Encrypted team folders: an overview

Encrypted team folders are team folders that are end-to-end encrypted. Only team members have access to the encryption key, while excluding anyone else, including Dropbox. Admins can also create recovery keys for encrypted folders, in case of user access issues.

Organizational data can be categorized into nonsensitive, sensitive, and highly sensitive. Nonsensitive data can be safely migrated to the cloud, while sensitive data sometimes requires additional protection measures. Highly sensitive data demands the highest level of protection, in some cases with strict adherence to regulatory requirements. End-to-end encryption is recommended for highly sensitive data, while alternative solutions, such as Advanced Key Management or standard Dropbox encryption, may suffice for less sensitive data. Understanding these categories helps organizations safeguard data and maintain compliance.

Encrypted team folders act like normal team folders, but they can only be accessed by authorized team members. The content within an encrypted folder is also encrypted. Encrypted team folders display as a blue folder with a key inside a shield icon. Learn more about file and folder icons.

How to activate team folder encryption

If you’re a team admin, you can activate team folder encryption for your team. To do so:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Click Security.
4. Select Encryption options.
5. Click Get started next to End-to-end encryption.
6. Click Start on the pop-up window to confirm your choice.
7. Click Generate recovery key.
   • Notes:
     • You won’t be able to recover your encrypted data if you get locked out and don’t have this recovery key.
       
     • The recovery key won’t be displayed again, so make sure to save it physically or digitally.
8. Confirm that you have stored the recovery key by entering the last five characters for verification.
9. Review your device registration. You can choose either automatic device registration (recommended) or the manual option with manual key verification.
   •  If you selected automatic device registration, click Finish to complete the activation process.
   •  If you selected manual key verification, confirm this by clicking Set up manual on the next screen. Your team code will then be generated, which you can copy, store, and share with team members. Click Finish to complete the activation process. Click Next to complete the activation process.      
10. Click Create encrypted folder to create an encrypted team folder, or click Dismiss to close the pop-up window and go back to your account.
    

How to create an encrypted team folder

If you’re a team admin, you can create encrypted team folders for your team. To do so:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Click Settings.
4. Select Content.
5. Click Create team folder.
6. Select End-to-end encryption.

How to add and manage recovery keys

Recovery keys make sure data can always be retrieved and decrypted, even in the event of key loss or user access issues. Team admins can create and manage multiple recovery keys for different admins or storage locations.

To create an additional recovery key:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Click Security.
4. Select Encryption options.
5. Click Add new key next to Manage recovery keys, in the End-to-end encryption section.
6. Enter any of your existing recovery keys.
7. Click Generate.
8. Click Copy or Print to copy your recovery key, and store it somewhere safe.
   • Note: The recovery key won’t be displayed again, so make sure to save it physically or digitally.
9. Click Next to complete the activation process.
10. Click Manage recovery keys to manage your existing keys, or click Done to close the pop-up window and go back to your account.

To edit or delete existing recovery keys:

1. Log in to dropbox.com with your admin credentials.
2. Click Admin console in the left sidebar.
3. Click Security.
4. Select Encryption options.
5. Click the Manage button next to Manage recovery keys, in the End-to-end encryption section.
6. A list of your recovery keys will pop up.
7. Click the Delete button (trash can icon) next to a recovery key to delete it permanently. Click Delete to confirm your choice.

How to verify a recovery key

The verification process is a two-way process. The admin needs to verify the device's code, while the user needs to verify the team code. The team code is shown to the admin during the end-to-end encryption activation process. The admin can then share the team code with team members via email. On the user's side, both the team and client codes are displayed in the sync notifications. The user verifies that the displayed team code matches the code provided by the admin.

To verify that the device code shared by the user matches the value displayed to the admin in the admin console:

1. Click Settings.
2. Click Encryption options.
3. Click Review pending devices.
4. Click Accept to register the devices.