End-to-End Encrypted Cloud Storage Explained — What the Host Can Still See

Two kinds of 'encrypted' that get advertised as one

Every serious cloud encrypts something. The word on the homepage is doing too much work. At-rest encryption means the disks in the warehouse are scrambled so a stolen drive is junk. The company can still open your files when you log in, when a feature wants to generate a preview, or when a lawful process arrives. End-to-end / zero-access encryption means your device scrambles the file first. The company stores blobs it says it cannot read. Those are different products. Marketing collapses them on purpose.

You can see the difference in features. A host that can scan for malware, power a full-text search over every PDF, and train models on your documents is holding usable data. A host that cannot read the file cannot offer those extras in the same way. Convenience is often the bill for keys living on their side.

From the record

Ask 'who can decrypt this without my device?' If the answer is the vendor's support team, you chose at-rest privacy, not zero-access.

GUIDEORA explainer rule

At-rest vs client-side, without the slogans

Google Drive, Dropbox (standard), and Microsoft OneDrive (outside Personal Vault / extra options) are the everyday at-rest model for consumers. They are excellent at sharing, search, and apps. They require you to trust the company, its staff access design, and the legal process that applies to it. That trust is reasonable for many people. It is not the same as 'not even the company can read this.'

Client-side encryption moves the keys to devices you control. Proton Drive, Sync.com, and (when enabled) Apple's Advanced Data Protection for iCloud are in that conversation. The cost is recovery: lose the keys and the password reset may not bring plaintext back. That is the point of the design, and it is also the foot-gun.

Filenames, folders, and the leftover metadata

Encrypting file bytes is not the whole story. A host might still see that you uploaded a 40 MB blob at 2 a.m., from which IP, into which account. Some products also encrypt filenames and folder names. Proton currently says Drive encrypts files, their names, and more on-device. That is stronger than encrypting only the payload. It still does not erase account-level logs the company needs to run a service — billing, login, abuse.

Treat metadata as the crowded-room problem from our Wi-Fi guides: people may not hear the words, but they can see you are talking. If your threat model is a nosy roommate, E2E Drive plus a password manager is plenty. If your threat model is a sophisticated state actor, you need a specialist, not a consumer cloud review.

Threats encrypted cloud never promised to stop

• Malware or a malicious sync client on a machine that can decrypt.
• Phishing that captures the Proton (or any) password and your second factor.
• A share link plus password sitting in the same email thread.
• Physical access to an unlocked phone with Photos backup signed in.
• You deleting the only copy because you believed 'the cloud is the backup.'

Where Proton Drive sits in this model

Proton Drive is consumer zero-access cloud with a Swiss company, open-source clients, and audits Proton points to. The free tier is 5 GB. Paid Drive Plus is 200 GB. Larger quotas ride Unlimited, Duo, or Family. Docs and Sheets are encrypted editors, not a full Google Workspace clone. Sharing can use passwords and expiry. That is the product. It is not 'military-grade' poetry, and GUIDEORA will not write that.

A practical checklist before you migrate

What to do this weekend

Decide who you refuse to trust with plaintext. If the answer is 'the storage company,' pick a client-side cloud and start with a small folder — Proton Drive's free 5 GB is enough for that test. If the answer is 'I need comments from twelve coworkers in a Doc,' stay on a collaboration cloud and encrypt only the sensitive zip yourself.