# Dropbox — Cloud Storage & File Sharing

Dropbox by Dropbox, Inc. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Dropbox, Inc. (https://www.dropbox.com/business)
- Category: [Cloud Storage & File Sharing](https://whats-best.ai/software/cloud-storage.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/cloud-storage/dropbox
- Alternatives: https://whats-best.ai/software/cloud-storage/dropbox/alternatives ([markdown](https://whats-best.ai/software/cloud-storage/dropbox/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Dropbox, Inc.
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 1 Nov 2026

## The panel's verdict

Dropbox is a cloud storage and file-sharing service; customers outside North America contract with Dropbox International Unlimited Company in Dublin, while the terms are governed by California law with disputes in San Francisco courts. The bench scored it highest on encryption and security, citing 256-bit AES at rest, SSL/TLS in transit, Rewind ransomware recovery and listed SOC and ISO certifications, and gave administration and governance a flat 7 for the exportable, filterable activity log, retention policies, silent legal holds and remote wipe. Sovereignty is the outlier at 2-3: the privacy policy states data may be stored, processed and transmitted in the United States and locations around the world, top-level encryption keys are generated by AWS KMS, and the judges found no public information on an EU hosting option, a subprocessor list or a data processing agreement. Sync and access and sharing and collaboration scored 6-7, portability and integrations a flat 6. Pricing transparency scored 5-6: Standard at €12 per user per month and Advanced at €18 per user per month are public; Enterprise is contact-sales only.

**Speaks for it:**
- Encryption and security scored 7-8, documenting 256-bit AES at rest, SSL/TLS in transit, Rewind ransomware recovery and listed SOC and ISO certifications
- Administration and governance scored a flat 7 for a filterable, exportable activity log, retention policies, legal holds silent to end users, device approvals and remote wipe
- Share links take password, expiry and disabled downloads, file requests collect uploads from people without accounts, and transfers run up to 100 GB with download tracking
- Standard and Advanced prices are published per user per month with minimum users, restore windows and transfer limits stated
- A documented API with SDKs in six languages and webhooks, plus a Movebot-powered migration add-on, gives a way in and a way out (portability and integrations scored a flat 6)

**Held against it:**
- Sovereignty scored 2-3: the terms choose California law and San Francisco courts while the privacy policy says data may be stored, processed and transmitted in the United States and locations around the world
- Top-level encryption keys are generated by AWS KMS on hardware security modules and namespace keys are stored encrypted in Dropbox's database, so key custody rests with the provider
- We found no public information on an EU hosting option, a subprocessor list or a published data processing agreement
- Enterprise is 'Contact sales for pricing', and storage beyond the starting pools plus the migration and data governance add-ons are unpriced
- We found no public information on directory or SCIM provisioning, SIEM log streaming, or open protocols such as WebDAV, SFTP and S3

**Best for:**
- You exchange large files with clients and need password-protected, expiring share links, transfers up to 100 GB with download tracking, and uploads from people without a Dropbox account
- You want documented ransomware recovery — restore windows of 180 days to one year by plan and Rewind of a whole account or folder
- You must evidence governance to an auditor with an exportable activity log, retention policies and legal holds silent to end users
- You are moving off an on-premise file server and can buy the Movebot-powered migration add-on through the sales team

**Avoid if:**
- You need your data to stay in the EU — the privacy policy only says data may be stored, processed and transmitted in the United States and locations around the world, and EU-to-US transfers rest on SCCs and the Data Privacy Framework
- You must hold your own encryption keys — top-level keys are generated by AWS KMS and namespace keys sit encrypted in Dropbox's database
- You have to budget your full annual cost from public pages — Enterprise is 'Contact sales for pricing' and storage beyond the starting pools is unpriced

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The Data Protection Officer | The Architecture Practice Partner | The Tax Adviser | The Agency Producer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sync, clients & file access | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 3/5 |
| Sharing & external collaboration | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Encryption, key custody & recovery | 4/5 | 4/5 | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Administration, audit & governance | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Export, API & self-hosting | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Pricing transparency | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **2.5/5** |

### The judges

- **The IT Lead** (v1.0): Runs IT with one colleague for a 180-person machine builder with three sites and a sales office in Poland. Is retiring the old file server and wants every account provisioned from Entra ID, team folders that stay with the company when someone leaves, an audit log they can hand to the auditor, a lost laptop wiped remotely, and a way back to the last clean state if ransomware ever encrypts a share.
- **The Data Protection Officer** (v1.0): External data protection officer for a hospital group, two care providers and a payroll bureau, where the files are patient letters and salary statements. Reads who holds the keys before the feature page, asks whether end-to-end encryption survives a share link and the office editor, and wants the subprocessor list, the storage location and the contracting entity in writing before a single folder moves.
- **The Architecture Practice Partner** (v1.0): Partner in a 25-person architecture practice in Hamburg whose CAD and BIM models run to several gigabytes each, worked on from the office, from home and on the building site. Needs files on demand so laptops do not fill up, sync that sends only what changed, a drive letter the CAD software accepts, phones that open plans offline in a basement, and structural engineers who can pick up a folder without an account.
- **The Tax Adviser** (v1.0): Runs a tax practice with eleven staff and 400 clients, bound by professional secrecy under §203 StGB. Receives receipts, payslips and annual accounts from clients who will not install anything, and sends back drafts that must not end up in a forwarded email. Needs upload links, shares with expiry and passwords, a record of who downloaded what, and a provider that cannot read the files it stores.
- **The Agency Producer** (v1.0): Producer at a 30-person video and design agency in Cologne that sends cuts, layouts and raw footage to customers every day and collects their feedback. Wants review links that play in the browser, comments on the file, transfers of 100 GB that do not stall, freelancers added for one project and removed after it, connections to Slack and the project tool, and a storage bill that does not jump when one shoot fills a terabyte.
- **The Skeptic** (v1.0): Has seen "end-to-end encrypted" on a service that switches it off for shared folders, "hosted in Germany" on storage whose accounts and support run from the US, and "lifetime" plans from a company two years old. Reads that a product is "GDPR-compliant" and asks who holds the keys, whether ten years of folders, versions and shares can be exported in a form another provider imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit use cases: dashboard used to support SOC 2, HIPAA audits [S21]
- Certifications: SOC 1 · SOC 2 · SOC 3 · HIPAA/HITECH · ISO 22301 · ISO 27001 · ISO 27017 · ISO 27018 · ISO 27701 · ISMAP [S7]
- Dnt signal honored: yes [S12]
- Dpf certification: Dropbox, Inc. · yes · yes · yes [S12]
- Dpf dispute resolution: free · JAMS [S12]
- Dpf exclusion formswift: FormSwift [S12]
- Frameworks supported: GDPR · HIPAA · SOC 2 [S20]
- Ftc oversight: yes [S12]
- GDPR: yes [S6]
- GDPR commitment: yes · yes · yes [S9]
- Google API policy: yes [S12]
- Government request principles: Government Request Principles: transparent, fight blanket requests, protect all users, provide trusted services [S12]
- HIPAA support: yes [S6]
- Independent verification: yes [S7]
- Kms provider: Hardware Security Modules (HSM) · AWS KMS [S19]
- Namespace key storage: Namespace encryption keys stored encrypted in Dropbox's database [S19]
- Privacy contact: privacy@dropbox.com [S12]
- Privacy policy available: yes [S9]
- SOC reports: 1 · 2 · 3 [S6]
- Transfer mechanisms: yes · yes · yes · yes · yes [S12]
- Transparency report: yes [S12]
- Trust center: Trust Center available [S8]
- Trust center: yes [S9]
- Trust center: Trust Center [S6]

**Data**
- Access and download: yes · yes · yes · yes [S12]
- Deletion after account deletion: 30 [S12]
- Portability: yes [S12]
- Report delivery: CSV to 'Dropbox Business reports' folder · email notification when ready [S21]
- Retention: retained for as long as account exists or needed to provide Services [S12]

**Hosting**
- Data locations: yes · yes [S12]

**Integrations**
- API admin permission levels: 4 [S22]
- API async pattern: yes [S22]
- API audit log: /2/team_log/get_events [S22]
- API content search: yes · Dropbox Business [S22]
- API cursor compatibility: yes [S22]
- API date format: ISO 8601 [S22]
- API delete user message: yes [S22]
- API dropins no migration: no [S22]
- API error handling: yes · 409 [S22]
- API file ids: yes [S22]
- API file type permission removed: no [S22]
- API http methods: POST · JSON body [S22]
- API linked apps list: Business teams · yes [S22]
- API list revisions: /2/files/list_revisions [S22]
- API locale header: Dropbox-Locale header [S22]
- API members add batch: yes · 20 [S22]
- API objective c sdk: yes [S22]
- API permanent delete: yes [S22]
- API select user header: Dropbox-API-Select-User [S22]
- API sharing invites: yes [S22]
- API suspend users: yes · yes [S22]
- API team reports: get_storage · get_activity · get_membership · get_devices [S22]
- API temporary link: /2/files/get_temporary_link [S22]
- API token migration: /2/auth/token/from_oauth1 [S22]
- API v1 retired: yes · v1_retired · September 2017 [S22]
- API v2 oauth: OAuth 2 [S22]
- Chooser saver: yes [S10]
- Developer resources: yes [S2]
- Files API: Files API · Paper API [S10]
- Http API: yes [S10]
- Sdks: Swift · .NET · Java · JavaScript · Objective-C · Python [S10]
- Webhooks: yes [S10]

**Legal**
- Contracting entity: Dropbox, Inc. · Dropbox International Unlimited Company [S13]
- EU consent nonusers: yes [S12]
- EU odr platform: https://ec.europa.eu/consumers/odr [S13]
- Governing law: California law [S13]
- Jurisdiction: Federal or state courts of San Francisco County, California [S13]
- Liability cap: greater of $20 USD or 100% of amounts paid under current service plan [S13]
- Minimum age: 13 · 16 [S13]
- No sale of data: no [S12]
- Policy change 2027: 2027-01-01 [S12]
- Policy posted: 2025-05-30 · 2025-05-30 [S12]
- Policy revision notice: yes [S12]
- Terms effective date: 2025-01-07 · 2025-01-07 [S13]
- Translation disclaimer: US English [S13]
- Upcoming terms change: 2027-01-01 [S13]
- Update refund: yes [S13]

**Pricing**
- Advanced: 3 · 15 · 18 [S3]
- Advanced: 3 · 15 TB · 18 [S14]
- Advanced: 18 [S15]
- Advanced admin features: tiered-admin management [S1]
- Advanced admin features: yes [S14]
- Advanced compliance tracking: yes [S3]
- Advanced e2e encryption: yes [S3]
- Advanced end to end encryption: yes · yes · yes · yes [S14]
- Advanced features: Tiered-admin management · End-to-end encryption · Advanced key management · Compliance tracking · Single sign-on [S6]
- Advanced key management: yes [S3]
- Advanced min users: 3 [S6]
- Advanced price: Advanced · EUR · 18 [S1]
- Advanced price: Advanced · EUR · 18 [S4]
- Advanced price: Advanced · EUR · 18 [S6]
- Advanced price: EUR · 18 [S11]
- Advanced restore: 3 or more · starts at 15 TB for team · 1 year [S15]
- Advanced restore window: 1 year [S14]
- Advanced SSO: yes [S3]
- Advanced storage: Advanced · 15 [S1]
- Advanced storage: Advanced · 15 [S6]
- Advanced storage: Starts at 15,000 GB for the team [S11]
- Advanced storage: 15 TB [S16]
- Advanced team size: Advanced · 3 [S1]
- Advanced transfer: Deliver up to 100 GB [S11]
- Advanced users: 3 [S11]
- Compare plans: yes [S2]
- Enterprise customization: Customize number of users, Customize storage [S11]
- Enterprise features: Transfer up to 250 GB · Enterprise-grade security · Integrations with best in-class security solutions · Live support from dedicated experts [S6]
- Enterprise price: Enterprise · yes [S6]
- Enterprise pricing model: Contact sales for pricing [S11]
- Enterprise quote only: Enterprise · yes · yes [S1]
- Enterprise transfer: Transfer up to 250 GB [S11]
- Plan dependent reports: report availability varies by plan [S21]
- Plus: 1 · 2 TB · 9.99 · monthly · yearly [S14]
- Plus: 1 · 2 TB · 9.99 [S15]
- Plus: 1 · 2 TB · 9.99 [S16]
- Plus restore days: 30 [S3]
- Plus restore window: 30 [S14]
- Plus transfer limit: 50 [S3]
- Plus transfer limit: 50 [S14]
- Standard: 1 person or more · 3 · 12 [S3]
- Standard: 1 · 3 TB · 12 [S14]
- Standard: 12 [S15]
- Standard admin: yes [S3]
- Standard admin features: yes · yes · yes [S14]
- Standard file restore: 180-day history [S11]
- Standard min users: 1 [S6]
- Standard price: Standard · EUR · 12 [S4]
- Standard price: Standard · EUR · 12 [S6]
- Standard price: EUR · 12 [S11]
- Standard restore: starts at 3 TB for team · 180 [S15]
- Standard restore: 180 [S16]
- Standard restore days: 180 [S3]
- Standard restore period: 180 · Standard [S1]

**Product**
- Activation admin roles: team admin · security admin [S19]
- Activity export: csv · Dropbox Business reports folder · yes [S21]
- Activity log actions: CancelKeyDeletion · CreateKey · DeleteKey · DisableKey · EnableKey · ScheduleKeyDeletion [S19]
- Activity notifications: progress notifications and recent activity view [S2]
- Activity report: Activity report · filterable activity log · filter by event type, team member, date range [S21]
- Admin console reports: Admin console reports suite for Dropbox for teams [S21]
- Admin control: yes [S15]
- Admin features: admin features for team management, data security and compliance, activity insights [S2]
- Admin link limits: yes [S16]
- Advanced compliance tracking: Advanced · yes [S1]
- Advanced encryption: Advanced · yes · yes [S1]
- Advanced encryption activity log: yes [S19]
- Advanced encryption description: Advanced key management system using unique team keys and multi-layered key encryption [S19]
- Advanced encryption plan availability: Advanced · Business Plus · Enterprise [S19]
- Advanced end to end encryption: yes · yes [S4]
- Advanced restore window: 365 [S4]
- Advanced security: yes · yes · yes · yes · yes [S15]
- Advanced security features: yes · yes · yes · yes · yes [S16]
- Advanced SSO: Advanced · yes [S1]
- Advanced SSO: yes · yes [S4]
- Advanced storage: 15 [S4]
- Advanced tiered admin: yes [S4]
- Aes at rest: 256-bit AES [S6]
- AI integration: yes [S3]
- AI integrations: yes [S1]
- AI integrations: yes [S16]
- AI principles: yes [S7]
- AI tool integrations: yes [S4]
- AI tools: yes [S15]
- AI tools integration: yes [S14]
- API access: 1000000000 [S11]
- API explorer: yes [S10]
- API volume: 50000000000 [S10]
- Apps: Desktop app, Mobile app, Integrations [S11]
- Arbitration opt out: yes · 30 [S13]
- Automated account management: Automated account management blocks future free accounts on the domain [S20]
- Automated parallel loading: Automation via parallel loading, Dropbox API call optimization, and Movebot's managed scalable technology [S23]
- Automatic sync: yes [S3]
- Beta services confidential: yes [S13]
- Branding: yes [S14]
- Branding on shared files: yes [S4]
- Breach alerts: breach alerts and notifications · yes [S6]
- Breach security: vulnerability testing · dark web monitoring · enterprise detection and response [S6]
- Business APIs: Business APIs · Events API · Team Folders API [S10]
- Change notifications: yes · added · edited · deleted · renamed · moved [S4]
- Class actions barred: no [S13]
- Cloud storage: yes [S15]
- Content organizer: centralized organization of files, cloud content, Paper docs, web shortcuts [S2]
- Core features: file storage, sharing, previews, search [S10]
- Cross device sharing: phone · tablet · computer · yes [S4]
- Cross platform sync: Windows · Mac · iPhone · iPad · Android [S3]
- Custom link expiration: Custom expiration dates [S11]
- Customer base: 575000 [S7]
- Customer recovery: customer testimonial: deleted data recoverable and kept secure [S7]

**Support**
- Admin contact: Admins should contact their account team or Customer Success Manager to learn more [S23]
- Advanced training: Advanced training for end users and admins [S11]
- Enterprise live support: Live support from dedicated experts [S11]
- Forum: yes [S10]
- Live chat: Live chat support [S11]
- Priority email: Priority email support [S11]
- Privacy faqs: deletion schedules · usage information · algorithmic analysis · yes [S9]
- Rewind help: Support can assist with rewinding an account [S18]

213 more facts on the canonical page: https://whats-best.ai/software/cloud-storage/dropbox

## Questions

### Is Dropbox European?

No. whats-best.ai classifies Dropbox as Rest of world.

### Where does Dropbox store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Dropbox have a free plan?

Not stated on the vendor’s pages as of 1 Nov 2026.

### What are the best alternatives to Dropbox?

As of 1 Nov 2026, the panel rates [Nextcloud Files (Nextcloud Hub) (4/5)](https://whats-best.ai/software/cloud-storage/nextcloud-files), [Tresorit (3.5/5)](https://whats-best.ai/software/cloud-storage/tresorit) and [Proton Drive (3/5)](https://whats-best.ai/software/cloud-storage/proton-drive) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is [Nextcloud Files (Nextcloud Hub)](https://whats-best.ai/software/cloud-storage/nextcloud-files) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Dropbox alternatives](https://whats-best.ai/software/cloud-storage/dropbox/alternatives).

## Head-to-head

- [Dropbox vs Tresorit](https://whats-best.ai/compare/dropbox-vs-tresorit.md)

## What this page leaves out

- 19 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage (business): https://www.dropbox.com/business (checked 2026-11-01)
- [S2] Features page: https://www.dropbox.com/features (checked 2026-11-01)
- [S3] Features page (sync): https://www.dropbox.com/features/sync (checked 2026-11-01)
- [S4] Features page (sharing): https://www.dropbox.com/features/share (checked 2026-11-01)
- [S5] Features page (file transfer): https://www.dropbox.com/transfer (checked 2026-11-01)
- [S6] Security / trust page: https://www.dropbox.com/features/security (checked 2026-11-01)
- [S7] Security / trust page (trust centre): https://www.dropbox.com/business/trust (checked 2026-11-01)
- [S8] Security / trust page (compliance): https://www.dropbox.com/business/trust/compliance (checked 2026-11-01)
- [S9] Security / trust page (privacy and governance): https://www.dropbox.com/business/trust/privacy (checked 2026-11-01)
- [S10] API documentation: https://www.dropbox.com/developers (checked 2026-11-01)
- [S11] Pricing page: https://www.dropbox.com/business/plans-comparison (checked 2026-11-01)
- [S12] Privacy policy: https://www.dropbox.com/privacy (checked 2026-11-01)
- [S13] Terms of service: https://www.dropbox.com/en_GB/terms (checked 2026-11-01)
- [S14] Sync, clients & file access — found from sitemap: https://www.dropbox.com/features/sync/work-remotely-offline (checked 2026-11-01)
- [S15] Sync, clients & file access — found from sitemap: https://www.dropbox.com/features/sync/save-space (checked 2026-11-01)
- [S16] Sharing & external collaboration — found from sitemap: https://www.dropbox.com/features/share/link-sharing (checked 2026-11-01)
- [S17] Sharing & external collaboration — found from sitemap: https://help.dropbox.com/share/sharing-permissions (checked 2026-11-01)
- [S18] Encryption, key custody & recovery — found from sitemap: https://help.dropbox.com/security/ransomware-recovery (checked 2026-11-01)
- [S19] Encryption, key custody & recovery — found from sitemap: https://help.dropbox.com/security/advanced-encryption (checked 2026-11-01)
- [S20] Administration, audit & governance — found from sitemap: https://www.dropbox.com/business/security-and-compliance (checked 2026-11-01)
- [S21] Administration, audit & governance — found from sitemap: https://help.dropbox.com/account-access/admin-console-reports (checked 2026-11-01)
- [S22] Export, API & self-hosting — found from sitemap: https://www.dropbox.com/developers/reference/migration-guide (checked 2026-11-01)
- [S23] Export, API & self-hosting — found from sitemap: https://help.dropbox.com/plans/data-migration-movebot (checked 2026-11-01)

---

Cite as: whats-best.ai, "Dropbox — Cloud Storage & File Sharing", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/cloud-storage/dropbox

Corrections: https://whats-best.ai/correct/1222?target=page