Cloud Storage & File Sharing
Dropbox
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Dropbox, Inc. · www.dropbox.com
Compare with Tresorit → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Dropbox at a glance
- Vendor
- Dropbox, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Dropbox 3/5, the mean of 6 judges. Dropbox is a cloud storage and file-sharing service; customers outside North America contract with Dropbox International Unlimited Company in Dublin, while the terms are governed by California law with disputes in San Francisco courts. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Dropbox is a cloud storage and file-sharing service; customers outside North America contract with Dropbox International Unlimited Company in Dublin, while the terms are governed by California law with disputes in San Francisco courts. The bench scored it highest on encryption and security, citing 256-bit AES at rest, SSL/TLS in transit, Rewind ransomware recovery and listed SOC and ISO certifications, and gave administration and governance a flat 7 for the exportable, filterable activity log, retention policies, silent legal holds and remote wipe. Sovereignty is the outlier at 2-3: the privacy policy states data may be stored, processed and transmitted in the United States and locations around the world, top-level encryption keys are generated by AWS KMS, and the judges found no public information on an EU hosting option, a subprocessor list or a data processing agreement. Sync and access and sharing and collaboration scored 6-7, portability and integrations a flat 6. Pricing transparency scored 5-6: Standard at €12 per user per month and Advanced at €18 per user per month are public; Enterprise is contact-sales only.
Speaks for it
- Encryption and security scored 7-8, documenting 256-bit AES at rest, SSL/TLS in transit, Rewind ransomware recovery and listed SOC and ISO certifications
- Administration and governance scored a flat 7 for a filterable, exportable activity log, retention policies, legal holds silent to end users, device approvals and remote wipe
- Share links take password, expiry and disabled downloads, file requests collect uploads from people without accounts, and transfers run up to 100 GB with download tracking
- Standard and Advanced prices are published per user per month with minimum users, restore windows and transfer limits stated
- A documented API with SDKs in six languages and webhooks, plus a Movebot-powered migration add-on, gives a way in and a way out (portability and integrations scored a flat 6)
Held against it
- Sovereignty scored 2-3: the terms choose California law and San Francisco courts while the privacy policy says data may be stored, processed and transmitted in the United States and locations around the world
- Top-level encryption keys are generated by AWS KMS on hardware security modules and namespace keys are stored encrypted in Dropbox's database, so key custody rests with the provider
- We found no public information on an EU hosting option, a subprocessor list or a published data processing agreement
- Enterprise is 'Contact sales for pricing', and storage beyond the starting pools plus the migration and data governance add-ons are unpriced
- We found no public information on directory or SCIM provisioning, SIEM log streaming, or open protocols such as WebDAV, SFTP and S3
Best for
- You exchange large files with clients and need password-protected, expiring share links, transfers up to 100 GB with download tracking, and uploads from people without a Dropbox account
- You want documented ransomware recovery — restore windows of 180 days to one year by plan and Rewind of a whole account or folder
- You must evidence governance to an auditor with an exportable activity log, retention policies and legal holds silent to end users
- You are moving off an on-premise file server and can buy the Movebot-powered migration add-on through the sales team
Avoid if
- You need your data to stay in the EU — the privacy policy only says data may be stored, processed and transmitted in the United States and locations around the world, and EU-to-US transfers rest on SCCs and the Data Privacy Framework
- You must hold your own encryption keys — top-level keys are generated by AWS KMS and namespace keys sit encrypted in Dropbox's database
- You have to budget your full annual cost from public pages — Enterprise is 'Contact sales for pricing' and storage beyond the starting pools is unpriced
The scores
| Criterion | Panel median |
|---|---|
| Sync, clients & file access | 3 of 5 |
| Sharing & external collaboration | 3.5 of 5 |
| Encryption, key custody & recovery | 4 of 5 |
| Administration, audit & governance | 3.5 of 5 |
| Export, API & self-hosting | 3 of 5 |
| European sovereignty | 1 of 5 |
| Pricing transparency | 2.5 of 5 |
Sync, clients & file access
Show reasoningHide reasoning
How this is scored
How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.
0 — Not a file storage or sync product; files cannot be stored and synced with it.
3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.
5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.
8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.
10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.
The IT Lead
Desktop sync for Windows and Mac with online-only files visible in the file explorer, offline folders on desktop and mobile, photo backup, full-text and image search, file sizes up to the storage quota starting at 2 GB, and a vendor-commissioned sync study as a performance figure. We found no public information on a Linux client, block-level sync, or access through WebDAV, SFTP or S3 — the protocols I would want for migrating the old file server. 3 4 10 11 14 15 16
The Data Protection Officer
Desktop sync for Windows and Mac with online-only files shown in the file explorer, offline folders on desktop and mobile, photo backup, and full-text and image search are documented, and file size is tied to the storage quota rather than a fixed cap. A 2023 Principled Technologies study commissioned by Dropbox is cited for sync performance. We found no public information on a Linux client, on WebDAV, SFTP or S3 access, or on block-level delta sync. 3 4 11 14 15 16
The Architecture Practice Partner
Online-only files that still appear in the file explorer and offline folders on iOS and Android are exactly what our laptops and site phones need, and desktop sync for Windows and Mac, full-text and image search, a quota-based file-size limit and a commissioned sync benchmark are all documented. We found no public information on a Linux client, on block-level or delta sync for multi-gigabyte models, or on access via WebDAV, SFTP or S3. 3 14 15 11 4 16
The Tax Adviser
Desktop apps sync to Windows and Mac with online-only storage and offline folders, the mobile apps on iOS and Android carry offline files and photo backup, search covers full text and images, and the file-size allowance is stated as the storage quota starting at 2 GB — that covers how my eleven staff reach client documents on any desk. The captured pages show no Linux client, no block-level or delta sync and no access through WebDAV, SFTP or S3, and the only performance figure is a Dropbox-commissioned 2023 study, so I stay in the middle band. 3 4 11 14 15 16
The Agency Producer
The captured pages show desktop apps for Windows and Mac with online-only files visible in the file explorer, offline folders on desktop and mobile, automatic sync, full-text and image search, previews, and file sizes up to the storage quota starting at 2 GB, backed by a 2023 commissioned study claiming Dropbox outperformed competitors in 86% of sync comparisons. For the rest of the top level — Linux clients, block-level sync, and access via WebDAV, SFTP or S3 — we found no public information. 3 14 15 4 11 10
The Skeptic
Desktop sync for Windows and Mac with online-only files viewable in the file explorer, offline folders on desktop and mobile, full-text search and stated file sizes are all documented. We found no public information on a Linux client, block-level or delta sync, or access through open protocols such as WebDAV, SFTP or S3 — the one performance claim is a commissioned study, not a technical figure. 3 4 11 14 15
Sharing & external collaboration
Show reasoningHide reasoning
How this is scored
How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.
0 — Files cannot be shared with anyone else.
3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.
5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.
8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.
10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.
The IT Lead
Team folders, share links with password, expiry and disabled downloads, admins able to restrict links to groups, file requests from people without accounts, watermarking, file locking and Microsoft Office editing in place, plus a Teams integration, tracked large transfers and admin reporting on externally shared content. We found no public information on guest accounts with their own permission set or a per-share access log. 1 2 4 5 6 11 16 21
The Data Protection Officer
Links with password, expiration and disabled downloads on team plans, view and edit permissions down to subfolders, file requests from people without accounts, watermarking, file locking, and a transfer service up to 100 GB with download tracking are documented, and admins can restrict link access to groups and require passwords and expiry on externally shared links. Office files can be created and edited directly in Dropbox, though we found no public information naming the co-editing suite, on guest accounts with their own permissions, or on a per-link access log. 1 4 5 6 11 16
The Architecture Practice Partner
Link controls with password, expiry and disabled downloads, watermarking and file locking, upload links that let external engineers hand over files without an account or sight of anything else, folder-level view or edit rights, and a transfer service up to 100 GB with download tracking cover most of our external work. Admin-level link restrictions to groups and an external sharing report are documented; we found no public information on guest accounts with their own permissions or an Outlook add-in. 4 16 1 5 11 2 6
The Tax Adviser
File request links let clients upload receipts without a Dropbox account and without seeing anything else in our storage, team-plan links take password, expiry and disabled downloads, admins can restrict links to certain groups and require password and expiry on external shares, and Dropbox Transfer delivers up to 100 GB with download tracking — nearly my whole checklist for exchanging client papers. Guest accounts with their own rights, an access log for each individual share and co-editing with a named editor are not documented on the captured pages, which holds it below the top. 1 5 6 11 16
The Agency Producer
Almost everything my studio sends out daily is documented: share links with password, expiry and disabled downloads, watermarking and file locking, file requests for clients without an account, Dropbox Transfer up to 100 GB with download tracking, and Replay with live review, versions and video commenting, plus admin-enforced passwords and expiry on external links and Microsoft Teams named among connected tools. Guest accounts with their own permissions and an add-in that swaps Outlook or Teams attachments for links are things we found no public information on. 1 4 5 11 16 6 2
The Skeptic
Links with password, expiry and disabled downloads, admins able to restrict link access to groups, file requests for people without an account, view-only and edit permissions, watermarking, file locking and transfers up to 100 GB are documented. We found no public information on guest accounts with their own permissions, an access log per share, or a download-count limit, and the browser co-editing claim does not name its editor. 1 4 5 6 11 16
Encryption, key custody & recovery
Show reasoningHide reasoning
How this is scored
How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.
0 — Files are stored without any stated encryption and no account protection beyond a password.
3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.
5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.
8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.
10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.
The IT Lead
TLS in transit, 256-bit AES at rest, two-factor, and a documented advanced encryption scheme with unique team keys generated in AWS KMS, rotated every 12 months and revocable only with three team admins — plus Rewind that rolls an account or folder back to before a ransomware event, with the recovery steps published. ISO 27001, SOC 1/2/3 and more are listed as independently verified; we found no public information on an externally audited cryptography report, a bug bounty, or end-to-end encryption staying on by default at the entry tiers rather than as an Advanced-plan feature. 3 6 7 9 15 18 19 20
The Data Protection Officer
TLS in transit and 256-bit AES at rest, two-factor authentication, single sign-on, tiered restore windows up to one year plus a stated ten-year recovery option, Rewind of a whole folder or account, documented ransomware recovery steps, and certifications including SOC 1, 2 and 3, ISO 27001 and HIPAA with independent verification are stated. What matters for patient letters: the advanced encryption documentation shows top-level keys generated by Amazon Web Services Key Management Service and namespace keys stored encrypted in Dropbox's own database, so key custody rests with the provider even on tiers marketed as end-to-end encrypted. We found no public information on an externally published audit report of the scheme or a bug bounty. 6 7 9 18 19 20
The Architecture Practice Partner
The pages document SSL/TLS in transit, 256-bit AES at rest, two-factor and single sign-on, version history with plan-dependent restore windows, ransomware detection and an account or folder rewind to a point in time, plus an advanced encryption scheme with team keys rotated every twelve months and revocation requiring three team admins. Who holds the keys is described — top-level keys are generated by AWS's key management service on hardware security modules and namespace keys sit in Dropbox's database — and SOC and ISO certifications are listed, though we found no public information stating the certification scope. 6 19 18 9 7 20
The Tax Adviser
TLS in transit and 256-bit AES at rest, two-factor authentication, stated restore windows of 30 days to one year by plan with ten years of version history on the enterprise governance page, Rewind of a whole folder or account, always-on ransomware detection with documented recovery steps, and SOC 1, 2 and 3 plus ISO 27001 and further certificates give me a security file I could put in front of an auditor. The end-to-end encryption on the Advanced plans is described as an advanced key-management system whose top-level keys are generated by AWS KMS on hardware security modules and rotated every twelve months, which a team or security admin must activate, and whose revocation — not ordinary operation — is what removes access even for Dropbox; the provider being unable to read stored files by default is therefore not shown, and the certificate scope is not given. 6 7 9 18 19 20
The Agency Producer
AES-256 at rest, SSL/TLS in transit, two-factor and single sign-on, up to ten years of version history, Rewind of a whole account or folder after ransomware with documented recovery steps, a security whitepaper, and a list of SOC and ISO certifications are all stated. The advanced encryption option — team keys generated by AWS KMS, rotated every 12 months, revocable permanently only by three team admins — sits on Advanced and above, and we found no public information on customer-held keys or the scope of the certifications. 6 19 9 18 7 20 3
The Skeptic
TLS and 256-bit AES are stated, version recovery runs to ten years on the governance pages with plan-specific restore windows, ransomware detection and Rewind of a whole account or folder are documented, and a whitepaper plus SOC and ISO 27001 certifications are named — though their scope is not shown. The key custody documentation is candid about who holds the keys: top-level keys from AWS KMS and namespace keys stored encrypted in Dropbox's database, so this is provider-managed encryption, and revocation is permanent and irreversible. 6 7 9 18 19
Administration, audit & governance
Show reasoningHide reasoning
How this is scored
What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.
0 — No administration: every account is independent and nobody can manage the team's users or files.
3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.
5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.
8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.
10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.
The IT Lead
An exportable, filterable activity log of all team actions delivered as CSV plus an Events API, legal hold that stays silent to users, retention policies, content-scanning data classification with real-time external-sharing alerts, device approvals and restrictions, remote wipe of a lost laptop, and instant transfer of a leaver's account. What I did not find — and need before retiring the file server — is public information on provisioning from Entra ID via SCIM or a directory, IP restrictions, or streaming the audit log to a SIEM. 9 11 16 19 20 21 22
The Data Protection Officer
An admin console with tiered admin roles, groups, an exportable activity report filterable by event, member and date range, retention policies, legal hold silent to end users, data classification scanning for card and passport numbers with real-time external-sharing alerts, device approvals, device-level restrictions, remote wipe and offboarding transfer are all documented, alongside a reports suite covering external sharing and members' two-factor status. We found no public information on provisioning via SCIM or a directory such as Entra ID or LDAP, or on streaming audit events to a SIEM. 6 9 19 20 21
The Architecture Practice Partner
An admin console with a dashboard, reports on storage, activity and members including two-factor status, an exportable filterable activity log, retention policies, legal holds, data classification with real-time DLP alerts (detection available for Germany), device approvals, remote wipe and instant transfer of leavers' accounts are all documented. We found no public information on provisioning through Entra ID, Google, LDAP or SCIM, or on a stated SIEM integration. 21 20 9 16 11
The Tax Adviser
An admin console with a filterable activity log exported as CSV, member data including role and two-factor status, external sharing and member access reports, retention policies and legal holds silent to end users, PII data classification with real-time alerts, device approvals and remote wipe, and instant deactivation or transfer of a leaver's account — this is governance I could actually evidence for my practice. Directory or SCIM provisioning and streaming logs to a SIEM are not documented on the captured pages, and the sharing alerts cover only team folders. 9 11 20 21
The Agency Producer
The admin console evidence is deep: groups and roles with tiered admins, a filterable activity log exportable as CSV plus an Events API endpoint, retention policies and silent legal holds, remote wipe and device approvals, data classification with real-time DLP alerts, domain verification with account capture, and instant deactivation or transfer of departing users — exactly how I would run freelance crews per project. We found no public information on provisioning through a directory or SCIM, or on SIEM streaming. 21 9 20 11 4 22
The Skeptic
The admin console offers a filterable, exportable activity log, reports on storage, external links, member access and two-factor status, retention policies and a legal hold silent to end users, device approvals, remote wipe, offboarding transfers and data classification with real-time alerts. We found no public information on provisioning through SCIM or a directory, on IP restrictions, or on streaming the audit log to a SIEM — only a vague "integrations with best in-class security solutions". 9 19 20 21 22
Export, API & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.
0 — Files can only be downloaded one by one; no export, API or migration path.
3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.
5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.
8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.
The IT Lead
A documented HTTP API with six official SDKs, webhooks and team endpoints, a Movebot-powered migration add-on that carries files and permissions off our on-premise file server on a schedule with real-time monitoring, deletion of account data initiated 30 days after cancellation, and an export window before termination. We found no public information on open-protocol access such as WebDAV, S3 or SFTP, a self-hosted edition, or an app marketplace. 2 10 12 13 22 23
The Data Protection Officer
A documented API with official SDKs for six languages, webhooks and team endpoints including the audit log, a machine-readable download, deletion initiated 30 days after account deletion, and an inbound migration add-on powered by Movebot sold through the sales team with permission transfer are stated. We found no public information on open-protocol access such as WebDAV, S3 or SFTP, a self-hosted or on-premise edition, open-source code, or a bulk export that includes versions and permissions. 2 10 12 13 23
The Architecture Practice Partner
A documented REST API with SDKs in six languages, webhooks, an API explorer and endpoints for revisions, team management and permanent deletion, plus a migration add-on powered by Movebot that moves files and permissions from on-premise file servers, give us a way in and a way out. The pages state deletion is initiated 30 days after account deletion and that users get an opportunity to export before termination; we found no public information on WebDAV, S3 or SFTP access, a self-hosted edition, or a bulk export of all files with folder structure and versions. 10 22 23 12 13
The Tax Adviser
A documented API with SDKs in six languages, webhooks, endpoints for the team audit log and file requests, a Movebot-powered migration add-on moving files and permissions from on-premise servers and other cloud stores into a team account, and named integrations with Microsoft Teams, Zoom and Dropbox Sign. The way out is thin on these pages: open protocols such as WebDAV, S3 or SFTP, a bulk export with folder structure and versions, an app marketplace and any self-hosted edition are not documented, and after cancellation I find only a thirty-day deletion of account data and the chance to export before a suspension. 2 10 12 13 23
The Agency Producer
API v2 is documented with SDKs in six languages, webhooks, and team plus audit-log endpoints, and there is a migration add-on powered by Movebot, sold through the sales team, that moves files and permissions from on-premise file servers and existing cloud storage into a team account. Machine-readable export and deletion of personal information 30 days after account deletion are stated; we found no public information on open protocols such as WebDAV, S3 or SFTP, or on a self-hosted edition. 10 22 23 12 13 2
The Skeptic
A documented API with six named SDKs, webhooks, audit-log endpoints and an API explorer is public, a migration add-on powered by Movebot moves files and permissions in from file servers and other clouds through the sales team, and deletion of account data starts 30 days after account deletion with an export opportunity before termination. We found no public information on open-protocol access like WebDAV, S3 or SFTP, on a self-hosted edition, on open-source code, or on a bulk export that carries versions, shares and permissions in a documented format. 10 12 13 22 23
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.
5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.
8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
Customers outside North America contract with Dropbox International Unlimited Company in Dublin, but the captured pages state data may be stored and processed in the United States and around the world, transfers to the US rest on the Data Privacy Framework and standard contractual clauses, and the terms are governed by California law in San Francisco courts. We found no public information on an EU storage option, a subprocessor list with locations, or a published data processing agreement — for our Polish sites that means SCCs and the DPF carry the whole chain. 12 13
The Data Protection Officer
Customers outside North America contract with Dropbox International Unlimited Company in Dublin, but the terms are governed by California law with proceedings in San Francisco courts, and the privacy policy states data may be stored, processed and transmitted in the United States and locations around the world, with EU-to-US transfers relying on Standard Contractual Clauses and the Data Privacy Framework and the parent under FTC oversight. Key generation runs through Amazon Web Services KMS, and we found no public information on a named data-centre location, an EU hosting option, a subprocessor list or a published data processing agreement. 12 13 19
The Architecture Practice Partner
The privacy policy states data may be stored, processed and transmitted in the United States and locations around the world including outside your country, with EU-to-US transfers relying on standard contractual clauses and the Data Privacy Framework, and the terms choose California law and San Francisco courts; we found no public information naming a European hosting option, the subprocessors or a data processing agreement. The advanced encryption keys being generated by AWS's key management service places a US provider in the chain. 12 13 19
The Tax Adviser
My contract would be with Dropbox International Unlimited Company in Dublin, yet the privacy policy says data may be stored and processed in the United States and locations around the world, transfers to the US rest on standard contractual clauses and the Data Privacy Framework, disputes are heard in San Francisco under California law, and the provider is subject to FTC oversight with top-level keys generated through AWS KMS. I found no public information on an EU hosting option, a subprocessor list or a data processing agreement, so the chain a practice bound by professional secrecy would have to vet is not open to vetting. 12 13 19
The Agency Producer
Customers outside North America contract with Dropbox International Unlimited Company in Dublin, but the privacy policy only says data may be stored and processed in the United States and locations around the world, with EU-to-US transfers carried by Standard Contractual Clauses and the Data Privacy Framework under FTC oversight, and California law with San Francisco courts governing the terms. We found no public information on an EU hosting option, a subprocessor list, or a data processing agreement. 13 12 6
The Skeptic
Customers outside North America contract with Dropbox International Unlimited Company in Dublin, yet the same terms are governed by California law with disputes in San Francisco courts, the company is subject to FTC oversight, and storage is described only as "in the United States and locations around the world". We found no public information on a European hosting option, a published data processing agreement, or a list of subprocessors and their locations; transfers rest on the Data Privacy Framework and standard contractual clauses. 12 13
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.
5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.
The IT Lead
Standard at €12 / user / month with 3,000 GB for the team and Advanced at €18 / user / month starting at 15 TB are public, with minimum users, restore windows and which tier carries single sign-on and end-to-end encryption all stated. But the Enterprise plan is sales-only, and we found no public prices for storage beyond the starting allocation or the Data Governance and migration add-ons, nor any statement of minimum term or VAT — so I cannot compute our real annual cost for 180 people from public pages alone. 1 11 14 15 16 20 23
The Data Protection Officer
Standard at €12 / user / month starting at 3,000 GB for the team and Advanced at €18 / user / month starting at 15 TB are public, with minimum users of 1 and 3, per-tier restore windows and transfer limits, and end-to-end encryption, advanced key management and single sign-on mapped to the Advanced tier. Enterprise is "Contact sales for pricing", and we found no public information on extra-storage pricing, the cost of the data migration add-on, or VAT treatment; the free trial requires a payment method and continues as a paid subscription unless cancelled beforehand. 1 11 15 16 21 23
The Architecture Practice Partner
Standard at "€12 / user / month" with storage that "Starts at 3,000 GB for the team" and Advanced at "€18 / user / month" "Starts at 15 TB for the team", with minimum user counts, restore windows and transfer limits per plan, let me price our 25 seats at a glance — but how storage scales beyond the starting figure and what it costs is not shown. Enterprise is contact-sales only, the migration and governance add-ons are unpriced, and we found no public information on VAT treatment or minimum term. 11 16 6 23 1 13
The Tax Adviser
Standard at €12 / user / month from one user with 3,000 GB team storage and Advanced at €18 / user / month from three users with 15 TB are public, with restore windows and transfer limits stated per plan, so I can price my eleven seats at a glance. Enterprise is 'Contact sales for pricing', storage beyond the included 'starts at' amounts and the migration and data governance add-ons are unpriced, and VAT treatment and a minimum term are not stated on the captured pages. 6 11 16 20 23
The Agency Producer
Standard at €12 per user per month starting at 3,000 GB for the team and Advanced at €18 per user per month starting at 15 TB are public, with minimum users stated, restore windows of 180 days and one year, and transfer limits of 100 GB per tier. Enterprise is "Contact sales for pricing", the migration and data governance add-ons are sold through sales, some admin reports vary by plan, and we found no public information on the cost of storage beyond the starting pools or on VAT treatment. 11 16 6 1 23 21
The Skeptic
Standard at €12 per user per month with 3,000 GB for the team and Advanced at €18 per user per month with 15 TB are public, with minimum users, restore windows and transfer limits stated and single sign-on and advanced encryption sitting in the Advanced tier. But Enterprise is "Contact sales for pricing", the cost of storage beyond "starts at" is not published, the data governance and migration add-ons are sales-only, and we found no public information on VAT treatment or minimum terms. 1 6 11 15 16 23
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Dropbox
Is Dropbox European?
No. whats-best.ai classifies Dropbox as Rest of world.
Where does Dropbox store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Dropbox have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Dropbox?
As of 1 Nov 2026, the panel rates Nextcloud Files (Nextcloud Hub) (4/5), Tresorit (3.5/5) and Proton Drive (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is Nextcloud Files (Nextcloud Hub) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Dropbox alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 19 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (23)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (business) www.dropbox.com Checked 1 Nov 2026 Details →
- 2 Features page www.dropbox.com Checked 1 Nov 2026 Details →
- 3 Features page (sync) www.dropbox.com Checked 1 Nov 2026 Details →
- 4 Features page (sharing) www.dropbox.com Checked 1 Nov 2026 Details →
- 5 Features page (file transfer) www.dropbox.com Checked 1 Nov 2026 Details →
- 6 Security / trust page www.dropbox.com Checked 1 Nov 2026 Details →
- 7 Security / trust page (trust centre) www.dropbox.com Checked 1 Nov 2026 Details →
- 8 Security / trust page (compliance) www.dropbox.com Checked 1 Nov 2026 Details →
- 9 Security / trust page (privacy and governance) www.dropbox.com Checked 1 Nov 2026 Details →
- 10 API documentation www.dropbox.com Checked 1 Nov 2026 Details →
- 11 Pricing page www.dropbox.com Checked 1 Nov 2026 Details →
- 12 Privacy policy www.dropbox.com Checked 1 Nov 2026 Details →
- 13 Terms of service www.dropbox.com Checked 1 Nov 2026 Details →
- 14 Sync, clients & file access — found from sitemap www.dropbox.com Checked 1 Nov 2026 Details →
- 15 Sync, clients & file access — found from sitemap www.dropbox.com Checked 1 Nov 2026 Details →
- 16 Sharing & external collaboration — found from sitemap www.dropbox.com Checked 1 Nov 2026 Details →
- 17 Sharing & external collaboration — found from sitemap help.dropbox.com Checked 1 Nov 2026 Details →
- 18 Encryption, key custody & recovery — found from sitemap help.dropbox.com Checked 1 Nov 2026 Details →
- 19 Encryption, key custody & recovery — found from sitemap help.dropbox.com Checked 1 Nov 2026 Details →
- 20 Administration, audit & governance — found from sitemap www.dropbox.com Checked 1 Nov 2026 Details →
- 21 Administration, audit & governance — found from sitemap help.dropbox.com Checked 1 Nov 2026 Details →
- 22 Export, API & self-hosting — found from sitemap www.dropbox.com Checked 1 Nov 2026 Details →
- 23 Export, API & self-hosting — found from sitemap help.dropbox.com Checked 1 Nov 2026 Details →