Your Cloud Provider Can Read Your Files

By NorwegianSpark Editorial · Published August 8, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

Every major cloud storage service says your files are encrypted. That is true, and it is not the reassurance it sounds like.

There are two very different arrangements hiding behind the same word, and the distinction decides whether the company holding your files can open them.

Two kinds of encryption

Provider-managed encryption. Your files are encrypted on the provider's servers, but the provider holds the keys. This protects against someone stealing the physical drives, and against interception in transit. It does not stop the provider itself reading your files, and it means a lawful demand, a rogue employee or a breach of their key infrastructure can expose them.

Zero-knowledge encryption. Files are encrypted on your device before upload, with a key derived from your password that never leaves your control. The provider stores data it cannot read. A court order produces ciphertext.

Both are honestly described as "encrypted". Only the second means the company cannot look.

The trade-offs of zero-knowledge

It is not strictly better, and pretending otherwise sets people up for a bad surprise.

If you lose the password, the data is gone. There is no reset, because there is no one holding a spare key. That is the entire point, and it is unforgiving.

Some features become impossible. Full-text search across your documents, server-side previews and thumbnails, in-browser editing, and easy link sharing all depend on the server being able to read the file. Zero-knowledge services either do without or do it locally, which is slower and more limited.

Collaboration is clunkier. Real-time co-editing is hard when the server cannot read the document.

It usually costs more per gigabyte and the apps are often less polished.

A practical split

Most people do not need everything encrypted to the same standard, and treating it as all-or-nothing leads to doing nothing.

The workable approach is to split by sensitivity. Keep the bulk — photos, general documents, things you would not mind a stranger seeing — on mainstream storage where the features and price are good. Put the genuinely sensitive material in a zero-knowledge service or an encrypted container.

That second group is smaller than people expect: identity documents, financial and tax records, medical information, legal correspondence, password and recovery keys, anything covering someone else's private life.

The container alternative

You do not necessarily need a different provider. An encrypted container — a file that behaves like a locked folder, using a well-regarded open-source tool — can sit inside your existing cloud storage.

The provider stores an opaque blob and syncs it like any other file. You mount it locally with your passphrase, work normally, and close it.

Trade-offs: the whole container re-syncs when it changes, which is wasteful for large ones, and simultaneous access from two devices risks conflicts. For a modest archive of sensitive documents that you touch occasionally, it works very well.

Before you rely on any of it

Two checks that catch the common disasters:

• Test a restore. Actually retrieve a file from a fresh device, with only the credentials you have stored. A backup you have never restored is an assumption.
• Store the recovery material somewhere else. With zero-knowledge encryption, your password *is* the data. Keeping it only in a password manager that itself lives in that storage is a loop that fails at the worst moment. A written copy in a physically secure place is unfashionable and effective.

The one-line version

If your provider can reset your password and still give you your files, they can read your files. That may be an entirely acceptable trade for convenience — just make it knowingly, and keep the small set of genuinely sensitive material somewhere it does not apply.