My last post left me a bit unsatisfied. Sure, I wrote about our home setup with Nextcloud, that was all fine; but I was missing the wider view. What European cloud storage is there besides Nextcloud? Software that doesn’t need self-hosting, maybe even proprietary, that could still be a good alternative? Most people keep their data in some cloud, so it is a relevant question. So I sent a few agents off to research, checked the results, and pulled together my own research and experience for this article.
I will not be able to give a complete picture of every GDPR-compatible storage provider. And I cannot offer my own judgement on how well each of them meets the standards, I have to rely on sources. But if you know other apps you like and use, or just want to share your experience, sources and opinions, please let me know!
Interesting, though maybe a personal bias: I mostly came across German and Swiss cloud storage providers. Please, share who you trust with your data in your own countries.
Proton.me
A few months ago I set up an account with Proton. The service is good for storing and sharing data. They caught my attention because they seemed to show up in every discussion about European alternatives, positioning themselves as a direct competitor to the big cloud office providers. But what are Proton’s actual capabilities?
For years, the service from Geneva (Switzerland) was mainly known for its encrypted storage. Over the past year, the company started to present itself more and more as the European alternative to Google and Microsoft, criticising them above all with the phrase “sovereignty washing”. What also caused a stir was a new Swiss law, which prompted Proton to say it would move parts of its infrastructure out of Switzerland to Germany and Norway.
In principle, Proton’s data sits in Europe. They have good encryption and are a big, experienced provider you can use safely. But they are not an alternative to the well-known cloud office providers. The docs and sheets apps look very good, the design is excellent, but the features are very limited. In the good year I have had access to the services, none of the sheets and docs features I care about were added (e.g. page numbers in a document, pivot charts in a sheet). Proton was sadly not the alternative I had hoped for at least in these areas. The company’s ambition does not quite seem to match reality.
As storage they are perfectly fine, though. They have apps to sync your data, on mobile as well as on the desktop, and the interface is good.
mailbox.org
Much smaller than Proton but well worth a look is mailbox.org. This research made me very curious about the app, and I will take a closer look soon. The company behind it, Heinlein Support GmbH, has been around for over 30 years; mailbox.org itself is run by the subsidiary Heinlein Hosting GmbH. They are from Berlin, with a privacy and open-source focus.
mailbox.org has fervent admirers on Reddit, that much is clear. The data is hosted in Berlin data centres and yes, the company is portrayed as a competitor to Proton and Nextcloud. Personally, I found the opinion of the German Federal Office for Information Security (BSI) interesting: it certifies that mailbox.org implements all the technical email security standards relevant to the office (however secure email may be in the first place). The office does not, however, say anything about the storage.
Are you a fan of mailbox.org too, or do you have other experiences? I am curious!
Filen.io
The third interesting provider is Filen.io: they do not try to compete with the big cloud office providers. They position themselves clearly as secure European cloud storage. They are a very young German company (from Recklinghausen) trying to win the market with big ambitions and very good prices.
And that is exactly what causes a lot of uncertainty. How does the company finance itself? What is the strategy? How can they afford those prices? Much of this could probably be explained with a more open communication strategy. Right now, though, their lack of transparency seems to be why there is wild speculation about them online.
My research showed that the company has big ambitions and clearly puts in the effort. For example, they built an Android app that focuses on privacy. But there is a recurring criticism that there has been no external audit so far, which makes it impossible to check the many security claims objectively.
More providers
Below you will find a list of further providers that offer cloud storage, some of it including collaborative office software. As I said, I have not personally tested any of them, but according to the research they all either keep their data in Europe or allow self-hosting.
A few question marks remain, though: Koofr, for example, is presented as a GDPR lighthouse; everywhere it is stressed that the data lives on German servers. But it is not clear with which provider. That always leaves me with an uneasy feeling.
- TwakeDrive: French provider that is very much into self-hosting. Their cloud is hosted on OVH in France. If you speak French, here is a really interesting review of the app.
- Koofr: Slovenian provider with cloud infrastructure in Germany. The provider is not disclosed.
- pCloud: Swiss provider that took venture capital from the US in its early phase. Their data centres are in Luxembourg, who runs them is unclear.
- Infomaniak kDrive: Swiss provider that runs its own data centres in Switzerland.
- Seafile: The company itself is based in Beijing. The application, however, is open source and can therefore be self-hosted, which is why I mention it here.
- Tresorit: originally a Hungarian cloud provider, but based in Zurich for many years now. They host their infrastructure on Azure (Microsoft) in Ireland.
One more remark: some of the providers listed above were analysed very closely for their encryption in a paper from ETH Zurich in 2024, and several of them did not hold up. There were security holes, and their security methods were criticised as not being sound. If you want to dig deeper into this topic, here are the sources:
- https://brokencloudstorage.info
- https://www.bleepingcomputer.com/news/security/severe-flaws-in-e2ee-cloud-storage-platforms-used-by-millions/
- https://thehackernews.com/2024/10/researchers-discover-severe-security.html
So, which provider should I use?
So what does all this tell us? We have many providers positioning themselves in the market as a European alternative. There are plenty of choices, and really few excuses to stay with Google, Apple or OneDrive.
But is the data safe with these providers? What does the ETH Zurich analysis tell me? Does it not show that my data might not be safe after all? Can you trust such a young company as Filen.io, and what happens if they go bankrupt?
These are all legitimate objections, of course. Whether a company really has zero knowledge of the keys, and is therefore proof against both a hacker attack and requests from security authorities, may well be questionable. Anyone who absolutely does not want information handed over by court order and within applicable law should ideally only operate on their own infrastructure and move as little as possible on the public internet. But that is not a use case for ordinary internet users. For this group, what should feed into the decision is which applicable law would apply, should a data request ever be made. With European storage providers, a jurisdiction outside the EU only has access if it follows the European processes.
What matters to me: in principle you should always consider whether you really want to store all your data in a single place. Keeping different providers for different purposes is not a bad strategy. That way you can also give young providers like Filen.io a chance. Of course such a company can go bankrupt, but that can happen with older providers too. A small risk always remains. But if you mostly want things easy and simple, you certainly cannot go wrong with Proton.
One thing I learned during my research, and it matches my own experience: users do not trust companies that communicate unclearly. I get uneasy too when I try to find out which providers are used for hosting and there is simply no clear answer. Transparency and open communication are central, but sadly too often in short supply.
We end up back at the point I have raised more than once: think about what matters to you personally. Then you can make a decision. What matters most, though, is that you think about it. And that you know what you are deciding for, and why.