iCloud, Google Drive & Dropbox: How Private Is Your Cloud, Really?
Every major cloud provider will tell you your files are "encrypted." Most of them mean something narrower than you'd assume. Here's a fair, plain-language look at what mainstream providers actually do — and where zero-knowledge encryption is a genuinely different model, not just a marketing word.
"Encrypted" almost always means encrypted-at-rest
Google Drive, iCloud, and Dropbox all encrypt files sitting on their servers. That protects you from one specific scenario: someone physically stealing a hard drive from a data center. It does not, by itself, stop the provider itself from reading your files — because the provider holds the encryption key, not just the encrypted data.
Why the key matters more than the encryption
Encryption without a key you exclusively control is closer to a locked filing cabinet where the landlord also has a copy of the key. It keeps out random passersby. It does not keep out the landlord, or anyone the landlord is legally compelled to let in.
This is the practical difference between "encrypted" and "zero-knowledge." Zero-knowledge means the key is derived from your password, generated on your device, and never transmitted to the provider — so there's no copy of the key for anyone to hand over, voluntarily or otherwise.
What that means for real scenarios
| Scenario | Standard cloud (Drive, iCloud, Dropbox) | Zero-knowledge cloud |
|---|---|---|
| Government data request with valid legal order | Provider can usually comply, holding the key | Provider can only hand over unreadable encrypted blobs |
| Server breach | Attacker may access readable files | Attacker gets encrypted data, useless without your key |
| Automated content scanning | Commonly used for abuse/policy detection | Not technically possible — provider never sees plaintext |
| Employee with server access | Technically capable of accessing files, policy-restricted | Not technically capable, by design |
None of this makes mainstream providers bad actors — most operate within their stated policies. The difference is that with standard cloud, your privacy rests on policy and trust. With zero-knowledge, it rests on math that doesn't care about policy changes.
The trade-off, honestly
Zero-knowledge encryption has one real downside: if you lose your password and have no recovery token, nobody — including the provider — can get your files back. There's no "verify your identity and we'll reset it" option, because there's nothing on the server side to reset. That's the cost of nobody else holding the key. See our piece on planning for exactly that scenario.
The honest takeaway
If your files are genuinely disposable — a folder of memes, temporary work files — the difference barely matters. If your files are photos of your kids, financial documents, or anything you'd rather no third party ever technically be able to read, the key-holder question is the entire ballgame, not a footnote.
A cloud that can't read your files, even if it wanted to.
Zero-knowledge, AES-256-GCM encryption, one-time payment. €49 for 1 TB during the August launch offer.
Switch to zero-knowledge →