The Corona-Warn-App goes to sleep

On 1 June 2023 the Corona-Warn-App entered "sleep mode". The app still opens and still shows stored certificates, but it no longer warns about exposures, no longer receives test results, and will not be updated further. Free citizen testing ended three months earlier, on 1 March. The test centres that filled shopping streets in 2021 have mostly been converted back into shops, pharmacies and empty units.

It is a quiet end to one of the largest digital public-health efforts Europe has seen. We were a small part of it through Labfy, our test-centre management platform, which at its peak served more than 300 test centres and delivered results into the Corona-Warn-App. This is a retrospective: what worked, what did not, and what we are carrying forward.

What the Corona-Warn-App got right

With roughly 48 million downloads and hundreds of millions of certificates stored, the Corona-Warn-App was one of the most-used government apps in Germany's history. Three things made that possible.

The privacy decision. Choosing the decentralised model in April 2020 cost time and caused a public argument, but it is the reason the app was trusted enough to reach a mass audience. No comparable centralised app in Europe achieved the same adoption.

Open source, from day one. Every line of code was public. Security researchers found and reported issues before they could be exploited. When people asked "can this track me?", the answer was verifiable.

Becoming a wallet. The app's second life began in 2021 when it learned to store test and vaccination certificates. Exposure warning was the original purpose; certificate storage was what people used every day.

What did not work as well

Bluetooth as a proximity sensor remained imprecise to the end. Many users received warnings after encounters that carried little real risk, and some real exposures were missed.

The ecosystem was slow to connect. For much of 2020, labs and test centres had no way to deliver results into the app. We saw this gap first-hand — it is the reason we built Labfy's integration in 2021 — but the months lost while the pipelines were missing were the months when the app could have helped most.

Sunsetting was never designed. Nobody planned how a national app should wind down. Sleep mode is a reasonable improvisation, but an exit plan should be part of the architecture of any public system.

What Labfy taught us about building software under pressure

Labfy went from idea to 300+ live sites in about a year. The lessons are ones we now apply to every product we build.

1. Build for the regulation you have, then abstract it. We hard-coded German reporting formats in the first release because speed mattered. By the third change to reimbursement rules we had learned to separate "what the regulator wants this month" from the core data model. Every product with a compliance layer needs that separation from day one.

2. Onboarding speed is a competitive moat. Our customers were opening test centres in days. Getting a new site live in under a day won more deals than any feature.

3. Design for the peak, not the average. Monday-morning and pre-holiday traffic spikes were where the platform was actually tested. Infrastructure that scales horizontally is not a luxury when your users all show up at once.

4. Privacy by architecture beats privacy by policy. Mirroring the Corona-Warn-App's design, Labfy's integration was built so that we could not learn anything about a person's app usage even if we wanted to. That made the data-protection conversations with operators and health authorities short.

5. Know when a product has done its job. Labfy was built for a specific moment. That moment is ending. We keep the platform maintained for the operators who still rely on it, but we are not pretending it is a growth business. Knowing when to stop investing is as much a product skill as knowing when to start.

What we are carrying forward

The pandemic accelerated digital adoption by years, and that acceleration did not reverse. Online booking, digital certificates, e-prescriptions, remote work: the infrastructure built in a hurry in 2020 and 2021 is now simply how things work.

For Daleenda, the experience of running a regulated health-data SaaS platform at scale — booking, registration, compliance reporting, integrations with public systems — is now part of our core expertise. We apply it to appointment and workflow systems for clinics and practices, to compliance-heavy data platforms, and to integrations with public digital infrastructure in Germany and beyond.

The Corona-Warn-App is asleep. The lessons are not.

Talk to a team that has built under real pressure