Keybase

What Keybase is and how it works

Keybase started in 2014 as a public directory that linked PGP keys to verified social identities (Twitter, GitHub, websites). It grew into a full end to end encrypted communications platform with chat, group teams, encrypted file storage (KBFS), encrypted git repositories and Stellar wallet integration. In 2020, Keybase was acquired by Zoom Video Communications to bolster Zoom's end to end encryption capabilities. Active product development has slowed since, but the service is still operational and the open source clients are still maintained.

What data Keybase processes

Even with end to end encryption, Keybase processes substantial metadata: username, optional email, public PGP keys, identity proofs on social platforms, friend network and team memberships, device identifiers (one per install), IP address per session, message timestamps, file sizes and chat counts. The encrypted payloads of messages and files are stored on Keybase servers but cannot be decrypted by Zoom. The web client at keybase.io sets session and CSRF cookies during login.

GDPR implications

Keybase processes personal data of EU residents (username, email, IP, social graph) and is therefore subject to GDPR. Since Zoom is established in the US, transfers to Zoom servers in the US must be addressed via Standard Contractual Clauses and the EU, US Data Privacy Framework. The metadata processed can be considered low risk on its own but reveals communication patterns and identity links that may be sensitive in certain contexts (journalists, activists, regulated professions).

Consent and lawful basis

For an individual signing up to Keybase, the lawful basis is contract performance (Art. 6(1)(b) GDPR), since the service is requested by the data subject. For organisations deploying Keybase to employees, contract performance and legitimate interest in secure communications are typical bases, with employee information requirements. For the web client cookies, the ePrivacy Directive applies and consent is required for non strictly necessary cookies.

Data transfers and Zoom ownership

Since 2020, Keybase has been operated by Zoom (US), with infrastructure on AWS in the US. This puts Keybase squarely in the US transfer category. Standard Contractual Clauses apply, Zoom is certified under the EU, US Data Privacy Framework, and the strong end to end encryption of message content offers a substantive supplementary measure. Run a Transfer Impact Assessment if you deploy Keybase for sensitive use cases.

Practical compliance steps

For organisational use, sign the Zoom DPA (which covers Keybase), document Keybase in your record of processing activities, run a Transfer Impact Assessment for US transfers, inform users (employees or members), prefer device names that do not identify the bearer, avoid using Keybase identity proofs to link personal accounts to professional identities, and consider migrating to actively developed alternatives if you need long term roadmap certainty.