You probably keep more in cloud storage than you realize: work documents, phone backups, scans of your taxes, even a photo of your passport. The question is not whether cloud storage is convenient — it is — but exactly who can read what you store there, and whether the trade-off is worth it for the files that matter most.
The honest reality: your provider can read your files
Uploading to cloud storage means entrusting your data to someone else. With most mainstream services, the provider can read your files. That does not mean employees are sifting through your holiday photos — it means the ability exists by design, and it is smart to assume it does.
The deciding factor is who holds the encryption keys, and that divides cloud providers into two camps.
Encryption at rest vs zero-knowledge
Encryption at rest (the mainstream default) means your files are encrypted while they sit on the provider's servers, so a thief who steals the hardware cannot easily read them. The catch: the provider holds the keys, so it can still decrypt and read your files (or hand them over when legally required).
Zero-knowledge encryption means your files are encrypted on your device before upload, and the provider never sees the keys. With those services, it is technically impossible for the provider to read your data — even if it wanted to, and even under a legal demand.
Provider comparison: what each can see
| Service | Model | Can the provider read your files? | Notes |
|---|---|---|---|
| Google Drive | Encryption at rest | Yes | Files readable via account; Google scans for abuse/child-safety by default |
| Dropbox | Encryption at rest | Yes | Same model; advanced controls on business tiers |
| Microsoft OneDrive | Encryption at rest | Yes | Files readable via account; Personal Vault adds a layer |
| Apple iCloud | At rest + some end-to-end | Mostly yes | iCloud Keychain is end-to-end encrypted; most other data is not |
| Proton Drive | Zero-knowledge | No | Encrypts on device; open-source clients |
| Tresorit | Zero-knowledge | No | Business-focused, zero-knowledge |
| Sync.com | Zero-knowledge | No | Consumer-friendly, end-to-end encrypted |
The pattern to remember: mainstream services are convenient but readable; zero-knowledge services are private but usually smaller, pricier, or less feature-rich. For everyday files, mainstream is fine. For sensitive documents, switch or encrypt.
Files worth protecting before you upload
Some files deserve extra care no matter which service you use: government IDs, tax returns, contracts, and anything containing a Social Security number or bank details. If those are exposed, the damage goes beyond losing the files.
The simplest safeguard: encrypt sensitive files on your own device before uploading. Tools like Cryptomator (free, open source) or VeraCrypt create encrypted containers/folders that sync like normal folders — the provider only ever sees scrambled data. Even someone with full access to your account cannot read the contents. When you need to send such a document to someone else, our secure file sharing guide covers sharing without weakening that protection.
Secure the account that holds your files
The strongest encryption does not help if your account password is weak or reused. Anyone who gets into your account gets everything you have stored. Do the basics:
- Use a strong, unique password for the account. The password manager guide explains how to manage this without memorizing.
- Turn on two-factor authentication. Most providers offer this as a simple setting, and it is one of the most effective steps you can take.
- Check connected devices and apps every few months. Sign out anything you do not recognize, and revoke third-party app access you no longer need. Each connection is another path into your files.
Clean up files you no longer need
Deleted files do not always disappear instantly. Many services keep removed files in a recycle bin before purging, so something you deleted last month may still be recoverable. Empty the recycle bin after deleting anything sensitive, and do a regular cleanup pass on old uploads. The backup strategy guide explains how to keep the files you need while retiring the rest. Less data stored means less data exposed if your account is ever compromised.
Quick answers
Can my cloud storage provider read my files? With most mainstream services, yes — the provider holds the decryption keys. Zero-knowledge services encrypt on your device and never hold the keys.
Is encryption at rest enough to protect my privacy? It protects against physical theft of servers, not against the provider or someone with your account access. For sensitive files, encrypt them yourself before uploading.
Should I encrypt files before uploading? Yes for anything sensitive — IDs, tax documents, contracts. Client-side tools like Cryptomator ensure the provider only ever sees a scrambled copy.
What should I do if my files are stolen or my account is taken over? Report identity theft at IdentityTheft.gov, change your password, turn on two-factor authentication, sign out unfamiliar devices, and revoke unrecognized app access.
Sources and further reading
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.