Mega Alternative: Storage Limits, Jurisdiction, and What "Zero-Knowledge" Actually Means

If you are searching for a mega alternative, you have probably hit one of three walls: transfer caps that throttle your actual usage, questions about what New Zealand's Five Eyes membership means for your files, or a growing suspicion that "zero-knowledge encryption" stops being zero-knowledge the moment an AI agent gets wired into the same data plane. This piece walks through all three, with specifics. We build Selina, a privacy-focused AI assistant, so we think about these tradeoffs constantly. Not every answer points back to us. Some do.

Key Takeaways

• MEGA offers real client-side encryption by default, even on its free tier. But encryption is not the whole story: jurisdiction, transfer caps, and new AI-agent integrations each introduce trust boundaries worth understanding before you commit.
• New Zealand is a Five Eyes member. Courts there have already compelled MEGA to hand over account metadata (IP addresses, email details) under legal process. File contents remain encrypted, but "metadata" is not nothing.
• MEGA's paid plans look generous on raw storage, but sharing and transfer bandwidth caps (as low as 1 TB/month on entry tiers) can quietly limit what you actually do with that space.
• The phrase "zero-knowledge" deserves scrutiny wherever you see it. If a provider integrates AI processing against your stored data, the trust model changes, even if the underlying encryption hasn't.
• Alternatives worth evaluating differ on architecture, not just price per gigabyte. The right question is not "how much space" but "what can technically be compelled, throttled, or accessed."

What does MEGA actually offer on its free and paid tiers?

MEGA's free plan starts at 20 GB of encrypted storage. The paid ladder runs from Pro Lite (400 GB storage, 1 TB transfer) up through Pro III (16 TB storage with a matching 16 TB monthly transfer allowance). There is also a Pro Flexi tier priced per terabyte, which scales with actual usage starting at 3 TB. At high capacities, Flexi can be substantially cheaper than comparable Google One plans: roughly €19.99/month for 8 TB on MEGA versus about double that on Google One.

Those numbers look good on a spec sheet. The friction shows up in practice.

Why do MEGA's transfer caps matter more than storage size?

Because storage you cannot move is storage you cannot use. On MEGA's cheapest paid plan, sharing is capped at a maximum of 3 TB per month. If you regularly send large files to collaborators or clients, you will hit that ceiling. The Pro Lite tier is even tighter at 1 TB of monthly transfer. Once you exhaust it, your links stop working until the next billing cycle.

Most comparison articles rank cloud providers by gigabytes-per-dollar. That metric misses the point. Effective usable throughput (storage minus transfer limits minus any overage friction) is the number that matters for anyone doing real work. A 2 TB vault with uncapped transfer beats a 16 TB vault where sharing is metered.

This is the quiet tax on "generous" storage. MEGA's pricing is competitive at rest. It gets expensive in motion.

Is MEGA safe? What does Five Eyes membership mean in practice?

MEGA is headquartered in Auckland, New Zealand. New Zealand is a member of the Five Eyes intelligence-sharing alliance, alongside the US, UK, Canada, and Australia. Multiple reviewers note this as a jurisdictional caveat, and they are right to, but most of them treat it as a static badge. It is not. It is a process risk.

Here is what that process looks like concretely. In a real case, MEGA fought a New Zealand High Court bid to limit how much user data had to be disclosed for a US court proceeding. The NZ court authorized release of IP addresses and email/account details tied to five user accounts. File contents remained encrypted. MEGA could not decrypt them. But account metadata (who, when, from where) was compelled and delivered.

"Metadata is not nothing" is an understatement. For many threat models, knowing that someone uploaded files at a specific time from a specific IP address is the whole game. The encryption protects content. It does not protect the fact of the activity itself.

Whether this matters to you depends entirely on your threat model. MEGA's encryption is genuine and default, which puts it ahead of most mainstream providers. But "safe" is not a binary property. It is a function of what you are protecting, from whom, and what you consider acceptable exposure.

Does MEGA's zero-knowledge encryption hold up under scrutiny?

For files at rest, yes. MEGA performs client-side encryption before upload. The company cannot decrypt your files or private conversations. Lose both your password and recovery key, and your data is permanently gone. That is the intended behavior of a zero-knowledge system, and MEGA delivers it.

Two caveats deserve mention.

First, MEGA publishes its client-side source code for review, but the server-side code remains closed, and the license does not technically qualify as open source. You can verify what the client does. You cannot verify what the server does. This is a meaningful distinction if your trust model requires full-stack auditability.

Second, MEGA's security has faced scrutiny in the past, with independent researchers identifying several cryptographic issues. Those specific flaws have been patched. But the history is worth knowing, because it illustrates that "zero-knowledge by default" is a property that must be maintained over time, not just declared once.

What happens to "zero-knowledge" when AI agents enter the picture?

This is the question almost no comparison article is asking yet, and it is the most important one for 2026.

MEGA's command-line tool (MEGA CMD) now supports user-selected AI agents that can operate against account data. The encryption design has not been abandoned. But think carefully about what "zero-knowledge" means once an AI agent has operational access to your encrypted vault.

In a pure zero-knowledge system, the provider never sees your plaintext. When you grant an AI agent access to that same data, someone (or something) other than you is now processing your plaintext. Even if decryption happens client-side and the agent runs locally, the trust boundary has expanded. If the agent calls an external API, the trust boundary has expanded further. The encryption still exists. The "zero-knowledge" property, in the strict sense, may not.

This is not unique to MEGA. The entire industry is moving this direction. Google One now bundles AI features directly into storage plans, selling expanded prompts and image generation alongside your file vault. The pitch is convenience. The tradeoff is that your storage provider and your AI provider increasingly share a data plane.

The honest architectural question: does granting AI access to your encrypted vault quietly reintroduce the trust boundary you switched to MEGA to avoid?

We think about this a lot at Selina. Our approach is to keep the concerns separated. Files uploaded fresh through SelinaSEND are zero-knowledge, end-to-end encrypted. The AI assistant side (chat, memory) runs on a stack of frontier models, routed per task. Memory is encrypted at rest but is not end-to-end encrypted, because content processed by a model at inference was never zero-knowledge. We state that plainly because the distinction matters. Bundling AI and storage into one product and calling the whole thing "zero-knowledge" is a claim that deserves more scrutiny than it typically gets.

Is there a mega personal alternative that handles privacy differently?

If you are specifically looking for a mega personal alternative for individual use (not team or enterprise storage), the evaluation criteria shift. You probably care less about collaboration features and more about: can the provider technically comply with a data request, what gets logged, and what happens when you delete something.

A few architectural patterns worth comparing:

• Client-side encryption, centralized hosting (MEGA's model): Your files are encrypted before upload. The provider holds ciphertext. Metadata (account details, IPs, timestamps) can be compelled. File contents cannot. This is good. It is not complete.
• Zero-knowledge transfer with no persistent storage: The file exists in transit, encrypted end-to-end, and is not retained after delivery. There is nothing to compel because there is nothing stored. SelinaSEND works this way for fresh file uploads.
• Distributed or federated storage: No single provider holds the complete file. Compliance becomes jurisdictionally complex for any requesting party. Harder to build, harder to use, but architecturally resistant to single-point compulsion.

The right model depends on what you are actually doing. Long-term archival storage has different requirements than secure file transfer. MEGA is strongest at the first. If your primary use case is sending files to specific people rather than parking them indefinitely, a transfer-first tool may be a better fit.

How do MEGA's collaboration and productivity tools compare?

Multiple 2026 comparison reviews consistently identify the same gap: MEGA is competitive on raw storage and price, weakest on collaboration and productivity tooling. There is no integrated document editor comparable to Google Docs or Microsoft 365. Shared folder management exists but is basic. If your workflow requires real-time co-editing or project management layered on top of storage, MEGA will feel sparse.

This is a deliberate tradeoff, not an oversight. Rich collaboration features require server-side processing of your content. That processing conflicts with zero-knowledge design. You cannot index a document for full-text search or render a real-time collaborative editing session without the server seeing plaintext at some point. MEGA chose encryption over features. Whether that trade is correct depends on what you value.

Some alternatives attempt both, with varying degrees of honesty about the resulting trust model. Read the architecture section of any provider claiming both zero-knowledge encryption and real-time collaboration. One of those claims is weaker than advertised.

What should you actually evaluate when choosing a MEGA alternative?

Skip the feature matrices. Ask these questions instead:

What can be compelled? Not "is it encrypted" but "if a court order arrives, what does the provider have to hand over?" Encrypted file contents are typically safe. Account metadata, access logs, IP addresses, payment records: these are usually fair game regardless of encryption. Some architectures minimize what gets collected in the first place. A short retention window for operational metadata is better than indefinite logging. No retention claim should be trusted without verification.

What is the effective transfer throughput? Storage without adequate transfer bandwidth is a warehouse with a narrow door. Check monthly transfer limits, sharing caps, and whether overages are metered or simply blocked.

Where does decryption happen? Client-side decryption is meaningfully better than server-side. But if the client then sends plaintext to an AI API for processing, the benefit narrows. Trace the full path your data takes, not just the storage leg.

What does "delete" mean? On some platforms, deletion removes your access without removing the data. On others, deletion triggers cryptographic erasure (destroying the key that protects the data, rendering the ciphertext unrecoverable). These are not the same thing.

Is the source verifiable? Published client code is a start. Published client code under a restrictive license that technically is not open source is less useful than it appears. Server-side opacity remains the industry norm, and honesty about that opacity is itself a signal.

How does pricing compare across the realistic alternatives?

At the low end, MEGA's 20 GB free tier is more generous than most. Google offers 15 GB shared across services. Dropbox offers 2 GB on its free plan. For personal users who just need a small encrypted vault and do not want to pay, MEGA's free tier is hard to beat.

At scale, the comparison gets more interesting. MEGA's Pro Flexi at €19.99/month for 8 TB undercuts Google One significantly. But Google bundles productivity tools, AI features, and ecosystem integration into that price. You are not comparing storage to storage. You are comparing encrypted storage to an application platform that includes storage.

For privacy-focused alternatives, pricing tends to run higher per gigabyte because the market is smaller and the infrastructure costs of zero-knowledge architectures are real. The question is whether the delta is worth it for your use case. If you are storing family photos, probably not. If you are transferring sensitive documents to clients, probably yes.

What matters more: jurisdiction or architecture?

Architecture. Every time.

Jurisdiction determines which legal system can compel disclosure. Architecture determines whether there is anything to disclose. A provider in the most privacy-friendly jurisdiction on earth is still a risk if it holds your plaintext. A provider in a Five Eyes country that genuinely cannot access your data (and generates minimal metadata) may be a better practical choice.

MEGA sits in an interesting middle ground. The architecture is strong (client-side encryption, zero-knowledge for files). The jurisdiction is imperfect (Five Eyes, with demonstrated willingness to compel metadata). The combination is reasonable for most personal threat models. It is insufficient for some.

The worst option is a provider that markets jurisdiction as a feature while quietly holding server-side encryption keys. You see this more than you would expect. "Based in Switzerland" is not a substitute for "we structurally cannot read your data." Both matter. The second matters more.

Where does Selina fit in this comparison?

Selina is not a cloud storage product. It is a privacy-focused AI assistant that remembers you across conversations, running on a stack of frontier models routed per task. The overlap with this discussion is narrow but real: we also handle file transfer (through SelinaSEND) and we also make encryption claims, so we hold ourselves to the same scrutiny we are applying here.

Files uploaded fresh into SelinaSEND are zero-knowledge, end-to-end encrypted. Standalone notes written outside the AI are also zero-knowledge. Chat messages are encrypted in transit and at rest, but not end-to-end, because the content was processed by a frontier model during creation. Files sent from SelinaVault are encrypted at rest, under a key you control, and cryptographically erasable. Operational metadata is kept for a short retention window, not stored indefinitely.

We are not trying to replace your cloud storage. If you need 8 TB of archival space, MEGA or a dedicated storage provider is the right tool. If you need to send sensitive files to someone with actual zero-knowledge guarantees and no transfer caps, that is where SelinaSEND fits. Different tools for different jobs.

If you want to see how the transfer side works: start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io