Who Can See Your Files?

Technically, yes. Google holds the encryption keys to files stored on Google Drive, which means Google's systems can access file contents. Google states it does not use Drive content for ad targeting, but its systems do scan files for policy violations and child safety purposes. Google can also be compelled by valid court orders to provide file contents to law enforcement. Google publishes a Transparency Report showing tens of thousands of government data requests per year globally.

By default, yes. Apple holds the encryption keys to standard iCloud backups and iCloud Drive content, meaning Apple can technically access your files. Apple offers Advanced Data Protection — an opt-in feature that gives you control of your own encryption keys — but it must be manually enabled in your iPhone settings (Settings → your name → iCloud → Advanced Data Protection). With Advanced Data Protection turned on, Apple states it cannot access your file contents even with a legal order.

Dropbox encrypts your files but holds the encryption keys itself. This means Dropbox can technically access your file contents, and law enforcement can request your files through valid legal process. Dropbox does not offer zero-knowledge encryption on its standard plans. For confidential work documents, this means your files are encrypted in transit and at rest but are not private from Dropbox or from governments with legal jurisdiction.

End-to-end encryption means your files are encrypted on your device before being uploaded, using a key that only you hold. The provider stores only encrypted data it cannot read. Even if the provider is hacked, subpoenaed, or compelled by a government, it cannot produce your readable file contents because it never had access to your encryption key. This is different from standard encryption, where the provider holds the keys and can decrypt your data.

For personal users, the most private options are those that use client-side or end-to-end encryption where the user holds the encryption keys. Apple iCloud with Advanced Data Protection enabled offers this. StorX uses client-side encryption on all plans by default, meaning the provider never holds your keys. Standard Google Drive, Dropbox, and OneDrive use provider-held encryption keys, which means the provider can technically access your files.

In most countries, yes — with a valid legal order. Cloud providers based in the US are subject to the CLOUD Act, which allows US law enforcement to request data from US-based companies even when data is stored internationally. Providers like Google, Apple, Dropbox, and Microsoft publish transparency reports showing thousands of government data requests per year. They generally comply with valid requests. Providers that use client-side encryption where the user holds the keys can only provide encrypted, unreadable data — but metadata may still be accessible.