ProtonBlog(new window)

Is cloud storage safe?

Share this page

Most cloud storage services aren’t end-to-end encrypted and can access your files. Here’s what you should look for when choosing a secure cloud storage service.

From family photos to banking statements, your files contain intimate details about you that should be protected when stored in the cloud. But keeping your files safe is trickier than it sounds since most cloud storage providers, such as Dropbox or Google Drive, don’t provide adequate protection. 

In 2016, Dropbox encountered a major hack(new window) in its cloud services, with over 68 million email addresses and passwords stolen and leaked on the internet. While Google Drive hasn’t experienced such a breach, it still holds the decryption keys(new window) to your files and retains the ability to access them at any time. 

Thankfully, you can still store files in the cloud safely and securely by choosing a cloud storage provider that respects your privacy. We show you how in this article. 

What is the cloud?
Security risks with cloud storage
What is secure cloud storage?
How to choose truly secure cloud storage

What is the cloud?

The cloud refers to a group of remote servers delivering hosted services(new window) over the internet. These services include a variety of applications, such as file backup and storage, project management tools, and video games. 

Compared to traditional storage, such as flash drives, you don’t need physical access to the servers powering cloud services. This means you can store and access data in the cloud from anywhere as long as your device is connected to the internet. 

How does cloud storage work? 

When you upload a file to the cloud, it gets saved on a remote server. Your file is no longer tied to your device and is synced across multiple servers. If you’re traveling and don’t have access to the file, you can still download it from the cloud on an internet-connected device. In simple terms, cloud storage works by “giving” you a virtual hard drive you can access wherever you are, whenever you want. 

To prevent unauthorized parties from accessing your file, cloud storage providers often encrypt it while it’s in transit from your device to their servers. When your file reaches their servers, it is decrypted and re-encrypted using keys your cloud storage provider owns and manages. This also means your cloud storage provider can access your files when it wants to, undermining your privacy and security. 

Security risks with cloud storage

Not all cloud storage solutions are made equal. Most modern cloud storage solutions implement security measures to protect your files, but they’re often not robust enough. If your cloud storage provider suffers from a breach, your files could be exposed and stolen by attackers. 

Lack of end-to-end encryption

Popular cloud storage solutions, such as Dropbox and Google Drive, encrypt your file when it’s in transit to and at rest on their servers. But the encryption they use does not include E2EE. In fact, Google Drive and Dropbox retain control of your encryption keys, meaning they can decrypt your files at will. If a hacker breaches Google Drive’s or Dropbox’s servers, they can also steal the decryption keys and access your files. 

Server location 

Since different countries have different data protection laws, the location of your cloud storage solution’s servers also impacts the security of your files. The US, in particular, is notorious for its mass surveillance laws(new window) — if your cloud provider operates from the US, it’s subject to these laws. 

Federal law enforcement in the US can also issue gag orders to prevent an individual from knowing they’re under surveillance. If you’re under investigation and your US-based cloud storage provider receives a court order to reveal your files, it can easily decrypt and hand them over to law enforcement agencies — all without your knowledge or consent.

Legal jurisdiction of the cloud storage solution 

The legal jurisdiction of your cloud provider’s headquarters is equally important. Most developed countries participate in intelligence-gathering networks, such as the 5 Eyes, 9 Eyes, or 14 Eyes agreements(new window). These networks create a legal framework for countries to gather intelligence across international borders. If your cloud provider is based in one of these countries, your files could be spied on by foreign governments. 

Data breaches and other cyberattacks

According to a 2022 report from IBM(new window), nearly half of all data breaches happen in the cloud. If your cloud storage solution is not end-to-end encrypted, your files and sensitive data could be exposed in a cyberattack. 

In August 2021, Accenture suffered a ransomware attack(new window) on its cloud-based services, resulting in a massive data leak. Some of its customers’ sensitive information was compromised and sold on the dark web. Earlier this year, over (new window)three(new window) million user accounts of the cloud-based digital scheduling platform FlexBooker were stolen(new window) and traded on hacker forums. Neither Accenture nor FlexBooker used E2EE to protect customer data. 

What is secure cloud storage?

To eliminate security risks, you can use secure cloud storage. Secure cloud storage works just like regular cloud storage but is protected with end-to-end encryption (E2EE). 

E2EE is an advanced security protocol that ensures nobody can open your files without your permission, not even your cloud storage provider. When you upload a file to an encrypted cloud storage solution, your file is immediately encrypted on your device and stays encrypted when stored in the cloud. When you re-download the file from the cloud to your device, the file is decrypted using a decryption key you own and control. 

Besides E2EE, a secure cloud storage solution should also:

  • Be hosted in privacy-friendly countries so you can benefit from strict data protection laws
  • Be open source so anyone can inspect the code to verify the security features have been implemented correctly
  • Support two-factor authentication to provide an additional layer of security to your cloud storage account
Protect your files with end-to-end encryption with Proton Drive

How to choose truly secure cloud storage

Thankfully, you can mitigate the risks associated with cloud storage by ensuring strong protection for your files. 

Use end-to-end encrypted cloud storage 

The best way to prevent your files from falling into the wrong hands is to use an end-to-end encrypted cloud storage provider, such as Proton Drive. Files encrypted using end-to-end encryption are always secure. Even if your cloud storage provider encounters a server breach, a hacker can’t access your files without obtaining your private key that’s securely stored on your device.

Two-factor authentication 

Two-factor authentication(new window) (2FA) provides additional security to your cloud storage account by requiring two pieces of information when you sign in: your password and proof of possession of a device. Together, they help determine you’re the owner of the account. 2FA comes in many forms, but the most popular ones are one-time verification codes generated by an authenticator app (TOTP), and security keys(new window) (also known as hardware keys or 2FA keys). 

Read the privacy policy 

Privacy policies(new window) explain how organizations collect, store, and secure your personal information. Reading your cloud provider’s privacy policy is a great way to determine how safe your data is. For example, Dropbox’s privacy policy(new window) states, “your files may be disclosed to third parties” if they determine “such disclosure is reasonably necessary”.

On the other hand, Proton’s privacy policy states, “we do not have the technical means to access the content of your encrypted emails, files, and calendar events”. Even if we receive a court order to turn over your documents, we can’t since we don’t have the decryption key to decode your encrypted files. 

Server location 

As explained earlier, knowing the location of your cloud provider’s servers is critical to protecting your files. You should always pick a secure cloud storage provider with servers located in countries not part of any intelligence-gathering network. 

Known for its political neutrality, Switzerland is home to some of the world’s strictest data protection laws. Any foreign surveillance request must first be examined by a Swiss court for legitimacy and validity. If you’re being investigated under Swiss law, you also have a legal right to be notified of all surveillance procedures. 

Swiss privacy laws

Switzerland is one of the few countries in the world to have data-processing regulations built into its constitution, allowing Swiss companies and residents to benefit from strong privacy protections. In 2020, the Swiss parliament passed a new law to the Federal Data Protection Act(new window), including the following changes:

  • Genetic and biometric data now fall under the definition of sensitive data.
  • The principles of “privacy by design” and “privacy by default” must be applied to all software, hardware, and services created by Swiss companies. These principles require companies to integrate the protection and respect of user privacy into the products or services they develop.
  • In the event of a data breach, Swiss companies must notify the Swiss Federal Data Protection and Information Commissioner promptly. 

These changes come into effect on September 1, 2023. Because of this, Switzerland is one of the best countries to keep your data safe and private. 

The better way to secure your files

Since your files and documents can reveal a lot of sensitive information about you, keeping them safe is a critical priority. With Proton Drive, all your files are encrypted automatically — no technical knowledge or special skills are needed. All you need to do is create a Proton Drive account and upload them. 

Proton Drive also comes from the same team that built Proton Mail and Proton Calendar, and it uses the same E2EE to secure your files. Unlike Google Drive and Dropbox, Proton Drive is designed so no one can access your files(new window) without your permission. All contents of your file, including its name, extension, size, and other metadata, are automatically encrypted. We also use cryptographic signatures on all files and signatures so they cannot be tampered with.

All Proton services, including Proton Drive, support TOTP and security keys(new window). With 2FA or a security key enabled, even if a hacker compromises your password, they will not be able to sign in to your Proton Drive account without access to your TOTP or security key. 

We own, operate, and invest heavily in our own servers in Switzerland and Germany. Our servers are protected with fully encrypted hard disks and located in security centers with biometric access. Even if our hardware is confiscated, your files are still kept safe with end-to-end encryption. 

When you use a Proton Drive account, you can:

  • Use our free cloud storage plan which gives you up to 1 GB of storage
  • Share your files with others by creating secure, password-protected links 
  • Set sharing time limits that give you control over who can access your files and for how long
  • Monitor suspicious activity by tracking the number of times your files have been downloaded
  • Search for files easily, even when they’re end-to-end encrypted

If you want to support our mission of building a better, more private internet, consider upgrading to a paid Proton Drive account for 200 GB total storage and priority support.  

Keep your files private, share them securely
Get Proton Drive free

Share this page

Lydia Pang(new window)

Lydia is a lifelong book-lover and her professional experience spans several industries, including higher education and editorial writing. She's excited to write for Proton and champion privacy as a fundamental right for everyone.

Related articles

Can you password-protect a folder in Google Drive?
Protecting a folder with a password is a simple yet effective way of securing files. You may wonder whether you can password-protect a folder in Google Drive. We explain what access controls Google Drive offers and what you can do to improve your sec
Proton Pass now supports passkeys on all devices and plans
We’re excited to announce that Proton Pass supports passkeys for everyone, allowing you to manage and use passkeys across all devices seamlessly. Passkeys are an easy and secure alternative to traditional passwords that can help prevent phishing atta
what is a passkey?
Passkeys are a new way to secure your online accounts using cryptographic keys instead of passwords. They offer a high level of convenience and security, and are a real game-changer in the way we access and secure sites. What is a passkey, though, an
Apple’s marketing team has built a powerful association between the iPhone and privacy. The company’s ad campaigns claim that “what happens on your iPhone, stays on your iPhone.” And, “Privacy. That’s iPhone.” But Apple’s lawyers are telling a diffe
A cyberattack on national public employment service France Travail has exposed the personal data of as many as 43 million people.  The latest breach is the second major cybersecurity attack to happen in France in the past month, raising concerns abo
If I share a folder in Google Drive, can anybody see my other folders
Google Drive makes it easy to share files and folders, but you may have wondered at some point whether the people you’ve shared a folder with can see your other folders. We answer this question below and also share some tips for truly secure link sha
In 2014, Proton Mail was introduced as a web app, revolutionizing how we think about email privacy. Today, we’re excited to broaden the horizons of secure communication by launching the Proton Mail desktop app. Anyone can now use the new Proton Mail