Icedrive
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
UK/Gibraltar cloud storage (ID Cloud Services Ltd), opt-in Twofish client-side encryption, lifetime plans; UK/DE/US data centres, no region pinning.
Icedrive offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under File sharing.
Assessment notes
Icedrive is operated by ID Cloud Services Ltd, a UK micro-company (HQ Unit 12 J-Shed, Kings Road, Swansea, Wales; one source also cites a Gibraltar registration) founded in 2019 and effectively a one-person operation led by James Bressington; the product offers genuine client-side Twofish encryption but only on an opt-in dedicated encrypted folder, not the whole account, and runs a distributed storage architecture across data centres in the UK, Germany AND the USA with no customer region selection, meaning EU buyers cannot keep data out of US infrastructure; combined with UK-post-Brexit ownership, material CLOUD Act exposure, no public DPA or sub-processors list, and no certifications, the signal mix is the weakest in this category.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Icedrive
Icedrive is a consumer-and-prosumer cloud storage service operated by ID Cloud Services Ltd, a UK micro-company based in Swansea, Wales (one secondary source additionally cites a Gibraltar company registration; the discrepancy is unresolved and flagged below). Founded in 2019, it is effectively a one-person operation led by CEO James Bressington, which is unusual for a directory of procurement-grade vendors and is itself a risk signal: there is no team depth, no funding disclosed, and no public corporate filings surfaced at audit.
The product's headline differentiator is encryption. Icedrive is the only mainstream cloud storage service to use the Twofish algorithm, and it offers true zero-knowledge client-side encryption: files and even file/folder names are encrypted on the device with a 256-bit key that never reaches Icedrive's servers. The important caveat for buyers: this applies only to files placed in a dedicated encrypted folder, not to the whole account. Anything stored outside that folder is not zero-knowledge.
For an EU-sovereignty audit Icedrive is weak. Storage is distributed across data centres in the UK, Germany and the United States with N+2 redundancy, and customers cannot choose their storage region, so EU data can and does land on US infrastructure, which is material CLOUD Act exposure regardless of the client-side encryption available on the opt-in folder. There is no public DPA, no sub-processors list, and no certifications. The vendor's own site (icedrive.net) returned HTTP 403 to automated fetching at audit, so several fields rely on secondary sources.
Pricing is competitive and lifetime-friendly: a 10 GB free tier, Pro plans from ~$5.99/month for 2 TB, and one-time lifetime plans starting around $389 for 2 TB with $199/1 TB and $449/5 TB add-on "stacks"; the lifetime model is the main reason Icedrive appears on best-of lists. Best fit: privacy-curious individuals who will discipline themselves to use the encrypted folder and who value lifetime pricing over EU data residency. Procurement-grade EU buyers should prefer Koofr (SI/DE), Internxt (ES), Tresorit (CH/HU) or Proton Drive (CH), all covered elsewhere on this directory.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Icedrive
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |