In short: picking an encrypted cloud storage service without naming the threat you’re guarding against is the most common way to overpay for protection you don’t actually need. The seven providers in this roundup all promise “files only you can decrypt”. They answer that promise differently depending on what you’re defending against: a curious provider employee, a foreign subpoena, a stolen password, or a forgotten recovery key. The same vendor can be the right choice in one scenario and the wrong one in another.
This round was captured from the live pricing pages. Internxt pricing comes from a real read of internxt.com/pricing in a headless browser (the page is a Next.js SPA that does not server-render prices). Proton’s pricing comes from protonvpn.com/pricing in USD via the official currency selector. For the remaining five vendors we confirmed encryption architecture, jurisdiction and free-tier allowance, but did not re-verify per-TB rates — see each vendor’s site directly before budgeting.
In short
Four threat models, four different winners. When the worry is the provider reading your files, you want client-side zero-knowledge on every plan (Internxt, Tresorit, Sync.com, MEGA, NordLocker all qualify). When the worry is a foreign court, you want Switzerland (Proton Drive, Tresorit, pCloud) or New Zealand (MEGA), and you want to avoid Canada (Sync.com — Five-Eyes) and the US (most non-zero-knowledge drives). When the worry is a stolen password, you want 2FA and account-recovery without surrendering the encryption key. When the worry is losing the key, no real zero-knowledge provider can recover your files — the answer is a password manager, not a friendlier vendor.
Internxt’s 1 TB plan renews at €9.99/month (about $11.36 at the ECB reference rate of 1.1367) with a one-time €380 lifetime option. Proton Drive ships inside Proton Unlimited at $7.99/month on the 24-month plan, which is a bundle not a standalone price. The other five are described by architecture, jurisdiction and free-tier allowance only — their per-TB rates were not re-verified in this round.
What “encrypted” actually means in a cloud drive
“Encrypted” hides three different claims under the same word, and most buyer confusion lives here.
TLS in transit + AES at rest, vendor holds the keys. This is Dropbox, Google Drive, OneDrive and iCloud in their default configuration. Files are encrypted while moving and while stored on disk, but the provider owns the keys. A subpoena to the provider returns your unencrypted files. Protects against a network tap and a stolen physical disk; nothing against a curious employee or a lawful court order.
Client-side zero-knowledge. Files are encrypted on your device before they leave it, and the key never reaches the vendor. A court order returns ciphertext, and an employee with database access sees ciphertext too. Five of the seven in this list do this on every plan by default: Internxt, Tresorit, Sync.com, MEGA, NordLocker. pCloud keeps the keys server-side for the base product and sells a separate pCloud Crypto folder add-on for the files you actually need to encrypt. Proton Drive ships zero-knowledge client-side encryption inside the Proton Unlimited bundle.
Zero-knowledge inside a bundle. Proton Drive is end-to-end encrypted, but you don’t buy it as a standalone product. You buy Proton Unlimited ($7.99/month on the 24-month plan) and Drive is one line item alongside Mail, VPN, Pass and Calendar. If you’d buy Proton Mail and Proton VPN anyway, Proton Unlimited is the cheapest path to encrypted cloud storage. If you only need the drive, it is an expensive path to 500 GB.
Most buyers searching for encrypted cloud storage end up on a list like this one and walk away more confused than they started, because the category mixes three different security models under one word. The seven below are described by where the keys actually sit, not by how the homepage phrases it.
Threat model 1: the provider itself reads your files
When the worry is the provider’s employees, a malicious insider at the data center, or a US National Security Letter forcing the provider to hand over plaintext in secret, you need client-side zero-knowledge on every file. Not a subset. Of the seven, six do this by default on every paid plan: Internxt, Tresorit, Sync.com, MEGA, NordLocker, and Proton Drive. pCloud only does it for files placed in the paid pCloud Crypto folder. On pCloud the threat-model-1 answer is “yes if and only if you pay for the add-on and you remember which folder the file is in”.
This is the strongest threat model the category addresses. Once the provider cannot read your files, a court order returns ciphertext and the case usually stops there, because most legal process assumes plaintext discovery. The remaining threat models matter when zero-knowledge isn’t enough on its own.
Threat model 2: a foreign court or intelligence alliance hits the provider
Zero-knowledge answers the question “can the provider read your files”. It does not answer “can the provider be forced to log your metadata, seize your account, or delete your account by court order”. For that, jurisdiction matters.
Switzerland (not in 14-Eyes, not in EU). Proton Drive, Tresorit and pCloud are Swiss-jurisdiction companies. Swiss law has its own data-protection regime and does not participate in the US-led intelligence-sharing agreements. For a privacy-first individual buyer this is the strongest jurisdiction in the seven.
EU outside 14-Eyes. Internxt is headquartered in Valencia, Spain. Spain is in the EU, which means GDPR applies, but Spain is also in the 14-Eyes intelligence-sharing network. US legal process to Internxt goes through EU channels first.
Canada (Five-Eyes). Sync.com is Canadian. Canada is part of the Five-Eyes alliance with the US, UK, Australia and New Zealand. The compliance posture Sync.com publishes (SOC 2, HIPAA, FINMA-aligned controls) is the meaningful protection; the jurisdiction itself is the weak link.
New Zealand (not 14-Eyes). MEGA’s parent company is in New Zealand. New Zealand participates in Five-Eyes, so it is not the strongest jurisdiction either; MEGA’s threat-model-2 argument rests more on user-controlled keys than on geographic isolation.
Panama (Nord Security parent). NordLocker sits under Nord Security in Panama. Panama has no data-retention laws and is not in the 14-Eyes network.
For a buyer who treats metadata as sensitive as files, jurisdiction alone is not enough. The answer is to also pick a vendor that does not keep much metadata. That is the harder property to verify, which is why this article treats it as out of scope.
Threat model 3: an attacker steals your password or your device
Zero-knowledge stops the provider from reading your files. It does not stop an attacker who has your password — because once they have your password they have the key. The defense here is two-factor authentication, device authorization, and the ability to revoke a stolen device from the account.
Of the seven, six publish some form of 2FA on paid plans (Internxt, Proton Drive, Tresorit, Sync.com, MEGA, NordLocker — pCloud is the laggard here, and the pCloud Crypto folder does not add 2FA, only encryption). Tresorit’s admin console publishes device tracking and remote-wipe aimed at business buyers. Sync.com publishes HIPAA-aligned controls that include session management. The meaningful question for an individual buyer is whether the vendor supports 2FA on the entry-tier paid plan or only on the enterprise tier. Most of the seven reserve the strongest account-recovery options for higher tiers, which is the pattern to push back on at checkout.
A second concern: social-engineering against the vendor’s support team. If an attacker can convince support that they are you and reset your password, they get your files regardless of encryption. The published answer is “we keep no password reset that touches the encryption key” — which is true for the zero-knowledge providers, but means the account-recovery story is weaker than a non-zero-knowledge drive.
Threat model 4: you lose your password or encryption key
This is the threat model the category cannot solve. A real zero-knowledge provider cannot read your files, which means the provider cannot recover them for you either. Forget the password, lose the recovery key, and the files are gone.
Honest answers in this list:
- Internxt — zero-knowledge, no password recovery; recovery key on first login.
- Proton Drive — zero-knowledge, recovery method at signup.
- Tresorit — zero-knowledge, no password recovery; admin reset = data wipe.
- Sync.com — zero-knowledge, recovery options limited.
- pCloud Crypto folder — zero-knowledge, recovery options limited to the Crypto folder.
- MEGA — recovery key at signup.
- NordLocker — zero-knowledge; recovery key at account creation.
The right defense is a password manager plus a printed copy in a safe place.
The seven, picked for each threat model
This cross-reference maps each vendor to the four threat models above.
| Internxt | Proton Drive | Tresorit | Sync.com | pCloud | MEGA | NordLocker | |
|---|---|---|---|---|---|---|---|
| Provider reads files (T1) | No (E2E, zero-knowledge) | No (E2E, zero-knowledge) | No (E2E, zero-knowledge) | No (E2E, zero-knowledge) | Only inside paid pCloud Crypto folder | No (E2E, zero-knowledge) | No (E2E, zero-knowledge) |
| Foreign court subpoena (T2) | Spain (EU, 14-Eyes) | Switzerland (not 14-Eyes) | Switzerland (not 14-Eyes) | Canada (Five-Eyes) | Switzerland (not 14-Eyes) | New Zealand (Five-Eyes) | Panama (not 14-Eyes) |
| Stolen password / device (T3) | 2FA on paid plans | 2FA on paid plans | 2FA + device tracking + admin console | 2FA + HIPAA controls | 2FA, weakest in this list | 2FA, session management | 2FA, paired with NordPass |
| Lost password / key (T4) | Recovery key, no password reset | Recovery method at signup | Recovery key, admin reset = data wipe | Recovery options limited | Recovery options limited | Recovery key at signup | Recovery key at signup |
| Free tier | 1 GB | 1 GB (Proton Free) | Trial only | 5 GB | 10 GB | 20 GB | None (paid only) |
| Cheapest paid entry | Essential 1 TB — €1.99 first month, renews €9.99/mo (about $11.36) or €380 lifetime (about $432) | Proton Unlimited — $7.99/mo on 24-month plan (500 GB Drive + Mail + VPN + Pass) | Solo Starter — see vendor site | Solo Basic — see vendor site | Premium 500 GB — see vendor site (Crypto folder is a separate add-on) | Pro Lite — see vendor site | 50 GB plan — see vendor site |
| Best fit when | You want zero-knowledge + a lifetime option under EU process | You want zero-knowledge + a full Swiss-privacy bundle | You’re a team that needs granular sharing permissions | You’re HIPAA- or FINRA-aligned and want Canadian compliance | You want a lifetime plan with an optional zero-knowledge folder | You want the largest free tier with user-controlled keys | You already use NordVPN or NordPass and want a paired encrypted locker |
Internxt prices here are captured verbatim from internxt.com/pricing (EUR as displayed; USD figures are our conversion at the ECB reference rate of 1 EUR = 1.1367 USD). Proton’s price comes from protonvpn.com/pricing in USD via the official selector. The remaining five rows are qualitative — see each vendor’s site directly for current rates.
Pick by scenario
- Threat model 1 with a lifetime option. Internxt Essential 1 TB (€1.99 first month, renews €9.99/mo, about $11.36 at the ECB rate of 1.1367) or Premium lifetime 3 TB (€580 one-time, about $659). 30-day money-back window.
- Threat model 2 with the Proton ecosystem. Proton Unlimited ($7.99/mo on the 24-month plan) — 500 GB of zero-knowledge Drive plus Mail, VPN, Pass and Calendar under one Swiss-jurisdiction subscription.
- Threat model 1 plus a team with admin needs. Tresorit Solo Starter, or Small Business for per-user audit logs. Switzerland-jurisdiction zero-knowledge with the strongest permission model in this list.
- Threat model 1 plus Canadian compliance. Sync.com Solo Basic or Pro. HIPAA/FINRA-aligned controls, 5 GB free tier.
- Threat model 1 only for specific folders, otherwise lifetime plan. pCloud Premium lifetime plus
pCloud Cryptofor the folders that actually need client-side encryption. - Real free tier first. MEGA free at 20 GB, then upgrade to Pro Lite when the transfer quota becomes a problem.
- Already on NordVPN / NordPass. NordLocker 50 GB entry plan, Cure53-audited.
When two scenarios match equally, decide jurisdiction first (Switzerland > EU > Canada > US), lifetime option second (Internxt, pCloud), free-tier size third (MEGA 20 GB > Sync.com 5 GB > Internxt 1 GB).
The seven, in detail
1. Internxt — best for zero-knowledge encryption shipped as the default, with a lifetime payment option
Internxt is the cloud-storage answer for buyers who have decided Dropbox and Google Drive are not private enough. End-to-end, post-quantum-encrypted storage that only you can decrypt, open-source clients, 1 TB / 3 TB / 5 TB plans. Free tier is 1 GB for life. Our Internxt review walks the three pricing tables.
Pricing, captured from internxt.com/pricing (real browser; the page is a Next.js SPA that does not server-render prices). Currency: EUR (no on-page switcher). Annual subscription: Essential 1 TB — €1.99 first month, renews €9.99/mo (about $11.36); Premium 3 TB (recommended) — €3.99 first month, renews €19.99/mo (about $22.72); Ultimate 5 TB — €5.99 first month, renews €29.99/mo (about $34.09). Per-file upload limits: 10 / 50 / 100 GB. Lifetime (one-time): Essential €380 (about $432); Premium €580 (about $659); Ultimate €780 (about $887). Lifetime plans stackable up to 100 TB per account. Money-back: 30 days. Audit: Securitum. Jurisdiction: Spain (EU, 14-Eyes). Open-source clients: yes.
The trade-off: zero-knowledge and post-quantum encryption on every plan, open-source clients, audited, the only lifetime one-time-payment tier here. The 1 GB free tier is small — useful for evaluating the apps, not large enough to back up a phone. Renewal rates are the steady-state cost (the €1.99 / €3.99 / €5.99 promo pricing is day-one aggressive). No public uptime SLA. EUR-only display means US buyers see EUR pricing with FX conversion at the card processor’s rate. Storage is distributed; if your compliance regime requires US-only data residency, Internxt is not the right vendor.
Published sync speed on a representative file set, mobile reliability on iOS and Android, whether the bundled VPN is competitive versus Proton VPN or Mullvad, and whether an enterprise tier with contractual SLA exists — all four are workload-specific. Validate each on your own install before locking in a plan.
2. Proton Drive — best for a Swiss-jurisdiction privacy bundle (Drive + Mail + VPN + Pass in one subscription)
Proton Drive is the encrypted cloud storage option that ships inside Proton’s broader ecosystem. Proton Unlimited at $7.99/month on the 24-month plan bundles Drive (500 GB), Mail, VPN (Plus features: 10 devices, 20,000+ servers in 140+ countries — see our Proton VPN review), Pass, and Calendar under one Swiss-jurisdiction account with open-source clients and end-to-end encryption. Proton Free includes 1 GB of Drive.
Pricing, captured from protonvpn.com/pricing with USD via the official currency selector. Proton VPN Plus 1-month $9.99/mo, 1-year $4.49/mo, 2-year $3.49/mo. Proton Unlimited 1-month $12.99/mo, 1-year $9.99/mo, 2-year $7.99/mo (includes 500 GB of Drive). Proton Free $0/mo. Proton Drive is not separately priced; ships inside Proton Unlimited or via Proton for Business. Money-back: 30 days. Jurisdiction: Switzerland (not 14-Eyes). Audited by multiple independent firms. The rest of our encrypted cloud storage coverage is collected in the Privacy and Security hub.
The trade-off: the only service here shipping end-to-end encryption AND a full privacy stack (VPN + Mail + Pass + Calendar) under one Swiss-jurisdiction subscription. Storage tops out at 500 GB on Proton Unlimited — smaller than Internxt’s 1 TB entry — and higher tiers need Proton for Business sales quotes. No lifetime plan option.
Per-file upload limit on Proton Drive, iOS and Android sync speed, and published sharing-link controls (password, expiry, recipient identity) — all three are workload-specific. Validate each on your own install before locking in a plan.
3. Tresorit — best for granular sharing permissions on a business-grade zero-knowledge drive
Tresorit is the enterprise-leaning option. Zero-knowledge encryption (AES-256, client-side), granular per-folder and per-file sharing permissions, device tracking, and an admin console aimed at teams. Plans run Solo Starter through Enterprise with per-user rates.
Pricing — not verified in this round. Per-user rates on annual billing; Enterprise is sales-quoted. Free tier: trial only. Jurisdiction: Switzerland (not 14-Eyes). Audit: ISO 27001, GDPR. Open-source clients: no. Money-back: 14 days. See tresorit.com/pricing for current rates.
The trade-off: strongest permission model here and a Swiss-jurisdiction business-grade product with an admin console for IT. Higher entry price than Internxt or pCloud, no free tier, closed-source clients. Aimed at teams that need IT-visible control over who can share what with whom.
4. Sync.com — best for Canadian-jurisdiction zero-knowledge with HIPAA and FINRA-compliance posture
Sync.com is the Canadian-jurisdiction option with a published compliance stack (SOC 2, GDPR, HIPAA, FINRA-aligned controls) and zero-knowledge AES-256 client-side encryption. Plans run from a free 5 GB tier through multi-TB individual plans and team plans.
Pricing — not verified in this round. Individual plans at per-year rates; team plans scale per user. Jurisdiction: Canada (Five-Eyes; PIPEDA applies). Audit: SOC 2, GDPR, HIPAA-aligned. Money-back: 30 days. See sync.com/pricing for current rates.
The trade-off: a Canada-headquartered zero-knowledge provider with published compliance posture and a real 5 GB free tier. Thinner documentation and less-published SLAs than Tresorit; closed-source clients. Canadian jurisdiction is a Five-Eyes consideration for strict threat models; for most individual buyers the HIPAA/FINRA compliance is the meaningful protection.
5. pCloud — best for a lifetime plan option with an optional zero-knowledge folder add-on
pCloud is one of the few providers that publishes a real lifetime plan option (separate from Internxt’s). A paid add-on called pCloud Crypto brings zero-knowledge encryption to a specific folder inside the drive; the base service ships with TLS-in-transit and AES-256-at-rest encryption, but the keys are held by pCloud. To get true zero-knowledge on a pCloud plan, buy pCloud Crypto separately (a one-time lifetime fee per folder).
Pricing — not verified in this round. 10 GB free tier, Premium and Premium Plus monthly/annual/lifetime plans, Family plan. pCloud Crypto is a one-time lifetime purchase per folder. Jurisdiction: Switzerland (not 14-Eyes). Audit: SOC 2, GDPR. Money-back: 14 days on annual plans. See pcloud.com/pricing for current rates.
The trade-off: cheapest path to a large-GB lifetime plan here, but the encryption story is split: base pCloud is not zero-knowledge; pay a separate add-on per folder for client-side encryption. Switzerland-based, SOC 2 audited.
6. MEGA — best for a generous 20 GB free tier with user-controlled keys
MEGA is the privacy-first incumbent with a 20 GB free tier (one of the largest in the category), user-controlled encryption keys, and open-source SDKs. New Zealand parent company.
Pricing — not verified in this round. Pro Lite / Pro I / Pro II / Pro III monthly and annual plans with transfer quotas. Jurisdiction: New Zealand (Five-Eyes). Audit: ISO 27018, GDPR. Money-back: 30 days on annual Pro. See mega.io/pricing for current rates.
The trade-off: largest free tier here (20 GB) with a New Zealand jurisdiction. Free-tier accounts carry a published transfer quota that a large backup can exhaust. Closed-source clients; New Zealand is Five-Eyes for strict threat models. Upgrade to Pro Lite once the transfer quota bites.
7. NordLocker — best for an encrypted file locker that pairs with NordVPN and NordPass
NordLocker is the encrypted file-locker product from Nord Security (the company behind NordVPN and NordPass). Runs as a desktop app that encrypts files locally before uploading to NordLocker’s cloud, with end-to-end encryption on every paid plan.
Pricing — not verified in this round. 50 GB entry plan and higher tiers (500 GB at the top), paid only. Audit: Cure53. Jurisdiction: Panama (not 14-Eyes). Open-source clients: no. Money-back: 30 days. See nordlocker.com/pricing for current rates.
The trade-off: cheapest path to a Cure53-audited zero-knowledge file locker that shares an account ecosystem with NordVPN and NordPass. Smaller storage ceiling than Internxt or pCloud, no free tier, closed-source clients. Most useful for buyers already on NordVPN or NordPass.
FAQ
Encrypted cloud storage buyers ask these most often.
What does “zero-knowledge” actually mean?
The encryption key never leaves your device. A subpoena returns ciphertext; an employee with database access sees ciphertext. The trade-off: the provider cannot recover your files if you lose the key.
Which of the seven have a free tier?
MEGA 20 GB, pCloud 10 GB, Sync.com 5 GB, Internxt and Proton Drive 1 GB each. Tresorit and NordLocker publish no free tier.
Is Proton Drive available on its own?
No. Proton Drive ships inside Proton Unlimited ($7.99/month on the 24-month plan, 500 GB of Drive plus Mail, VPN, Pass, Calendar) or via Proton for Business. Proton Free includes 1 GB of Drive.
Does the provider hold my keys?
Internxt, Proton Drive, Tresorit, Sync.com, MEGA and NordLocker encrypt client-side. pCloud’s base service keeps the keys server-side; zero-knowledge applies only inside a paid pCloud Crypto folder.
Which jurisdictions are involved?
Internxt — Spain (EU, 14-Eyes). Proton Drive, Tresorit, pCloud — Switzerland (not 14-Eyes). Sync.com — Canada (Five-Eyes). MEGA — New Zealand (Five-Eyes). NordLocker — Panama (not 14-Eyes).
What happens if I lose my password?
On every zero-knowledge provider here, you lose access. Set up a password manager and a printed copy of the recovery key at signup.
Which is best if I’d subscribe to Proton Mail and Proton VPN anyway?
Proton Unlimited at $7.99/month on the 24-month plan adds 500 GB of zero-knowledge Drive to the bundle. Standalone encrypted storage is Internxt Essential 1 TB at €9.99/month (about $11.36 at the ECB rate of 1.1367).
What did you not verify in this list?
Per-TB rates for six of the seven. Only Internxt’s prices were captured from its official pricing page in this round; Proton’s numbers come from the USD view of protonvpn.com/pricing. The other five are described qualitatively and should be checked directly before budgeting.
How we picked the seven, and what we did not measure
No benchmark — the seven bill in different units (per-month, lifetime, per-user). We read every official pricing page and verified Internxt’s headlines; for the other six we confirmed architecture, jurisdiction and free-tier allowance but did not re-verify per-TB rates. Each survivor ships client-side encryption on its paid plans, publishes a self-serve entry tier, and supports the sync-and-share loop.
We excluded three categories by definition: standard cloud drives that hold the keys (Dropbox, Google Drive, OneDrive, iCloud without ADP), self-hosted encrypted file systems (Cryptomator, VeraCrypt on top of any cloud), and S3-compatible object storage (Backblaze B2, Wasabi). Five brands were not re-priced this round: Filen, IceDrive, Koofr, Proton Drive for Business, and Nextcloud.
Every figure that depends on a real workload (sync speed, mobile reliability, sharing-link controls, enterprise audit scope) is flagged where it appears in the text rather than guessed.
Sources
- Internxt: internxt.com/pricing — captured via Skyvern (Next.js SPA).
- Proton Drive: protonvpn.com/pricing — captured via Skyvern; USD via official selector.
- Tresorit: tresorit.com/pricing — qualitative facts only.
- Sync.com: sync.com/pricing — qualitative facts only.
- pCloud: pcloud.com/pricing — qualitative facts only.
- MEGA: mega.io/pricing — qualitative facts only.
- NordLocker: nordlocker.com/pricing — qualitative facts only.
How we tested this: Internxt’s plan prices come from internxt.com/pricing, captured in a real browser because the page renders its prices client-side. Internxt lists EUR only, so USD figures for it are our conversions at the same ECB rate used across this site (1 EUR = 1.1367 USD), not vendor quotes. Proton’s figures come from the official USD view of protonvpn.com/pricing on the same date.
For Tresorit, Sync.com, pCloud, MEGA and NordLocker, the encryption architecture, jurisdiction, free-tier allowance and open-source posture were taken from each vendor’s own pages; their per-TB rates were not re-verified in this round and are not quoted as numbers. Figures that depend on a real workload, such as sync speed, mobile reliability and enterprise audit scope, are flagged where they appear in the text. Scoring criteria are on the methodology page.
Disclosure: this article contains affiliate links. If you buy through them we may earn a commission at no extra cost to you. Commission never changes our scoring or the order of our rankings.