# Tresorit — Cloud Storage & File Sharing

Tresorit by Tresorit AG holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: UK / wider Europe; sovereignty: not determined.

- Vendor: Tresorit AG (https://tresorit.com)
- Category: [Cloud Storage & File Sharing](https://whats-best.ai/software/cloud-storage.md)
- Provenance (editorial classification): UK / wider Europe
- Canonical page: https://whats-best.ai/software/cloud-storage/tresorit
- Alternatives: https://whats-best.ai/software/cloud-storage/tresorit/alternatives ([markdown](https://whats-best.ai/software/cloud-storage/tresorit/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Tresorit AG
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S11]

## The panel's verdict

Tresorit AG of Zurich, part of Swiss Post, sells end-to-end encrypted file sync and sharing for businesses. Strongest is controlled external exchange: sharing and collaboration scores run 8-9, on encrypted links with password, expiry, open limits, disabled download and print, watermarks, file requests for recipients without an account, and zero-knowledge office editing on Collabora. Weakest is leaving: portability and integrations scored 4-5, the captured pages showing no public information on migration tools, bulk export or a self-hosted edition. Sync and access clusters at 6, with the architecture practice partner at 4 for want of public information on delta sync and previews for multi-gigabyte BIM files. Administration and governance and sovereignty each scored a flat 7 — primary storage in the EEA or Switzerland with customer-selectable residency, beside terms disclosing sub-processing in the United States and other countries and possible transfers outside the EU or Switzerland. Pricing transparency scored 5-6: €12 per user per month from 3 users and €20 from 5 users are published, but the pages give different figures for Business storage, and extra storage and eSign are unpriced.

**Speaks for it:**
- Sharing and collaboration scored 8-9, on encrypted links with password, expiry, open limits, disabled download and print, watermarks, access logs and link activity reports
- Client-side AES-256 zero-knowledge encryption is documented in a published whitepaper, with the vendor stating it cannot decrypt files or recover passwords
- Administration and governance scored a flat 7, with exportable audit logs, provisioning via Azure AD SSO and SCIM, and Microsoft Sentinel SIEM streaming
- Encrypted file requests collect uploads from recipients without an account, and Word, Excel and PowerPoint files edit in-app under end-to-end encryption on Collabora
- The contracting entity is stated in writing — Tresorit AG of Zurich, part of Swiss Post — with primary storage in the EEA or Switzerland and a published data processing addendum

**Held against it:**
- Portability and integrations scored 4-5, and we found no public information on migration tools from named providers, bulk export preserving folder structure, or SDKs and webhooks
- Sync and access scored 4-6, and we found no public information on delta sync for large files, previews or full-text search
- We found no public information naming an independent audit or penetration test of the cryptography, or stating the scope of the ISO 27001:2022 certification
- The terms disclose sub-processing in the United States and other countries, and some service data and metadata may be handled outside the selected location
- We found no public price for extra storage or the eSign add-on, and the captured pages give different figures for FileSharing Business storage — 1 TB per user and from 6 TB

**Best for:**
- You exchange confidential documents with external clients and need encrypted links with expiry, open limits, watermarks and detailed access logs
- You collect files from counterparties who will not register — encrypted file requests are documented for recipients without an account
- Your team runs on the Microsoft stack — provisioning via Azure AD SSO and SCIM, Active Directory synchronisation and Microsoft Sentinel SIEM streaming are documented
- You answer to professional secrecy or a regulator and want a written contracting entity — Tresorit AG of Zurich under Swiss law, part of Swiss Post, with a published data processing addendum and ISO 27001:2022 stated

**Avoid if:**
- You need every processing step inside Europe — the terms state sub-processing within the EEA, the United States and other countries, and the privacy policy says personal data may also be transferred outside the EU or Switzerland
- You are buying a backup product — the terms describe a cloud storage sync and share service, not back-up services
- Your threat model extends to metadata — the terms state folder and room names are not end-to-end encrypted and may be visible to Tresorit during support
- You must compute the full annual cost before committing — Enterprise is custom pricing from 50 users billed annually, fees are stated exclusive of taxes, and we found no public price for extra storage or the eSign add-on

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The Data Protection Officer | The Architecture Practice Partner | The Tax Adviser | The Agency Producer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sync, clients & file access | 3/5 | 3/5 | 2/5 | 3/5 | 3/5 | 3/5 |
| Sharing & external collaboration | 4.5/5 | 4.5/5 | 4/5 | 4.5/5 | 4.5/5 | 4.5/5 |
| Encryption, key custody & recovery | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 4/5 |
| Administration, audit & governance | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Export, API & self-hosting | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| European sovereignty | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Pricing transparency | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 |
| **Weighted verdict** | **3.5/5** | **3.5/5** | **3/5** | **3.5/5** | **3.5/5** | **3.5/5** |

### The judges

- **The IT Lead** (v1.0): Runs IT with one colleague for a 180-person machine builder with three sites and a sales office in Poland. Is retiring the old file server and wants every account provisioned from Entra ID, team folders that stay with the company when someone leaves, an audit log they can hand to the auditor, a lost laptop wiped remotely, and a way back to the last clean state if ransomware ever encrypts a share.
- **The Data Protection Officer** (v1.0): External data protection officer for a hospital group, two care providers and a payroll bureau, where the files are patient letters and salary statements. Reads who holds the keys before the feature page, asks whether end-to-end encryption survives a share link and the office editor, and wants the subprocessor list, the storage location and the contracting entity in writing before a single folder moves.
- **The Architecture Practice Partner** (v1.0): Partner in a 25-person architecture practice in Hamburg whose CAD and BIM models run to several gigabytes each, worked on from the office, from home and on the building site. Needs files on demand so laptops do not fill up, sync that sends only what changed, a drive letter the CAD software accepts, phones that open plans offline in a basement, and structural engineers who can pick up a folder without an account.
- **The Tax Adviser** (v1.0): Runs a tax practice with eleven staff and 400 clients, bound by professional secrecy under §203 StGB. Receives receipts, payslips and annual accounts from clients who will not install anything, and sends back drafts that must not end up in a forwarded email. Needs upload links, shares with expiry and passwords, a record of who downloaded what, and a provider that cannot read the files it stores.
- **The Agency Producer** (v1.0): Producer at a 30-person video and design agency in Cologne that sends cuts, layouts and raw footage to customers every day and collects their feedback. Wants review links that play in the browser, comments on the file, transfers of 100 GB that do not stall, freelancers added for one project and removed after it, connections to Slack and the project tool, and a storage bill that does not jump when one shoot fills a terabyte.
- **The Skeptic** (v1.0): Has seen "end-to-end encrypted" on a service that switches it off for shared folders, "hosted in Germany" on storage whose accounts and support run from the US, and "lifetime" plans from a company two years old. Reads that a product is "GDPR-compliant" and asks who holds the keys, whether ten years of folders, versions and shares can be exported in a form another provider imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Additional standards: ISO 27001 · NIS2 · GDPR · DORA · HIPAA [S4]
- Art21 objection: yes [S10]
- CCPA: yes [S5]
- CCPA: California residents' personal data · yes [S6]
- CCPA: yes [S18]
- CCPA supported: yes [S20]
- Certifications: yes · yes [S17]
- Cjis: US law enforcement, criminal justice information · yes [S6]
- Cjis supported: yes [S20]
- Continuous monitoring: yes [S20]
- Dora: EU financial sector, ICT services · yes [S6]
- Dora supported: yes [S20]
- DPA: Business Subscription subject to EU Data Protection Laws · yes [S11]
- DSGVO supported: yes [S20]
- E2e visibility limit: no [S11]
- Finra: US broker-dealers, securities industry · yes [S6]
- Finra supported: yes [S20]
- Frameworks listed: DORA · NIS2 · FINRA · ITAR · DSGVO · HIPAA · CCPA · ISO · TISAX · CJIS [S20]
- GDPR: EU personal data · yes [S6]
- GDPR: yes [S19]
- GDPR claim: yes [S15]
- GDPR DPA: GDPR support; keys stored client-side [S5]
- GDPR DPA: yes [S18]
- GDPR swiss: Swiss data protection laws · GDPR [S10]
- HIPAA: yes · yes [S5]
- HIPAA: US healthcare, PHI · yes [S6]
- HIPAA: yes [S11]
- HIPAA: yes · yes [S18]
- HIPAA supported: yes [S20]
- ISO 27001: TÜV Rheinland · ISO 27001:2022 · yes [S5]
- ISO 27001: ISO 27001:2022 [S10]
- ISO 27001 nis2: ISO 27001 · NIS2 [S4]
- ISO 27001: ISO 27001 · yes [S6]
- ISO 27001: yes [S19]
- ISO 27001: TÜV Rheinland · ISO 27001:2022 · yes [S18]
- ISO supported: ISO 27001 · yes [S20]
- Itar: US defense export control · yes [S6]
- Itar supported: yes [S20]
- Nis2: EU essential/important entities · yes [S6]
- Nis2: yes [S19]
- Nis2 supported: yes [S20]
- No data scanning: no [S1]
- Privacy by design: Privacy and security embedded in development process from design to deployment [S20]
- Swiss data protection: Data managed under Swiss data protection law [S18]
- Swiss privacy laws: data handled under Swiss privacy laws [S5]
- TISAX: European automotive industry · yes [S6]
- TISAX supported: yes [S20]

**Data**
- Customer ownership: yes [S11]
- Retention encrypted content: 90 · 60 [S10]

**Hosting**
- Adequacy: Hungary · Germany · yes [S10]
- Data residency: flexible data residency options available [S8]
- Data residency: yes · per user [S18]
- Data residency selection: yes [S11]
- Offices: Switzerland · Germany · Hungary [S8]
- Region options: EU · Switzerland · UK · US · other countries [S4]
- Residency: EU · Switzerland [S4]
- Residency: EEA · Switzerland · yes [S10]
- Residency options: EU-only or 12 global locations; EU, US or Switzerland storage [S1]
- Residency options: EU · Switzerland · UK · USA · others [S19]
- Subprocessor regions: EEA · United States · other countries and territories [S11]
- Worldwide options: EU · Switzerland · worldwide options [S4]

**Integrations**
- Active directory: Active Directory integration for user sync [S5]
- Active directory: Active-Directory-Integration · yes [S18]
- Azure ad: Azure AD SSO · Azure AD SCIM [S4]
- Existing cloud storage: works alongside existing cloud storage [S2]
- Microsoft365 outlook: Microsoft 365 · Outlook [S4]
- Microsoft 365: Microsoft 365 · Outlook · Azure AD SSO · Azure AD SCIM · Microsoft Sentinel SIEM [S19]
- Microsoft sentinel: SIEM visibility into file activity and security events · Microsoft Sentinel [S4]
- Open source list: https://tresorit.com/third-party-code [S11]
- Outlook addon: Tresorit Outlook Add-on · yes [S18]
- Outlook gmail: yes · :Microsoft Outlook · :Gmail · yes [S2]
- Outlook plugin: Outlook plugin for encrypted secure links [S5]
- SSO: Azure AD · Okta [S5]
- SSO: Azure AD · Okta [S18]

**Legal**
- Cco: Oliver Jaeger · 2025-10 · CCO [S8]
- Chro: Gabriella Nyíri · 2020 · CHRO [S8]
- Controller: Pfingstweidstrasse 60b., 8005 Zurich, Switzerland · Switzerland · Tresorit AG · CHE-349.825.210 · controller [S10]
- Copyright: Copyright © 2026 Tresorit [S9]
- Cpo: Stéphane Croisier · 2023 · CPO [S8]
- Dispute resolution: ICDR arbitration · Zurich, Switzerland · English [S12]
- DPA: yes · 7 January 2025 [S9]
- Entity: Tresorit AG · Pfingstweidstrasse 60b, CH-8005 Zurich, Switzerland [S11]
- EU representative: Soroksári út 30-34., 1095 Budapest, Hungary · Tresorit Kft. [S10]
- Founded year: 2011 [S8]
- Governing law: Switzerland [S12]
- Job applicant privacy notice: yes [S9]
- Languages: English · German [S8]
- Liability cap: fees paid in past six months of the service [S11]
- Minimum age: 18 [S11]
- Ownership: Swiss Post [S8]
- Policy update notice: 30 [S10]
- Privacy policy: yes [S9]
- Swiss post digital: Tresorit is part of Swiss Post's digital business services (Swiss Post Digital) [S8]
- Terms last updated: Acceptable Use Policy last updated 19 April 2024 [S9]
- Terms of service: Terms of Service [S9]
- Terms version date: 29/10/2026 [S11]
- Whistleblowing: yes [S8]

**Pricing**
- Auto renewal: yes · yes [S11]
- Business: FileSharing Business · 3 · 12 [S15]
- Business pro: Business Pro · 20 [S7]
- Business pro storage: 5 · 15 · 20 [S7]
- Business storage: 3 · 6 · 15 [S7]
- Enterprise: FileSharing Enterprise · annually · custom · 50 [S15]
- Free tier: yes · yes [S11]
- Monthly to annual switch: no · yes [S11]
- No refund on downgrade: no [S11]
- Plans listed: SecureCloud for Businesses · SecureCloud for Private Use · Engage · FileSharing · eSign add-on · Basic [S1]
- Price change notice: 30 [S11]
- Professional storage: 1 · 4 · 10 [S7]
- Taxes: yes [S11]
- Trial: free trial of FileSharing [S2]
- Trial conversion: yes · yes [S11]
- Trial liability cap: 100 [S11]
- Yearly discount: yearly · 20 [S15]

**Product**
- 2FA: yes [S7]
- Access monitoring: monitor who accesses files, when, and how [S2]
- Access revocation: yes [S17]
- Account conversion irreversibility: yes [S11]
- Admin controls: admin sharing policies, brand customization of encrypted emails, and reporting [S2]
- Admin policies and reports: yes [S16]
- Admin workload reduction: 90 [S4]
- Administrator access control: yes [S11]
- AI assist: coming soon · yes · no · yes [S3]
- AI credential exposure: yes [S11]
- Audit logs: yes · yes [S19]
- Audit logs admin console: Full governance and audit logs from a single admin console [S4]
- Audit reports: yes [S18]
- Auto delete shared files: yes [S16]
- Auto deletion: 90 [S15]
- Auto deletion policy: auto-deletion of shared files when link is revoked or expires [S2]
- Backup services: cloud storage sync and share · no [S11]
- Beta services: yes [S11]
- Bring your own azure: Bring Your Own Azure Storage lets customers store encrypted content in their own Azure storage account [S12]
- Business admin visibility: email · activity [S10]
- Business features: Data residency options, Custom Admin Policies, Single Sign-On, Subscription Co-Admin, Domain Verification [S7]
- Business pro features: User level data residency options, Dynamic Watermarks, Advanced link tracking & document analytics, Auto-deletion policy, Subscription Co-Owner, Custom Domain, AzureAD & Okta provisioning, Active Directory, SIEM Sentinel [S7]
- Call recording: yes [S10]
- Client integrity protection: HMAC or AEAD cryptographic authentication on encrypted file content [S18]
- Client side encryption: yes [S11]
- Cloud files in file manager: cloud files accessible from local file manager [S13]
- Comments engage: commenting on Engage Pages · yes · yes [S3]
- Connected AI services: connection functionality only · yes [S11]
- Cryptography: public key cryptography; RSA-4096 with OAEP padding, PKI certificates, tree of symmetric keys [S5]
- Cryptography details: RSA-4096 with OAEP-Padding (RFC 2437), plus tree of symmetric keys [S18]
- Custom subdomain processing: Data shared via Custom Subdomain may be partially processed outside normal residency terms [S12]
- Customer count: 11,000+ [S1]
- Customer count: 11000+ [S2]
- Customer count: 11000+ [S4]
- Customer count: 11000 [S19]
- Customer residency compliance responsibility: Customer is solely responsible for legal compliance including data residency obligations [S12]
- Data residency option: yes [S9]
- Data residency option: Customer may select a major geographic area for data storage in qualifying Service Plans [S12]
- Data residency options: per user · yes [S5]
- Data rooms trial: yes [S7]
- Deletion: yes [S17]
- Deployment one day: 1 [S4]
- Deployment speed: SSO, SCIM, and Sentinel integrations enable setup in a single day [S4]
- Deployment time: days · 1 [S19]
- Desktop platforms: Windows · Mac · Linux [S13]
- Device monitoring: admins monitor allowed devices and login locations [S5]
- Device tracking: yes [S18]
- Document scanning: yes [S13]
- E2e encryption: zero-knowledge end-to-end encryption of files on device before upload [S1]
- E2e encryption: zero-knowledge end-to-end encryption of files and metadata with unique random keys [S5]
- E2e encryption: Client-side end-to-end encryption protects files from send until recipient opens them [S16]
- E2e encryption: yes [S18]

**Subprocessors**
- List available: yes [S10]
- List URL: https://support.tresorit.com/hc/en-us/articles/216114397-Third-party-services [S11]

**Support**
- AI enabled support: automated or AI-enabled tools · self-service resources · personnel [S11]
- Demo videos: yes [S4]
- Knowledge base: Knowledge Base · Resource Hub · Blog · Service Status · Download [S1]
- Knowledge base: Knowledge Base listed under Help [S6]
- Knowledge base: Knowledge Base · Resource Hub · Blog · Service Status · Download [S8]
- No guaranteed SLA: no [S11]
- Service status: Service Status page listed under Help [S6]

107 more facts on the canonical page: https://whats-best.ai/software/cloud-storage/tresorit

## Questions

### Is Tresorit European?

Yes, though not from the EU. whats-best.ai classifies Tresorit as UK / wider Europe.

### Where does Tresorit store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Tresorit have a free plan?

Yes. Tresorit has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/13359).

### What are the best alternatives to Tresorit?

As of 1 Nov 2026, the panel rates [Nextcloud Files (Nextcloud Hub) (4/5)](https://whats-best.ai/software/cloud-storage/nextcloud-files), [Proton Drive (3/5)](https://whats-best.ai/software/cloud-storage/proton-drive) and [DRACOON (3/5)](https://whats-best.ai/software/cloud-storage/dracoon) highest among the other 13 Cloud Storage & File Sharing products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Nextcloud Files (Nextcloud Hub)](https://whats-best.ai/software/cloud-storage/nextcloud-files) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Tresorit alternatives](https://whats-best.ai/software/cloud-storage/tresorit/alternatives).

## Head-to-head

- [Tresorit vs Proton Drive](https://whats-best.ai/compare/proton-drive-vs-tresorit.md)
- [Tresorit vs Dropbox](https://whats-best.ai/compare/dropbox-vs-tresorit.md)

## What this page leaves out

- 46 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 12 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://tresorit.com/ (checked 2026-11-01)
- [S2] Features page (secure file sharing): https://tresorit.com/product/secure-file-sharing (checked 2026-11-01)
- [S3] Features page (new features): https://tresorit.com/new-features (checked 2026-11-01)
- [S4] Features page (administration for IT teams): https://tresorit.com/it-teams (checked 2026-11-01)
- [S5] Security / trust page: https://tresorit.com/security (checked 2026-11-01)
- [S6] Security / trust page (compliance): https://tresorit.com/compliance (checked 2026-11-01)
- [S7] Pricing page: https://tresorit.com/pricing/business (checked 2026-11-01)
- [S8] Company page: https://tresorit.com/about-us (checked 2026-11-01)
- [S9] Legal notice (legal documents): https://tresorit.com/legal (checked 2026-11-01)
- [S10] Privacy policy: https://tresorit.com/legal/privacy-policy (checked 2026-11-01)
- [S11] Terms of service: https://tresorit.com/terms-of-use (checked 2026-11-01)
- [S12] Terms of service (data residency option): https://tresorit.com/legal/data-residency-option-specific-terms (checked 2026-11-01)
- [S13] Sync, clients & file access — found from sitemap: https://tresorit.com/download (checked 2026-11-01)
- [S14] Sync, clients & file access — found from sitemap: https://tresorit.com/features/tresorit-drive (checked 2026-11-01)
- [S15] Sharing & external collaboration — found from sitemap: https://tresorit.com/pricing/file-sharing (checked 2026-11-01)
- [S16] Sharing & external collaboration — found from sitemap: https://tresorit.com/de/product/secure-file-sharing (checked 2026-11-01)
- [S17] Encryption, key custody & recovery — found from sitemap: https://tresorit.com/features/zero-knowledge-encryption (checked 2026-11-01)
- [S18] Encryption, key custody & recovery — found from sitemap: https://tresorit.com/de/cloud-sicherheit (checked 2026-11-01)
- [S19] Administration, audit & governance — found from sitemap: https://tresorit.com/de/it-teams (checked 2026-11-01)
- [S20] Administration, audit & governance — found from sitemap: https://tresorit.com/de/compliance (checked 2026-11-01)

---

Cite as: whats-best.ai, "Tresorit — Cloud Storage & File Sharing", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/cloud-storage/tresorit

Corrections: https://whats-best.ai/correct/1217?target=page