I work with clients who send me contracts, legal documents, and financial statements. For years I stored them in Google Drive without thinking twice. Then I read their Terms of Service carefully.
"Google's automated systems analyze your content to provide you with personally relevant product features." That's in Drive's ToS. Not hidden — just not something most people actually read.
I'm not claiming Google is doing anything malicious with my client files. But the technical fact is: Google has the encryption keys for every file in Drive. They can read them. Whether they choose to is a policy question, not a technical one. And policies can change, get subpoenaed, or get breached.
The problem with "encrypted at rest"
Most cloud providers advertise encryption. It sounds reassuring. But "encrypted at rest" just means the file is scrambled on disk — and the provider holds the key. It's the digital equivalent of giving your landlord a copy of your front door key and then calling it a locked apartment.
True privacy requires the provider to not have the key. Your device encrypts the data before it ever leaves. The provider receives only ciphertext — random bytes they can't read regardless of whether they want to.
What I switched to
For one-off client file delivery — sending a contract draft, a final invoice, a signed document — I switched to FileShot.io. It's open source, free to start, and works entirely in the browser. You drag in a file, it encrypts it locally using AES-256-GCM (the Web Crypto API handles this before the upload starts), and you get back a link.
The decryption key is in the URL fragment — the part after #. Browsers never send URL fragments to servers. So the FileShot server receives and stores encrypted bytes and has no idea what the file contains or even how large the plaintext is. When the recipient opens the link, their browser downloads the ciphertext and decrypts it locally.
No account needed. No storage limits to worry about for one-off transfers. The file is available for however long you set the expiry.
For ongoing storage I use Proton Drive
FileShot isn't a replacement for cloud storage — it's for point-to-point sharing. For documents I need to keep long-term, I moved to Proton Drive. End-to-end encrypted, provider can't read your files, and it has a proper folder structure and sync client.
Tresorit is the enterprise alternative if you need compliance features and auditing.
The point isn't paranoia
I'm not writing this because I think Google is evil or that your files are being actively read. The point is architectural: if you care about client confidentiality, you should know whether your file storage provider technically can access your files, regardless of whether they will.
The answer for Drive, Dropbox, and OneDrive is: yes, they technically can. For Proton Drive, Tresorit, and FileShot.io: no, they technically can't — by design.
That's a meaningful distinction, especially if you're in law, finance, healthcare, or any field where confidentiality isn't optional.
FileShot.io is MIT-licensed and the source is on GitHub if you want to verify the encryption implementation yourself.
Top comments (0)