Cloud Storage with End to End Encryption: A Practical Buyer's Comparison

You already know you want cloud storage with end to end encryption. You are past the "why encrypt" conversation. The harder question is which providers actually deliver on that claim, and which ones are coasting on a marketing page that falls apart under scrutiny. This guide walks through the technical criteria that matter, the providers that survive them, and the ones that don't. We wrote it because we got tired of buying guides that rank providers by star ratings without checking whether the cryptography actually works.

Key Takeaways

• A 2024 peer-reviewed study broke the encryption of four out of five major "E2EE" cloud providers, including ones with millions of users. Marketing claims and cryptographic reality are frequently different things.
• End-to-end encryption can be feature-specific rather than account-wide. Some providers only encrypt a single folder or a subset of data categories, leaving metadata, sharing links, and search indexes readable by the server.
• Jurisdiction and legal-compulsion resistance matter as much as cipher choice. The ongoing Apple-vs-UK saga shows that governments can force providers to withdraw encryption features entirely.
• The credibility bar for a provider is a published, dated, third-party security audit plus open-source clients, not a badge on a landing page.
• Quantum-resistant encryption is starting to appear in marketing copy. Treat it as a future signal, not a current buying criterion.

What Does "End-to-End Encrypted" Actually Mean for Cloud Storage?

It means the encryption and decryption keys live exclusively on your devices. The server stores ciphertext it cannot decrypt. If the provider is subpoenaed, breached, or staffed by someone curious, the data they hand over is useless without your key. That is the definition. A surprising number of services that advertise this do not meet it.

Standard cloud providers like Google Drive, Dropbox, and OneDrive encrypt data in transit (TLS) and at rest (server-side encryption), but they hold the keys. They can read your files. They can be compelled to hand them over in plaintext. Privacy Guides community discussions have documented this distinction extensively: server-side encryption protects against physical disk theft, not against the provider itself.

Zero-knowledge encryption is a stricter subset. It means the provider cannot decrypt your data, period, because they never possess the key material. When a provider claims zero-knowledge, you should be able to verify that claim through open-source client code or a published audit. If neither exists, you are trusting a sentence on a website.

How Did Researchers Break Four Out of Five "E2EE" Providers?

They assumed the server was malicious. That single assumption collapsed nearly everything.

In a CCS 2024 paper from ETH Zurich, researchers cryptographically analyzed five major providers that market themselves as end-to-end encrypted: Sync, pCloud, Icedrive, Seafile, and Tresorit. These five collectively serve over 22 million users. The results were severe. In four of the five, the researchers demonstrated attacks ranging from file injection and data tampering to, in some cases, direct access to plaintext file contents.

The attack model was not exotic. It assumed a server operator (or anyone who compromises the server) actively tries to break confidentiality. For a service whose entire value proposition is "we can't see your files," that should be the baseline threat model. For four of these providers, it was not.

The specific failures varied. Some lacked origin authentication, meaning the server could substitute its own keys during file sharing. Some used unauthenticated encryption modes, allowing ciphertext manipulation. Some failed to bind file metadata to the encryption in a way that prevented silent replacement of files.

The lesson for you as a buyer: ask "what is your threat model" and "does it include a malicious server." If the provider looks confused by the question, you have your answer.

Why Is Follow-Up Academic Work Happening Now?

Because the CCS 2024 paper exposed a deeper problem: there were no formal security definitions for E2EE cloud storage to begin with. Researchers at UCSD and MIT CSAIL are now building formal security proofs specifically for this category. The fact that this foundational work is happening after providers already have millions of users tells you something about the gap between marketing velocity and cryptographic rigor.

What About MEGA?

MEGA is worth a standalone paragraph because it is a cautionary case that keeps evolving.

In 2022, ETH Zurich researchers found what they described as "devastating" flaws in MEGA's cryptographic architecture, including a theoretical path to recovering users' RSA private keys. MEGA patched some issues, but the researchers stated that a complete fix would require a fundamental system redesign. MEGA's own founder, Kim Dotcom, publicly said after cutting ties with the company that he did not believe user data was safe there anymore.

Additionally, MEGA's bundled S4 object storage uses server-side encryption, not end-to-end encryption. If you are evaluating MEGA, verify which specific product and which specific storage tier carries the E2EE guarantee, because it is not uniform.

Is "Feature-Level" Encryption a Hidden Gap?

Yes, and it is one of the most common ways providers technically tell the truth while leaving most of your data exposed.

pCloud is a clear example. Its end-to-end encryption is confined to a "Crypto folder." Files outside that folder are encrypted at rest with keys pCloud holds. If you drag a file into the wrong folder, pCloud can read it. This is documented, not hidden, but it means "pCloud offers E2EE" is only true for a fraction of your storage, and only if you pay extra for the Crypto add-on.

Apple's iCloud is an even more instructive case. Apple end-to-end encrypts 15 specific data categories by default (iCloud Keychain, Health data, and others). Everything else, including iCloud Drive files, Photos, Notes, and Backups, is only E2EE if you manually enable Advanced Data Protection. If you haven't toggled that switch, Apple holds the keys to most of your data.

The buying question is not "does this provider offer E2EE" but "what exactly is covered, and what is left out." Metadata, filenames, folder structures, sharing link URLs, search indexes, collaboration state: ask about each one specifically. Providers that encrypt file contents but leave filenames in plaintext have a different privacy profile than ones that encrypt the full object including metadata.

How Does Jurisdiction Affect Your Encrypted Storage?

It can eliminate it overnight. The Apple-vs-UK situation is the live case study.

In January 2025, the UK Home Office served Apple with a secret "technical capability notice" under the Investigatory Powers Act, demanding backdoor access to encrypted iCloud content worldwide. Apple's response was to withdraw Advanced Data Protection from the UK entirely rather than build a backdoor. New UK users lost access to the feature. Existing UK users were told to disable it.

In September 2025, the Home Office issued a narrower second order, this time targeting only British citizens' encrypted backups. Apple is fighting this. As of August 2026, Apple has filed a new legal challenge with the UK's Investigatory Powers Tribunal.

The point is not that Apple did something wrong. Apple fought. Most companies would not. The point is that if your provider is incorporated in a jurisdiction where governments can issue secret compulsion orders, your encryption can be legally stripped regardless of the cryptography. Switzerland, where Proton is based, has different legal dynamics than the UK or the US. Iceland, where Tresorit's operations have a presence, is different again. "Where is this company incorporated, and has it ever received and fought a compulsion order" belongs on your evaluation checklist next to "what cipher suite do you use."

Which Providers Actually Survive Scrutiny?

A short list, with caveats.

Proton Drive

Swiss jurisdiction. End-to-end encrypted with keys generated and held client-side. Proton's documentation states the service has been audited by Securitum, a European security firm, and Proton publishes those audit reports. Open-source clients across Windows, Mac, Linux, Android, and iOS. If you are already in the Proton ecosystem (Mail, Calendar, VPN), Drive integrates without a separate account. The Cloudwards review notes that collaboration and sharing features are more limited than mainstream providers, a real trade-off. 1 GB free tier; paid plans start at the Mail Plus level.

Tresorit

The only provider in the CCS 2024 study that held up well against the researchers' attacks. Swiss-owned (by Swiss Post). Closed-source clients, but has undergone multiple independent security audits. Strong sharing controls with link expiry and permissions. More expensive than most competitors. If your threat model requires resilience against a malicious server (which it should), Tresorit's track record under academic scrutiny is a concrete differentiator, not just a marketing one.

Cryptee

Estonian jurisdiction. Focused on documents and photos rather than general-purpose file storage. End-to-end encrypted. Introduced encrypted photo and video sharing in March 2026. Smaller team, smaller user base, but a focused product that does fewer things and encrypts all of them.

Ente

Open-source, end-to-end encrypted photo storage. Launched Locker, a secure vault product, in February 2026. Fully open-source clients and server code. If code auditability is your primary trust mechanism, Ente gives you the most to verify.

Filen

German jurisdiction. Zero-knowledge encryption with client-side key management. Open-source clients. Generous free tier relative to competitors. Younger company, so the track record is shorter, but the architecture is documented and reviewable.

What Should Your Evaluation Checklist Look Like?

Here is the set of questions worth asking about any provider before you commit data to it.

1. Is there a published, dated, third-party security audit? Not a penetration test of the website. A cryptographic review of the encryption implementation, conducted by a named firm, with the report published or at least summarized publicly.
2. Are the clients open source? If not, is there at least an audit that covers the client-side key management? Closed-source clients with no audit mean you are trusting compiled binaries to do what the marketing page says.
3. What is the stated threat model? Does it include a malicious or compromised server? If the threat model only covers "curious employee" or "network eavesdropper," the provider has not thought about the hard case.
4. What exactly is encrypted end-to-end? File contents only? Filenames? Folder paths? Metadata? Sharing links? Collaboration edits? Get the specific list.
5. Where is the company incorporated? What legal instruments can compel disclosure or backdoor insertion in that jurisdiction? Has the company ever disclosed receiving such an order?
6. How is key recovery handled? If you lose your password, can the provider reset it? If yes, they hold a key recovery mechanism, which may mean they can access your data. True zero-knowledge means "lose your password, lose your data." Providers that offer password reset and claim zero-knowledge are in tension.
7. How are shared files handled? When you share a file with another user, is a new key generated and exchanged client-to-client, or does the server broker the key exchange? If the server participates in key exchange, a malicious server can substitute keys.

Is Quantum-Resistant Encryption a Real Buying Criterion Yet?

Not yet, but it is showing up in marketing copy.

Some 2026 buying guides now highlight providers advertising client-side post-quantum encryption. The concern is real: a sufficiently powerful quantum computer could break RSA and ECC, which underpin most current E2EE implementations. "Harvest now, decrypt later" is a valid threat model for data with a long sensitivity horizon.

But post-quantum cryptography standards (ML-KEM, ML-DSA) were only finalized by NIST in 2024. Implementations are new. The audit ecosystem for post-quantum cloud storage is essentially nonexistent. If a provider tells you they are "quantum-safe" today, ask for the audit. If there is no audit, you are beta-testing their cryptography with your data.

Treat quantum-resistance as a signal that the provider is thinking ahead. Do not treat it as a current security guarantee.

How Do You Evaluate "Zero-Knowledge" Claims Specifically?

Zero-knowledge means the provider possesses no key material that could decrypt your data, not at rest, not during upload, not during sharing. The practical tests are straightforward.

Can you reset your password without losing data? If yes, the provider can derive or recover your encryption key somehow. That is not zero-knowledge. Can the provider generate a preview thumbnail of your image? If they show thumbnails you did not generate client-side, they decrypted the image server-side. Can the provider search inside your files? Full-text search on encrypted data is technically possible (searchable encryption schemes exist) but rare in production. If the provider offers full-text search and also claims zero-knowledge, ask how. The answer will be illuminating.

Some reviewers note that distinguishing real zero-knowledge providers from pretenders is an explicit buying criterion. Not all encrypted storage is equal. Some providers charge extra for a single encrypted folder while leaving everything else server-readable. Others apply zero-knowledge encryption uniformly but sacrifice features like collaboration or search to do it honestly.

What Trade-Offs Come with Real E2EE Storage?

Several, and they are worth knowing before you commit.

Collaboration is harder. Google Docs-style real-time collaboration requires the server to understand document state. If the server cannot decrypt the document, real-time multi-cursor editing is extremely difficult to implement securely. Most E2EE providers offer file sharing and version history, not real-time co-editing.

Search is limited. Server-side full-text search requires server-side decryption. E2EE providers either skip search entirely, offer client-side search (which requires downloading indexes), or use encrypted search schemes that are slower and less capable.

Password loss means data loss. If the provider genuinely has no recovery key, forgetting your password means your data is gone. Some providers offer recovery phrases or secondary keys stored separately. Understand the recovery model before you store anything irreplaceable.

Performance can differ. Client-side encryption and decryption add computational overhead. On large files or slow devices, uploads and downloads may be noticeably slower than with a non-E2EE provider. The difference has narrowed as devices have gotten faster, but it is nonzero.

These are real trade-offs. A provider that claims E2EE with no collaboration limitations, full search, and password recovery should make you suspicious, not impressed.

Where Does Selina Fit in This Picture?

Selina is not a cloud storage provider. It is a privacy-focused AI assistant that remembers you across conversations. But the same buyer who cares about E2EE cloud storage tends to care about how their AI conversations are handled, so a brief, honest note is warranted.

Files shared through Selina (via SelinaSEND) are end-to-end encrypted, zero-knowledge. The provider cannot read them. Conversational memory is a different architecture: it is encrypted at rest, but a slice of each request reaches a frontier provider at inference, so memory is not end-to-end encrypted. We built Selina on a stack of frontier models, routed per task, with non-content operational metadata retained for a short retention window. Your account is protected; your content is encrypted. Those are different verbs for different layers, and we use them precisely.

What Should You Actually Do Next?

Pick two or three providers from the list above. Read the CCS 2024 paper (the summary site is accessible even if you are not a cryptographer). Check whether your candidate providers were studied, and if so, how they fared. Look for the audit report, not the audit badge. Check the jurisdiction. Try the free tier with non-sensitive data first. Then migrate deliberately.

The market for genuinely encrypted cloud storage is small, younger than it should be, and still recovering from an academic paper that broke most of its major players. That is not a reason to avoid it. It is a reason to evaluate carefully, trust the math over the marketing, and pick a provider that can show its work.

If your threat model also covers AI conversations and file transfers, start a free 7-day trial of Selina, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io