe.” and “Created a new kit?”
Safekeeping	Empty lines for “Kept by (name, role)”, “Place” and “Date”
Footer	“Confidential · belongs to the tenant {tenant}” and “Kit {date} · checksum {checksum}”

Recovery

Recover with the emergency kit … opens a dialog with four steps. The recovery is available only with Active.

Step	Title	Content
1 of 4	Recover with the emergency kit	Field Recovery key: “Enter the recovery key from the emergency kit of {tenant}, or scan the QR code on it.” Scan QR code opens the camera; the button is missing in browsers that cannot read QR codes. Continue checks the key (“Checking …”).
2 of 4	Confirm by e-mail	“We sent a link to {email}. Open it, sign in and confirm the recovery. This window then goes on by itself.” Below it “Waiting for the confirmation …” and I have confirmed.
3 of 4	Connect a new passkey	“The team key is open. Compare the fingerprint with the one on the emergency kit. Only if it matches, confirm with the passkey you will unlock with from now on. If it differs, cancel and contact fepli.” Below it Fingerprint, the box “The fingerprint matches the one on the emergency kit, character by character.” and Confirm with passkey, which can be selected only once the box is ticked.
4 of 4	Save emergency kit	As in the dialog, with “The code of the previous emergency kit is spent. Save a new kit now; only then is the tenant covered again.” and Activate new kit.

The link goes to the email address of the account that enters the key. It is valid for 30 minutes and works once. If someone closes the dialog after step 3, the page shows the note that the kit has been used.

Page behind the link

The link opens https://beispiel.fepli.eu/admin/e2e/wiederherstellen. The page requires signing in with the same account and confirms only with its button.

State	Title	Text
Open	Confirm the recovery	“On {date} at {time}, the code from the emergency kit was entered for your account {email}. Only confirm if that was you.” Button Confirm the recovery, below it “That was not you? Confirm nothing and tell your team right away: somebody else has the code of the emergency kit.”
Confirmed	Confirmed	“Go back to the window where you entered the code. It goes on there with your passkey.”
Expired	Link expired	“The link is no longer valid. Start the recovery again.”
Invalid	Invalid link	“This link belongs to no open recovery of your account. Was it used already, or are you signed in with another account?”

Emails and log

Occasion	Recipients	Subject	Button
Key entered (step 1)	the account that enters the key	“Recover access with the emergency kit”	Confirm the recovery
Access recovered (step 3)	all super admins, all accounts with access to the team key and the account itself	“Emergency kit used – create a new one”	Go to encryption

The log of the data subject rights records Recovery with the emergency kit started and Access recovered with the emergency kit.

Top bar

For a tenant that encrypts, the top bar of every page of the admin panel shows a lock to the left of the bell and, where needed, a badge for access. Whoever works in another person's account with Sign in as sees neither; that person's keys do not open in this session. What global admins see there is under Support disclosure.

beispiel.fepli.eu/admin/teilnehmende

☀️

Participants1 access requestNew⌘ ↵

Participants

Kind K7Q2Kind 9XRT

Element	Meaning	Effect
Access	Badge with a key while the account has no confirmed key or requests are waiting for it	Opens the access dialog. While it shows Set up access or Access awaits confirmation, the lock is missing.
Lock	Whether the keys are open in this browser	See Lock.
Pseudonym	What stands instead of the name while the lock is closed or the account has no key for the record: “Kind” and 4 characters	After unlocking, the page first shows the encrypted characters, then the name from left to right.

Lock

The lock is an icon without text; what it does is its tooltip.

State	Icon	Tooltip	Effect
Opening	with a spinner	“Unlocking …”	Within the same sign-in, the browser opens the keys by itself on reload and in further tabs, until signing out.
Locked		“Encrypted · unlock”	Selecting it asks for the passkey. For organizer accounts without a passkey that unlocks, the field Password with Unlock opens below the lock instead; Esc, × or a click beside it closes it.
Waiting	with a spinner	“Waiting for passkey …”	The passkey asks. With the password: “Checking password …”
Decrypting	with a spinner	“Decrypting in the browser · {done} / {total}”	The page decrypts its values.
Open		“Decrypted · in this browser only”	Not selectable. Signing out locks it; the browser then deletes what it kept for opening again.
Error	red lock	one of the messages	The text stands next to the lock.

Access dialog

Badge	Who sees it	Dialog
Set up access	Account without a key	“Access to encrypted data”, “Step 1 of 2”: Create key with passkey. For admins “This tenant's participant data is end-to-end encrypted. Your passkey creates a personal key; a team member then confirms it by comparing emojis.”, for organizers “The data of the registered children is end-to-end encrypted. Your passkey creates a personal key; a colleague who already has access then confirms it by comparing emojis – the first time, the team.” For organizers without a passkey who sign in with a password, it says “Your password creates …”, with the field Password and Create key with password.
Access awaits confirmation	Account with a key nobody has confirmed yet	Continue with passkey with Unlock with passkey, without a passkey Continue with password with the field Password and Unlock with password. Then Emoji comparison, “Step 2 of 2”: “Ask a team member to confirm your access – on the phone or side by side. Keep this window open.”, for organizers “Ask a colleague who already has access – the first time, the team – to confirm your access, on the phone or side by side. Keep this window open.”
1 access request, {count} access requests	Account with access that requests are waiting for	Access requests: per request the name, for organizers “for {organizer profile}”, for the support key “Support”, the email address, “requested on {date}” and Compare. If the lock is closed, the dialog first asks “Unlock with your passkey to confirm new keys.”, without a passkey “Unlock with your password to confirm new keys.”

Requests from admins and from support are seen by the team. The first request from an organizer profile is seen by the team, every further one by the accounts of that organizer profile with access.

Step	Title	Content
Waiting	Emoji comparison	For the team member: “Waiting for {name}. „Set up access“ has to be open on their side.” After one's own confirmation: “Waiting for {name} to confirm …”
Comparison	Compare emojis	“Do these emojis match the ones {name} sees, in the same order?”, 7 emojis with their names in the language of the admin panel, “Compare on the phone or side by side, not by email or chat.” Buttons They don't match and They match.
Result	Access set up	For the new person “Your key is confirmed. You now read the encrypted data in this browser.”, for the team member “{name} now has access to the encrypted data.”
Cancellation	Comparison cancelled	The reason (see Messages); for the new person also “A team member can start the comparison again while this window stays open.” Back to the list takes the team member back to the requests.

Encrypted data

Information	Encrypted for	What the server has instead
First and last name of a participant	Team; the organizer profiles at whose offers the participant is registered; the family, if its account has a key of its own	Pseudonym “Kind {code}”
Date of birth	as the names	the year of birth and the age of every registration. The server takes the year of birth only from a date the team or the family saves when editing, and from the date it still had in plain text when it first encrypted; a date organizers send along when registering does not change it. Without a date, the age of a registration is the one the participant reaches in the year of the offer.
Important information for the organizers	as the names	nothing
Answers to additional questions	Team; the organizer profiles at whose offers the registration is; the family, if its account has a key of its own	nothing. The answers in the section In plain text are exempt. The browser decrypts the columns of the additional questions in the participant list.
Last name of a participant account	Team	the first name
Billing address of a receipt	Team; the paying account, if it has a key of its own	the address only in the request that writes it
Receipts, proofs of consent and paper proofs in the archive	Team; the account concerned, if it has a key of its own; the emergency kit	the checksum of the file

Whatever was in the archive before the encryption was switched on stays unencrypted until its lock ends. An encrypted receipt downloads in the admin panel only after unlocking; while locked, the link is called Unlock first, and whoever opens the address of the PDF file directly sees “Stored encrypted. Unlock (top right) to download.”

In forms, encrypted fields are locked until the lock is open: “Unlock to edit (top right).” On the website, the family's forms show encrypted details such as the date of birth and Important information for the organizers locked: “Stored encrypted. The team can change it.” For a new child, all fields are open.

In plain text

Information	Note
Email address, phone number and postal address of the accounts	The server sends notifications and text messages with them.
Email address, phone number and mobile number of a participant	–
First name of the accounts	Greeting in emails
Year of birth of a participant	For age limits and the age of a registration
Names of the accounts of admins and organizers	–
Answers to a question of the type Choice where one option has a surcharge	The surcharge is part of the participation fee and of the receipt.
Answers to yes/no questions of the season	The priority for working parents evaluates such a question in the lottery.
Offers, seasons, organizer profiles	–

Consequences on the server

Place	For encrypted records
Searching and sorting by name	The server knows only the pseudonym.
Emails	If a person with an open lock triggers the sending, e.g. a newsletter or the admission notices, their browser sends the first names along. Otherwise the email says “your child” with the participant's avatar, provided the app Avatars is on. The outbox shows the names only after unlocking.
Exports with the date of birth, important information, answers or last names of accounts	The columns stay empty.
Age limits	Checked with the date of birth if the browser sends it along, otherwise with the year of birth: the limit counts as met if one of the two ages the year leaves open fits. If no age is known, an offer with an age limit does not take the child: “{name} cannot take part – the age is not known (…). Please give the date of birth.”

Unlocking with a password

Admins unlock only with a passkey, organizers also with their password. For a tenant that encrypts, no password leaves the browser: the browser derives a sign-in key for the server and a key for unlocking from it.

Place	Text	Meaning
Sign-in	Set a new password: “Participant data is now encrypted in the browser, and your previous password no longer counts for it. Sign in with a sign-in link or a passkey, then set a different password.” with Send sign-in link and Sign in with a passkey	The server has still seen the account's password. It no longer counts.
Set password	“Participant data is now encrypted in the browser. Choose a different password than before.”	After the sign-in link
Sign-in	“Signing in with a password is not possible here”	The browser has already signed in with this address using a derived password, and the server now asks for the password itself.
Sign-in	“Sign-in not possible”	The browser could not process the password.
Lock	Field Password and Unlock	Only for accounts without a passkey that unlocks.
Access dialog	Create key with password, Unlock with password	For accounts without a passkey; the same emoji comparison follows.

A new password through Forgot? restores the sign-in, not the access to the data: the account gets a new key.

On the website, registration asks for no password where the tenant encrypts; the family sets one afterwards in its account. Whoever deletes their account there gets a link by email instead of entering the password (Accounts: On the website).

Support disclosure

Only in installations with several tenants. Admins of a tenant disclose a participant or an account to global admins for a limited time with Release to support in the action menu (Disclose a record to support). For a tenant that encrypts, what global admins see depends on it:

Case	What global admins see
Without a disclosure	The masked pseudonym, e.g. “K••• K•••”
Disclosure without a key	The pseudonym, e.g. “Kind K7Q2”
Disclosure with a key	The name and the other encrypted details of the record, decrypted in their own browser

The record's key is handed over with the disclosure by an unlocked browser of the team, for every support key the tenant has confirmed.

Dialog

Element	Content	Effect
Record	Name, date of birth and identifier	–
Handover	“With the disclosure, your browser hands the key of this record to support ({names}). One key opens the whole record. When the disclosure ends, it is deleted; what support read until then stays read.”	With an open lock and a confirmed support key. The names are the people with a confirmed support key. The browser hands over exactly the one record whose name the dialog shows decrypted above.
Not unlocked	“Your browser is not unlocked. The disclosure then only lifts the mask: support sees “{pseudonym}”, not the name.” with Unlock	Unlock asks for the passkey; the dialog then shows the handover.
No support key	“No support key is confirmed for this tenant yet. The disclosure therefore only lifts the mask: support sees “{pseudonym}”, not the name.” Plus “To read names, support presents its key here once, and you confirm it with an emoji comparison.” or, once it is presented, “Is the person on the phone? Compare the emojis once; after that your browser hands over the record’s key.” with name, fingerprint and Compare emojis	Compare emojis starts the emoji comparison as in the access dialog; the dialog then reloads.
Disclosure period	7 days, 14 days, 30 days, Until the end of the season, each with its end date	Preselected: 14 days. If no season is running, Until the end of the season means 90 days.
Scope	Core data only: “Name and date of birth. Contact details and notes stay masked.”, with a support key also “Encrypted fields are opened by the record’s key in both scopes.” Complete record: “Adds email, mobile, editing notes and payment details.”	Preselected: Complete record. The scopes differ only in details that are not encrypted.
Reason · is logged	Required	Goes into the log.
Disclose	–	Discloses: “The record is now disclosed to support.” With a handover, the browser first encrypts the key for support.

End the release now in the action menu, with “until {date}”, ends the disclosure at once and deletes the keys handed over. After the end of the period, support gets no key any more; fepli deletes it within an hour at the latest. The log records Record disclosed to support, Support disclosure ended, Support disclosure expired, keys deleted and Support key confirmed.

Support key

In another tenant that encrypts, global admins see a badge for their support key instead of the badge for access. A support key applies to every tenant; each tenant confirms it once with an emoji comparison. The lock appears only once the tenant has disclosed records to their confirmed key.

Badge	When	Dialog
Set up support key	No support key yet	Set up support key: “The participant data of {tenant} is end-to-end encrypted: without a key, a support disclosure shows you the pseudonym only. Your passkey creates a support key that applies to every tenant; each tenant confirms it once with an emoji comparison.”, below it “Support · all tenants” and Create support key with passkey. The dialog then presents the key in the tenant.
Present support key	Support key exists, not yet presented in this tenant	Present support key: “So that {tenant} can disclose encrypted records to you, a team member of {tenant} confirms your support key once with an emoji comparison. Open it with your passkey for that.”
Support key awaiting confirmation	Presented, not yet confirmed	“Your support key is waiting for confirmation by {tenant}. Open it with your passkey so the emoji comparison can start.”

After the passkey, the dialog waits: “Ask a team member of {tenant} to confirm your support key – on the phone, in the “Disclose to support” dialog or under “Access requests”. Keep this window open.” After the comparison it shows Support key confirmed with “{tenant} has confirmed your support key. What this tenant discloses to you from now on, you read in plain text in your browser.” The team member sees “The support key of {name} is confirmed. From now on, an unlocked team browser hands it the records you disclose to support.”

Messages

Message	When
“This passkey cannot derive keys (PRF). Use a passkey stored in iCloud, Google or 1Password.”	The passkey does not support the PRF extension.
“The passkey was not confirmed.”	The passkey prompt was cancelled.
“This passkey does not open the keys.”	The passkey opens no key of the account.
“The password is wrong.”	Unlocking with a password
“Your account unlocks with its passkey.”	Unlocking with a password for an account that unlocks with a passkey
“Cannot be decrypted: the stored value does not match its key.”	Tooltip of a value that cannot be decrypted
“That did not work.”	Another error
“That is no recovery key. It starts with “R1-”, followed by 30 characters.”	Recovery, step 1
“The key contains a typo: the check digit does not match. Compare it character by character with the emergency kit.”	Recovery, step 1
“This key belongs to no emergency kit of {tenant}.”	Recovery, step 1
“This emergency kit is no longer valid: a new one was created on {date}. Use the new kit.”	The kit was replaced.
“Access was already recovered with this emergency kit on {date}. It opens nothing any more; somebody with access has to create a new one.”	The kit has been used.
“The e-mail is not confirmed yet. Open the link in the e-mail to {email} and click “Confirm the recovery” there.”	I have confirmed before the confirmation
“The recovery has expired. Please start again.”	The link has expired.
“This recovery no longer exists. Please start again.”	The recovery is completed or replaced by a newer one.
“Too many tries. Try again from {time}.”	Too many keys entered
“The encryption is not switched on; there is nothing to recover.”	Status not Active
“The team key does not match the emergency kit. Cancel and contact fepli.”	Recovery, step 2 or 3
“The team key does not match the one your account knows. No emergency kit is made. Contact fepli.”	Create new emergency kit
“The camera cannot be opened. Enter the key by hand.”	Scan QR code
“The emojis don't match. Nothing was shared. Find out with the person what went wrong before you try again.”	They don't match
“The comparison was cancelled. Nothing was shared.”	The other side cancelled or closed the dialog.
“The comparison expired. Nothing was shared.”	The comparison waited too long.
“Checking the keys failed. Nothing was shared.”	A browser could not confirm the other side's keys after the comparison.
“No open requests.”	Access requests without a request
“The dialog does not name exactly the record decrypted above. Nothing was disclosed.”	Disclose in the dialog of the support disclosure
“The record’s key could not be opened in this browser. Nothing was disclosed.”	Disclose in the dialog of the support disclosure
“The record’s key could not be handed over. Nothing was disclosed; open the dialog again.”	Disclose in the dialog of the support disclosure, if fepli does not accept the key handed over