Encrypted Dropbox alternatives for business: an honest comparison

Start with the threat, not the feature list "Encrypted" answers nothing until you say against whom. Against a laptop thief, disk encryption suffices. Against a network attacker, TLS suffices. Against the provider, its staff, its integrations and its legal exposure, only client-side encryption changes the outcome.

Category 1 — Mainstream storage (Dropbox, Google Drive, OneDrive) Superb sync, previews, search, integrations. All of that requires the provider to be able to read your files, which is documented behaviour, not a scandal. Suitable for material whose exposure would be inconvenient; unsuitable for material whose exposure would be existential.

Category 2 — Encrypted-folder add-ons Some providers offer an optional encrypted area whose contents they cannot read, alongside a normal readable area. This is a real improvement, with two practical caveats: the protected area usually loses features, so people avoid it; and the default location remains the readable one, so protection depends on a human decision every time.

Category 3 — Self-hosted stacks Full control, and full operational responsibility: upgrades, backups, availability, key management, incident response. Teams without a dedicated operator often end up with a self-hosted system that is less secure than the SaaS it replaced, because nobody patched it.

Category 4 — Zero-knowledge workspaces The provider hosts ciphertext and cannot decrypt. Keys derive on the device, group access uses per-member sealed envelopes, and removal rotates keys. You lose provider-side content search, administrator recovery and read-access integrations; you gain an architecture where breach and compulsion both yield ciphertext.

The features businesses discover they need - Encrypted **names and structure**, not just file contents — folder trees leak strategy. - **Resumable large uploads**, or people will route around the tool. - **Protected links** with passphrase, expiry, view budget, watermark and revocation. - **Key rotation on offboarding**, which is the single most neglected control. - **An append-only audit trail** for internal review and client questionnaires. - **Chat in the same encrypted space**, so files stop travelling through a readable product first.

Migration without drama Move one team or project at a time. Mirror an existing local folder continuously so nothing depends on a big-bang cutover. Use protected links for external parties so nobody outside needs an account. Keep the old tool read-only for a quarter, then remove it — and remember to revoke its external links before you do.

The honest summary If your files would merely be embarrassing in public, mainstream storage is a rational choice. If they would end a client relationship, a case, a deal or a launch, choose an architecture where nobody outside your team holds a key — and accept the recovery discipline that comes with it.