Frequently asked questions about security and privacy

Below you'll find the questions we get asked most often about the security and privacy of your WebOké Nextcloud. If your question isn't listed, please get in touch with us.

Where are my files stored?

In the Netherlands, in two data centres run by NorthC in Aalsmeer and Oude Meer. Your files never go to American cloud companies. With a Personal, Family or Max package, you also get your own Nextcloud server, separate from other customers. See What is Nextcloud and what is a WebOké Nextcloud?.

Are my files encrypted?

Yes, in two ways: in transit (all traffic goes via https) and on the disks in the data centre. If you want a folder to be readable only on your own devices, you can also use end-to-end encryption. Do read the limitations in End-to-end encryption: when to use it, and when not to first.

Can I turn off the login code by email?

No. The second step at login is switched on for everyone, because a password alone doesn't offer enough protection. However, besides the email code, you can also use an authenticator app, a notification on another device, or backup codes. See Setting up an authenticator app and saving backup codes and Approving login with a notification on another device.

Why doesn't my regular password work in my phone's calendar?

Because that app can't enter the extra login code. For such apps, use an app password. See App passwords: when and how to use them.

Someone else knows my password. What should I do?

1. Change your password (Changing or forgetting your password).
2. Check Devices & sessions to see which devices and browsers are logged in, and revoke anything you don't recognise (Viewing, revoking, or remotely wiping devices and sessions).
3. Also change your mailbox password: that's where your login codes arrive.
4. Turn on an authenticator app (Setting up an authenticator app and saving backup codes).

I received a login code, but I wasn't logging in.

That means someone tried your password and got it right. Don't share the code with anyone and change your password immediately. Then follow the steps above. WebOké will never ask you for a code.

Can I see who has accessed my account?

Under Settings, Security, Devices & sessions, you'll see all browsers, apps and app passwords with their last activity (Viewing, revoking, or remotely wiping devices and sessions). In the Activity app, you can see what's happened with your files and shared folders.

My laptop or phone has been stolen. What now?

Revoke the device or have it wiped remotely under Devices & sessions, and change your password. The full step-by-step plan is in Remotely locking down a stolen laptop.

Who in my package can see my files?

Every user has their own files. Others only see what you share with them yourself. The package administrator can create accounts and reset a password, but can't view your files in Mijn WebOké. Note: anyone who sets a new password for you can then log in as you, as long as the code is sent to an address they can read. So always have users use their own email address.

Does WebOké or anyone else use my files for AI?

No. The AI Assistant in Nextcloud is only switched on if the owner of a Family or Max package turns it on themselves, using their own account with an AI provider of their choice (for example, Mistral, with processing in the EU). Only what you ask the assistant yourself is sent to that provider. See AI Assistant in your Nextcloud.

Do you have a data processing agreement?

Yes. If you use your Nextcloud for business purposes and store other people's personal data in it, you'll sign a data processing agreement with WebOké. You'll find it in our knowledge base: Data Processing Agreement.

Why does logging in suddenly take a long time?

Your internet address is probably being throttled because an incorrect password has been tried too often from your network, often caused by an outdated app. See Multiple invalid login attempts: why you're being slowed down and how to fix it and IP address throttled by an old app: which one is it?.

Is open source actually safe? Can't anyone read the code?

That's exactly why it is. Thousands of developers and security researchers keep an eye on it, so weaknesses are found and fixed quickly. Nextcloud also runs a reward programme for anyone who reports a vulnerability. WebOké installs the security updates for you.