Proton Drive (Switzerland, Geneva, EU-owned, EU-hosted, zero-knowledge E2E, CLOUD Act exposure: None) and Tresorit (Switzerland, Zurich, Swiss-Post-owned, zero-knowledge E2E, CLOUD Act exposure: Material via its sub-processor chain, while file contents stay end-to-end encrypted) are the strongest European alternatives to Dropbox. For cost-competitive Swiss hosting without the E2E premium, kDrive by Infomaniak (Switzerland, Geneva, EU-owned, EU-hosted, CLOUD Act exposure: None) is the leading SMB choice. Most of the alternatives mapped here are EU/EEA- or Swiss-owned and European-hosted; each listing shows its verified exposure level.
ALTERNATIVES
17
CLOUD-ACT · NONE
11
WITH BSI C5
0
FREE TIER
9
DISCLOSURESome links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.
TOP PICKS
Which are the closest Dropbox alternatives?
Ordered by feature parity and migration friction, which is weighted higher than feature breadth.
Slovenian cloud storage (Koofr d.o.o., est. 2013), German ISO 27001 data centres, optional client-side encryption via the open-source Koofr Vault, 10 GB free.
DE
Germany
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
German-operated (LC by vBoxx GmbH, Frankfurt) Leitz-branded business cloud on its own German data centres (Frankfurt + Mannheim), ISO 27001 (TÜV Nord), AVV available on request.
FRANKFURT · DE
Germany
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Norwegian cloud storage & backup (Jotta Group AS, est. 2008), 100% Norway-hosted on renewable power, server-side AES-256, public DPA, no CLOUD Act reach.
NO
Norway
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Norwegian-run virtual project drive (Archi Systems AS, EEA) for large CAD/BIM/point-cloud files, hosted on EU-owned OVHcloud in France with single-writer file locking and immutable versions.
PARIS · FR
France
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedThis listingEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Dropbox is the default cloud-storage tool for a generation of small businesses and creative teams, but it remains a US-incorporated product (Dropbox, Inc., listed on NASDAQ as DBX) running on US cloud infrastructure, with sub-processors that fall under CLOUD Act jurisdiction. This page maps nine European alternatives against it, checking who legally owns each company, where the data physically sits, whether files are end-to-end encrypted, and whether the platform holds a recognised European compliance framework (ISO 27001, BSI C5, EUCS, SecNumCloud): the profile a German procurement team needs for a Schrems II transfer impact assessment, or that a European agency needs before trusting a vendor with client deliverables.
What happens to your files once they leave Dropbox depends on which of these you pick first. Proton Drive is the strongest privacy-first option from the Proton ecosystem (Switzerland, Geneva, EU-owned, EU-hosted, CLOUD Act exposure: None), Tresorit is the enterprise standard for European cloud storage with zero-knowledge end-to-end encryption (Switzerland, Zurich, EU-owned, EU-hosted, CLOUD Act exposure: Material via its sub-processor chain, while file contents stay end-to-end encrypted), and kDrive by Infomaniak is the most cost-competitive Swiss-hosted choice for SMBs that want strong compliance without the price premium (Switzerland, Geneva, EU-owned, EU-hosted, CLOUD Act exposure: None).
What you keep, what you give up
What do you keep, and what do you trade off?
So what actually carries over from a Dropbox account?
File sync across Mac, Windows, Linux, iOS, Android (every alternative has native clients).
Shared folders with role-based permissions.
Public share links with optional password protection and expiration dates.
File version history (typically 30–180 days depending on tier).
Office-document integration: Tresorit, kDrive, Nextcloud all integrate with OnlyOffice or Collabora.
Mobile camera uploads (Proton Drive, kDrive, Nextcloud all support automatic photo backup).
Not everything makes the trip, though:
Dropbox Paper for collaborative documents. Replaced by OnlyOffice (paired with most of the European alternatives) or CryptPad for E2E.
Dropbox Showcase for pitching files. No direct equivalent; most teams replace this with a one-page website or a simple landing-page tool.
Dropbox's AI features (Dash, Sign integration with US-hosted signing). European alternatives ship without these by default, since they would defeat the data-sovereignty argument. kDrive ships its own document signing.
The Dropbox file-request links. Most European alternatives have an equivalent ("public upload folder"), but the UX is a step less polished.
Migration tips
How do you migrate from Dropbox?
Moving a live workspace off Dropbox comes down to six steps, roughly in this order, whichever European vendor you land on.
Plan the bandwidth window. Dropbox-to-European migrations are bandwidth-bound. For a 1 TB workspace on a 100 Mbit/s upload link, plan for 24+ hours of upload time. Run the bulk migration over a weekend or use a desktop sync client to do an offline transfer during business hours.
Export your Dropbox file tree to a local staging area first. Use the Dropbox desktop client with selective sync to pull the full file tree to a local drive. This becomes your canonical staging copy. From the staging copy, upload to the new vendor. Uploading from the source rather than syncing client-to-client gives better resume behaviour if the connection drops.
Re-share folders after migration, do not try to preserve share links. Dropbox share-link URLs cannot be ported. Plan to reissue share links for active client folders, and send each client a notification email with the new link. Most teams discover during this step that 60–70% of their old share links were dead anyway.
Set up the new desktop sync client on every team member's machine before the cutover.Tresorit, kDrive, Nextcloud, and Proton Drive all have desktop sync clients that mirror Dropbox's UX. Install in advance, get team members logged in, and verify that the sync folder shows the new vendor's tree. Then on cutover day, the only step is to remove the Dropbox sync client.
Handle Dropbox Paper and Showcase content separately. Paper documents export as .docx and need to be uploaded to your new collaborative-document tool. Showcase pages export as PDFs only; copy the source-folder structure for any active showcases.
Keep Dropbox paused, not cancelled, for 60 days. File-sync accounts accumulate silent dependents: a client still emailing files to the Dropbox folder, a Zapier integration that auto-saves attachments, a Slack share-to-Dropbox bot you forgot existed. Pause the workspace and keep paying the lowest tier for 60 days rather than cancel outright.
Picking the right one
Which Dropbox alternative should you pick?
Skip straight to a shortlist based on your situation:
You are a privacy-first individual or solo founder and want zero-knowledge encryption with a clean UX. Start with Proton Drive (Switzerland, Geneva, EU-owned, EU-hosted, CLOUD Act exposure: None, zero-knowledge E2E). Integrated with the Proton ecosystem (Mail, Calendar, VPN, Pass) if you use any of those. Best fit for journalists, legal practitioners, and anyone whose threat model includes legal compulsion of the cloud provider.
You are a DACH SMB with a procurement reviewer evaluating every new SaaS vendor. Start with kDrive (Switzerland, Geneva, EU-owned, EU-hosted, CLOUD Act exposure: None) or luckycloud (Germany, Berlin, EU-owned, EU-hosted, CLOUD Act exposure: None). kDrive has stronger pricing and broader product surface (including Sign, Meet, Mail bundle); luckycloud is the simpler German-hosted option with strong DPA detail.
You are an enterprise with team-folder permissions, SSO, and zero-knowledge encryption all on the contract. Start with Tresorit (Switzerland, Zurich, EU-owned, EU-hosted, zero-knowledge E2E, CLOUD Act exposure: Material via its sub-processor chain, with file contents end-to-end encrypted regardless) or Nextcloud (Germany, Stuttgart, EU-owned, EU-hosted, CLOUD Act exposure: None, self-hostable). Tresorit is the packaged enterprise SaaS path; Nextcloud is the open-source self-hosted path with the most flexibility and the lowest cost per seat at scale.
You are a creative agency moving large media files (video, raw photo, design assets) for client delivery. Start with kDrive or pCloud (Switzerland, Luxembourg-hosted, EU-owned, EU-hosted, CLOUD Act exposure: Minor, no default E2E). Both ship clients with selective sync and lifetime-plan options that work for project-archive use cases. kDrive has stronger integrated office tooling; pCloud has the lifetime-plan pricing if you want to amortise storage cost.
Which one fits comes down to a single binding constraint, whether that's end-to-end encryption, price per TB, enterprise SSO depth, or media-file workflow: use the side-by-side table above to sort by whichever of the four decides it for you.
Prefer a provider in a specific jurisdiction? See our verified shortlists of German cloud providers and French cloud providers, each compared on hosting region and CLOUD Act exposure.
FAQ
Frequently asked questions
Is Dropbox usable under GDPR?
Dropbox publishes an EU Standard Contractual Clauses-based DPA with post-Schrems II supplementary measures, so using it from the EU is legally workable. What keeps it on procurement watchlists is the layer underneath that DPA: Dropbox, Inc. is US-incorporated and publicly listed (NASDAQ: DBX), the platform runs on US cloud infrastructure, and key sub-processors fall under CLOUD Act jurisdiction. That combination is usually the first thing a transfer impact assessment flags.
Which Dropbox alternative has the strongest compliance profile?
This is the strongest category on the site. Eight of the nine alternatives mapped here are EU or Swiss-owned, EU-hosted, and carry no material CLOUD Act exposure. Among them: Proton Drive (Switzerland, Geneva, privacy-leading, zero-knowledge), kDrive (Switzerland, Geneva), Nextcloud (Germany, Stuttgart, self-hostable open source), luckycloud (Germany, Berlin), Filen (Germany, zero-knowledge E2E), Internxt (Spain, zero-knowledge), leitzcloud (Germany), and pCloud (Switzerland, EU-hosted in Luxembourg, though without end-to-end encryption by default). Tresorit (Switzerland, Zurich, enterprise E2E, zero-knowledge) remains the enterprise encryption benchmark, but its current sub-processor chain gives it a material CLOUD Act flag (CLOUD Act exposure: Material); file contents stay end-to-end encrypted regardless.
Will my Dropbox file structure transfer?
Yes. Dropbox supports a clean file export and most European alternatives accept the same folder hierarchy on upload. The two things that need attention: shared-link URLs change (you will reissue the share links after migration), and any Dropbox-specific features like Paper documents and Showcase pages need to be exported separately. For most teams the migration is a straightforward folder-tree upload.
Do the alternatives support team folder permissions and SSO?
Yes for both, on the business/enterprise tiers. Tresorit, kDrive, Nextcloud, and leitzcloud all support team folder permissions with role-based access and SSO (SAML 2.0, OIDC). Proton Drive's team features are newer but cover the same ground for typical SMB use. For SSO with Active Directory specifically, Nextcloud has the deepest integration.
What about end-to-end encryption?
Three alternatives mapped here ship with end-to-end encryption by default: Tresorit (zero-knowledge for the file content and metadata), Proton Drive (zero-knowledge for content and most metadata), and Filen (zero-knowledge end-to-end). Internxt is also zero-knowledge by design. For teams where E2E is a compliance requirement (legal, healthcare, government), these are the four to evaluate first.
Does Dropbox fall under the US CLOUD Act?
Yes. Dropbox, Inc. is a US-incorporated public company (NASDAQ: DBX), and the consolidated group falls within the reach of the US CLOUD Act regardless of where EU customer data is stored. For a Schrems II transfer impact assessment, this is the core question. The alternatives on this page with no material CLOUD Act exposure (Proton Drive, kDrive, Nextcloud, luckycloud, Filen, Internxt, leitzcloud, pCloud) are not US-incorporated, which removes direct CLOUD Act exposure. Tresorit is likewise not US-incorporated, but its current sub-processor chain carries a material CLOUD Act flag (CLOUD Act exposure: Material), even though file contents stay end-to-end encrypted. These classifications track incorporation and ownership as publicly disclosed, not how well any given vendor encrypts your files.
Is there a GDPR-compliant alternative to Dropbox with end-to-end encryption?
Yes. Tresorit, Proton Drive, Filen, and Internxt all offer zero-knowledge end-to-end encryption by default, meaning the vendor cannot read your file content even in response to a legal request. All four publish GDPR-compliant data processing agreements and are EU or Swiss-owned and EU-hosted. Proton Drive, Filen, and Internxt carry no material CLOUD Act exposure; Tresorit carries a material flag via its current sub-processor chain (CLOUD Act exposure: Material), though zero-knowledge encryption means file contents stay unreadable to the vendor either way. For organisations with the strictest data-confidentiality requirements (legal, healthcare, public sector), these four are the recommended starting point.
What is the cheapest European alternative to Dropbox?
Proton Drive and Filen both offer generous free tiers with end-to-end encryption. Filen is particularly competitive on paid storage pricing. kDrive by Infomaniak offers competitive monthly pricing for SMBs with a broader product bundle (Drive, Mail, Meet, Sign). For self-hosted deployments, Nextcloud eliminates per-seat cost entirely if you run your own infrastructure. It is the lowest-cost-per-TB option at scale. Confirm current pricing on each vendor's page as rates change frequently.
Can a European cloud-storage tool still sync with my existing desktop and mobile apps?
Yes. Every alternative mapped on this page ships native desktop sync clients for Mac, Windows, and Linux, plus mobile apps for iOS and Android. Tresorit, kDrive, Nextcloud, and Proton Drive all mirror Dropbox's folder-sync UX. The practical difference is the sync client branding and setup process; day-to-day file access works identically. For office-document co-editing, pair the storage layer with OnlyOffice or Collabora. Both integrate natively with Nextcloud and kDrive.
KEEP EXPLORING
Related European alternatives
Dropbox sits in File sharing. Compare neighbouring tools with the same hosting, ownership and CLOUD Act checks.
For every product we read the public DPA, sub-processors document, hosting region declaration, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.
Type to search products, categories, or alternative-to pages.
↩ openesc close
built locally · no analytics
Strictly necessary cookies (session, security) are always on. Analytics uses Pirsch (cookieless). With your consent, any advertising on the site can be personalised via cookies. Without consent, ads stay generic and untracked, but may still appear.
Read the privacy notice →