How Osiris encrypts your data
Every chunk Osiris writes to storage is encrypted with AES-256-GCM before it leaves the server, with a separate encryption key per organization. That is a structural property of the chunk store, not a setting to remember to turn on, and it applies the same way in every edition.
Who can actually read your data
On a self-hosted install (the normal way to run Community or Business), your organization's key never leaves your own infrastructure, and nobody outside it holds the key. On an instance a Service Provider operates for you under the Service Provider edition, that provider holds the installation's master key to operate the service, which is unavoidable for a service someone else runs, and can technically decrypt any tenant's data with it, including outside Osiris entirely (for example with the offline standalone-restore tool and the chunk store directly, bypassing the running application). Reading and restoring inside Osiris itself go through audited paths, landing in a tamper-evident, hash-chained log: who, when, for whom, and from which IP. That log cannot see access performed outside Osiris with the master key directly. Choose a provider you trust for the same reason you would trust anyone holding a master key to your data, and have your data processing agreement (Art. 28 GDPR) cover this explicitly.
No phone-home
Osiris does not call home: no telemetry, no licence server contacted at runtime, no connection back to IT Systeme Flores UG. It connects only to what you configure (Microsoft 365, your IMAP servers, your chosen storage, and your mail transport), plus, only when running in public mode, Let's Encrypt for your own TLS certificate, and, only if you switch it on yourself, an optional update check. A licence key is verified offline against a signed Ed25519 signature, not by contacting a server at all.
The rest of the picture
Encryption is one piece of the sovereignty story; where the encrypted bytes physically live is the other, seestorage andYour data is your data for the full picture together.
Frequently asked
How is my data encrypted in Osiris?
Every chunk is encrypted with AES-256-GCM before it leaves the server, with a separate key per organization (tenant). Encryption is not optional or edition-dependent: it applies identically in Community, Business and Service Provider.
Can the operator of my Osiris instance read my data?
On a self-hosted install (the normal way to run Community or Business), no one outside your organization holds the key. On a Service-Provider-operated instance, the provider holds the installation's master key and can technically decrypt tenant data with it, including outside the running Osiris application (for example with the offline standalone-restore tool). Reading and restoring inside Osiris itself go through audited, logged paths (who, when, for whom, from which IP) in a tamper-evident, hash-chained log; access outside Osiris using the master key directly does not appear there. Choose a provider you trust, and cover this in your data processing agreement (Art. 28 GDPR).
Does Osiris send telemetry or call home?
No. No telemetry, no licence server contacted at runtime, no connection to IT Systeme Flores UG. It only connects to what you configure (Microsoft 365, your IMAP servers, your storage and mail transport), plus, only in public mode, Let's Encrypt for your own TLS certificate, and, only if you switch it on yourself, an optional update check.