STRATO HiDrive
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German cloud storage (STRATO GmbH, United Internet/IONOS group), two German data centres, ISO 27001 + Trusted Cloud, optional zero-knowledge E2E.
STRATO HiDrive is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under File sharing.
Assessment notes
STRATO HiDrive is the cloud-storage product of STRATO GmbH (Berlin, founded 1997; part of the publicly listed German United Internet / IONOS group since the 2017 acquisition from Deutsche Telekom), a fully German-incorporated, German-owned vendor running two high-security data centres in Germany, ISO 27001 certified, carrying the German government 'Trusted Cloud' seal and TÜV Nord certification, with optional zero-knowledge end-to-end encryption available for €2/month on top of the default server-side AES-128, and a public DPA at strato.de/agb/avv/; EU-owned (German IONOS group), German-hosted, ISO 27001 + Trusted Cloud + TÜV Nord, no CLOUD Act exposure; the public AVV doubles as the sub-processor disclosure, and re-reading it in August 2026 confirmed that of the fourteen sub-processors it names across STRATO's whole product range, only one is US (SiteLock, LLC, for website security) and one is Singaporean (Dropsuite, for backup) — neither is attached to HiDrive storage.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About STRATO HiDrive
STRATO HiDrive is the cloud-storage and online-backup product of STRATO GmbH, one of Germany's oldest and largest web-hosting companies, founded in 1997 and headquartered in Berlin. STRATO was owned by Deutsche Telekom until 2017, when it was acquired by United Internet AG (the publicly listed German internet group behind 1&1 and IONOS), so the ownership chain is entirely German and EU: no US parent, no US private equity, no US VC.
The sovereignty posture is among the strongest in the file-sharing category. STRATO operates two high-security data centres physically located in Germany, is ISO 27001 certified, carries the German Federal Ministry for Economic Affairs "Trusted Cloud" seal, and holds TÜV Nord certification. Default encryption is server-side AES-128 with secure TLS transport; for sensitive use cases STRATO offers an optional zero-knowledge end-to-end encryption add-on for around €2/month, which moves key control to the customer. As a German company with German hosting and a German listed parent, CLOUD Act exposure is none.
Documentation is more complete than it first looks. STRATO publishes its DPA (Auftragsverarbeitungsvertrag) at strato.de/agb/avv/, and that same document, version 3.5 dated 18 March 2024 and readable without a login, is also the sub-processor list. It names fourteen sub-processors across STRATO's whole product range, of which one is US (SiteLock, LLC, for website security) and one Singaporean (Dropsuite, for backup), neither of them on the HiDrive storage path. The AVV also grants customers a 14-day objection right when a sub-processor is added or replaced. The product UI is German-first with English available.
Pricing is paid-only (free trial months, but no permanent free tier): Starter 500 GB at €6/month, Basic 1 TB at €7.50/month, Plus 2 TB at €12.50/month, Family 2 TB / 5 users at €17.50/month, and Business 1-10 TB from €20/month, with meaningful annual discounts. HiDrive supports a REST API and WebDAV access, making it usable for automated backup workflows. Best fit: German and EU SMBs and individuals who want a large, established German vendor with in-country data centres, recognised certifications, and an optional zero-knowledge layer, and who do not need a free tier.
Sub-processor map · none disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of STRATO HiDrive
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |