pCloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Swiss cloud storage with customer-elected EU (Luxembourg) or US (Texas) data residency; signature lifetime plans, 24M+ users.
pCloud is a European service hosted in Luxembourg, with at most minor, transient US exposure under the CLOUD Act. It is listed under File sharing.
Assessment notes
pCloud AG (Baar, Switzerland; founded 2013 by Tunio Zafer and Anton Titov; primary operations from Sofia, Bulgaria) lets customers pick Luxembourg (EU) or Dallas, Texas (US) at signup as the data-residency region (EU customers selecting Luxembourg get full EU jurisdiction under GDPR), plus a 24M+ user base and signature lifetime plans as a subscription escape hatch; pCloud Crypto is an optional paid add-on that provides true zero-knowledge encryption (without it, files are encrypted at rest but pCloud holds the keys); Swiss-incorporated with customer-elected EU data residency, but neither a publicly accessible DPA nor any sub-processor disclosure: the privacy policy (revised 1 March 2023) names no third parties at all, referring only to generic 'payment providers' and 'advertising and analytical companies', and the GDPR page directs buyers to contact sales@ to request a DPA, making it on-request-only; zero-knowledge encryption is also not the default, requiring the paid pCloud Crypto add-on.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About pCloud
pCloud is a Swiss-incorporated cloud-storage product operated by pCloud AG (Baar, Switzerland) and founded in 2013 by Bulgarian engineers Tunio Zafer (CEO) and Anton Titov. Primary engineering and operations are based in Sofia, Bulgaria; the legal seat is Baar in canton Zug. The company reports 24M+ users across 130+ countries and has built its mainstream brand around a distinctive lifetime plan offering: one-time payments for permanent access (Premium ~€199 lifetime / 500 GB; Ultra ~€399 lifetime / 2 TB; Family Lifetime plans available), a marketing position no other directory vendor in this category matches.
For an EU-sovereignty audit the structurally interesting feature is customer-elected data residency: at signup pCloud asks each user to pick between Luxembourg (European Union) and Dallas, Texas (United States) as the data-region for that account, and files stay in the chosen region. EU customers who pick Luxembourg get a full GDPR-jurisdiction posture; US customers (and any EU customer who picks Texas) end up under US-jurisdiction with the standard CLOUD Act exposure. The Swiss legal entity layered on top with EU adequacy keeps cross-border contracting clean. Where pCloud falls short of Proton Drive, Tresorit, and Internxt is that zero-knowledge end-to-end encryption is NOT the default: files are encrypted at rest with AES-256 and in transit with TLS, but pCloud itself holds the keys unless the customer adds pCloud Crypto as a paid add-on (~€3.99/month or one-time lifetime), in which case the encryption shifts to client-side and pCloud no longer holds the keys.
Pricing in EUR: 10 GB free; Premium 500 GB ~€4.99/month (~€199 lifetime); Premium Plus 2 TB ~€9.99/month (~€399 lifetime); pCloud Crypto add-on for true zero-knowledge encryption is a separate purchase. 10-day money-back guarantee. Best fit: privacy-conscious consumers and SMBs who want a Dropbox alternative with EU data-residency option and the unique lifetime-plan economics; buyers requiring zero-knowledge encryption by default should choose Proton Drive, Tresorit, or Internxt instead.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of pCloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.pcloud.com/terms_and_conditions.html…
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |