Tools

Storing files in the cloud is handy. But the word 'encrypted' on a provider's marketing page can mean very different things. Knowing which kind of encryption a service offers is the gap between files only you can read and files the provider - or anyone who forces it - can read too. It is worth getting that split right before you trust a service with anything sensitive.

Two kinds of cloud encryption

The most common form is encryption at rest. Here the provider encrypts your files on its servers but also holds the keys. This protects your data if someone steals a hard drive from the data centre. But it does not protect it from the provider itself, from a rogue worker, or from a legal order that forces the provider to hand over readable copies. It is real protection against some threats and none against others.

End-to-end encryption, sometimes called zero-knowledge or client-side encryption, is the stronger model. Here your files are encrypted on your own device before they go up, with a key the provider never sees. The provider stores only ciphertext it cannot read. So even it cannot reach your files. The trade-off: if you lose your password or recovery key, the provider usually cannot get your data back. The trait that protects you also means no one can rescue you.

Services that encrypt end-to-end

Several services offer real end-to-end encryption. Proton Drive, part of the Swiss-based Proton suite, encrypts files end-to-end by design. pCloud offers an optional client-side encryption feature, sold as pCloud Crypto, for files placed in its encrypted folder. Tresorit and others aim at the same zero-knowledge model. The shared thread is that the encryption happens on your device, not just on the provider's servers.

• Encryption at rest: the provider holds the keys and can read your files
• End-to-end / zero-knowledge: encrypted on your device, unreadable to the provider
• Proton Drive (end-to-end by design) and pCloud Crypto (optional) are examples
• Zero-knowledge means no password recovery - keep your key safe
• Layer it: mainstream storage for ordinary files, encrypted for sensitive ones

Mainstream consumer services sit at a different point on the scale. It is worth being honest about that. The big-name drives usually encrypt data in transit and at rest with keys they control. That is fine for convenience and for guarding against outside theft. But it is not end-to-end encryption. If your goal is that the provider cannot read your files, those services do not meet it by default, whatever the soothing words suggest.

Choosing by what you're protecting

Choosing between models comes down to what you are guarding and how much recovery safety you want. For ordinary, non-sensitive files, handy encryption at rest from a solid provider is perfectly fine. For files you truly need to keep private - financial records, identity documents, private writing - end-to-end encryption is the model that actually delivers, as long as you take charge of your keys.

Whatever you choose, a few practical points apply. Keep a backup of your encryption password or recovery key somewhere safe, because zero-knowledge services have no reset. Remember that filenames and folder structure are sometimes less protected than file contents, depending on the service. And note that strong storage encryption stops protecting a file the moment you share a readable copy with someone else.

A layered, practical approach

It also helps to think about where your trust finally sits. With encryption at rest you trust the provider's honesty and how well it resists legal pressure. With end-to-end encryption you trust the math and your own key habits instead. Neither removes trust fully. But they put it in very different hands. Knowing which hands you prefer makes the choice between services much clearer.

A sound approach for most people is a layered one. Use handy mainstream storage for the bulk of ordinary files, where access and sharing matter most. Save an end-to-end encrypted service, or an encrypted folder, for the smaller set of files that truly need to stay private. That way you get ease where it helps and real privacy where it counts, without pretending one tool does it all.

If you want one pick to start from, an end-to-end encrypted option like Proton Drive or an encrypted pCloud folder is the safer default for sensitive files, because the provider cannot read what you store. Build your habit around that for the files that matter. Keep your recovery key safe. Then you will have cloud storage whose privacy rests on cryptography, not on a promise.