Confidential data at stake after Zivver acquisition

What’s going on?

• Zivver, founded in 2015 in Amsterdam, provides encrypted communication services (email, chat, documents) used by government agencies, hospitals, courts, etc.

• With its acquisition by Kiteworks, Zivver has become part of an American company.

• Kiteworks’ management consists of several individuals with backgrounds in Israel’s elite intelligence unit (Unit 8200).

• According to Zivver, all customer data remains encrypted, servers remain in Europe, and the company itself does not have access to the encryption keys.

However:

• Follow the Money and external cybersecurity experts investigated instances in which messages and attachments are sent to Zivver’s servers in “plain,” readable form before encryption takes place.

• This means that, at that stage, Zivver could technically view the content, even though Zivver claims this does not happen.

• Because the parent company is based in the U.S., the data is subject to U.S. law. This poses risks, especially in a time of geopolitical tensions.

 

Risks for Dutch Organizations

1. Legal Framework Shifts
   Because Kiteworks is based in the United States, U.S. government agencies may demand access or oversight under U.S. law. Even if data is stored in Europe, U.S. law may sometimes take precedence.

2. Uncertainty Regarding “Zero-Knowledge” Claims
   Zivver claims that it does not manage the encryption keys, meaning that only the customer has access. However, research indicates that in some use cases, data reaches Zivver in a readable form before encryption. This means Zivver itself may have access, or, in theory, third parties within the organization.

3. Geopolitical and Security Risks
   The IDF background of leaders at Kiteworks (formerly Accellion) raises questions about potential conflicts of interest or pressure from intelligence agencies. In times of international tension, such connections are sensitive.

4. Lack of oversight or prior review
   According to the article, the acquisition was not reviewed under the Act on Security Reviews of Investments, Mergers, and Acquisitions (Vifo), as Zivver is not considered critical infrastructure. As a result, there is no formal assessment of the risks associated with this acquisition.

 

What can Dutch organizations do?

As an organization (government agency, hospital, law firm, critical infrastructure, etc.), you may want to consider the following steps to strengthen your data security:

• Audit of Current Security: Have an independent review conducted to examine how data flows, especially before encryption. Is there a point at which data ends up on servers in a readable format?

• Contractual guarantees: Request explicit service level agreements (SLAs) and contractual assurances regarding encryption, management keys, server location, and who has access to which data.

• Legal review: Seek legal advice on how U.S. and European laws and regulations apply to your services. Consider the GDPR, Schrems II, the CLOUD Act, etc.

• Consider alternatives: Are there any entirely European providers that comply with NEN 7510 and ISO 27001 and have no foreign ownership involving intelligence agencies?

• Regulations & Policy: Promote regulations that classify encryption services as critical infrastructure, so that acquisitions and foreign investments in such sectors are subject to scrutiny. Also consider transparency requirements.

 

How does ALTA-ICT view this (our approach)?

At ALTA-ICT, we believe that trust must be earned, but it must also be verified. Our approach includes:

• Operating in accordance with ISO 27001/NEN 7510 to strictly regulate data management, encryption, and access.

• Technical audits and penetration tests, including “pre-encryption” scenarios, to identify potential vulnerabilities.

• Transparent documentation detailing who manages the keys, where the data is stored, who has access to it, and under what circumstances.

• Scenario simulations and risk management: What if foreign legislation is invoked? How do we then effectively protect the data?

• Strategies to reduce dependence on foreign suppliers when security risks are unacceptable.

 

Conclusion

Kiteworks’ acquisition of Zivver raises important questions about trust, the legal framework, and the technical realities of data security. For Dutch organizations, the saying “forewarned is half protected” applies. You should not rely solely on claims, but actively monitor, protect, and, if necessary, implement alternatives.

Would you like to work with ALTA-ICT to assess your organization’s current status in this area and identify potential improvements? Feel free to contact us for a free audit consultation.

Schedule a free audit: alta-ict.nl/contact/
info@alta-ict.nl

Do you use Zivver and want to know what the alternatives are? Read “Secure Email in the Netherlands: Zivver, Purview, or Something Else—or How ALTA-ICT Approaches Security.”

Reference

¹https://www.ftm.nl/artikelen/vertrouwelijke-zaken-te-grabbel-na-overname-zivver-door-kiteworks

²https://www.linkedin.com/posts/altaict_cybersecurity-databescherming-avg-activity-7373234138943885312-tGYa