What Dropbox is built for — and what it isn't
Dropbox is built for collaboration and convenience. Files sync across devices, share with a link, and integrate with productivity tools. For many use cases, this is exactly the right tradeoff.
For sensitive documents — legal files, financial records, client data subject to confidentiality obligations — the tradeoff fails in a specific and consistent way: the platform has access to your files.
The provider-side access problem
Dropbox operates on server-side encryption. Your files are encrypted at rest and in transit, but Dropbox holds the encryption keys. This means Dropbox can, in principle, access your file contents.
This is not a theoretical vulnerability. It is how the product is architected.
For files subject to professional confidentiality obligations — attorney-client privilege, accountant-client privilege, HIPAA, GDPR — provider-side key access is not a governance gap that can be papered over with a data processing agreement. It is a structural conflict between the platform model and the compliance requirement.
Dropbox does offer Business plans with enhanced controls, and since 2024 its Advanced and Enterprise tiers include one genuine exception — encrypted team folders, where content in an admin-designated folder is encrypted on a member's device before upload and Dropbox states it cannot access it. That exception does not cover metadata, does not apply outside folders explicitly marked encrypted, and is not available on Standard or any consumer plan — so it does not change the default for an account, only for the specific folders a team sets up that way. See is Dropbox encrypted for the detail.
The link sharing model
Dropbox link sharing is designed for ease of access. A generated link is accessible to anyone who has it. Password protection is available on paid plans, but the password is verified server-side — which means Dropbox can see both the content and the access credential.
Links in Dropbox can be set to expire, but this is not default behavior. Many shared links in Dropbox are effectively permanent: once created, they remain active until explicitly deleted.
For document delivery to clients, partners, or external counterparties, this creates a pattern of indefinite access grants that accumulate over time. A link created for a due diligence package two years ago is, by default, still active today.
What a genuine alternative requires
A genuine Dropbox alternative for sensitive files requires a different architecture, not just different pricing.
Client-side encryption. Files must be encrypted on the originating device before upload. The platform should have no access to file contents or keys. A platform breach should produce only unreadable ciphertext.
Per-document link controls. Every shared link should carry default expiry, download limits, and immediate revocation capability — and these should be defaults, not optional settings users must remember to configure.
No provider key access. The platform should be technically incapable of reading file contents. This is a verifiable architectural property, not a policy commitment.
Audit trail. Every file access should produce a timestamped log accessible to the file owner. This is what allows incident response within hours rather than days.
Evaluating alternatives
When evaluating alternatives for sensitive document workflows, the questions that determine fitness:
- Does the vendor have access to file plaintext at any point?
- Are link expiry and download limits applied by default, or must users set them manually?
- Is revocation instant — removing access without requiring the recipient to take any action?
- Can you export a full access log for a specific file or recipient?
Most mainstream alternatives — Google Drive, OneDrive, Box — share Dropbox's architecture on the key question: the provider holds the keys. The set that does not is smaller, and how the major zero-knowledge providers compare runs them through the same questions.
Migration approach
Migrating from Dropbox to a zero-knowledge alternative does not require migrating all files. The practical approach is to identify the file categories where provider-side access creates genuine compliance or confidentiality exposure and migrate those workflows first.
For most professional services firms, this means: client tax documents, legal correspondence, financial statements, and any file subject to a regulatory retention requirement.
Once the high-risk workflows are running on a zero-knowledge platform, the decision about what remains in Dropbox is a risk-tiering decision, not a binary one.
ShieldFive vs Dropbox at a glance
| Capability | Dropbox | ShieldFive |
|---|---|---|
| Zero-knowledge by default | No — server-side encryption, Dropbox holds keys | Client-side encryption; client-code trust |
| Post-quantum on stored files | Not described in public materials | Hybrid default on web and Android, AES-GCM fallback |
| Per-file encryption keys | No | Yes — per-file keys |
| Link expiry and revocation | Available on paid plans, off by default | Default expiry plus instant revocation |
| EU data residency | US-headquartered; EU storage region option on business tiers | Yes — EU storage and EU jurisdiction by default |
| Owner-readable file access log | Available on Business/admin tiers | Not yet — share access is recorded server-side, but there is no access log you can view or export |
Comparison reflects each vendor's public documentation as of 2026-06-25 and is updated as products change.
Where Dropbox is ahead, honestly
A fair comparison runs both ways. There are real reasons Dropbox is the right pick for many teams today.
Ecosystem and integrations. Dropbox connects to a very large catalogue of third-party tools — productivity suites, e-signature, project management — and ships official integrations and an API that a newer product cannot match in breadth. If your workflow depends on those connectors, Dropbox is ahead.
Maturity. Dropbox has shipped since 2007, at very large scale, with the operational track record that comes from that. For raw reliability at scale and feature completeness, it is a known quantity.
Collaboration features. Real-time co-editing, comments, Paper, shared team spaces, and granular admin controls are mature in Dropbox. A focused encrypted-storage product covers sharing and access control, not a full collaboration suite.
App breadth and platform coverage. Native desktop and mobile apps, deep OS integration, offline sync, and selective sync are long-established in Dropbox across every major platform.
Free-tier ubiquity and familiarity. Most clients and counterparties already have Dropbox installed and know how it works, which removes onboarding friction when you share a link. That familiarity is a genuine advantage.
If your priority is breadth of integrations and mature collaboration over zero-knowledge-by-default, Dropbox is a reasonable choice, and it would be wrong to imply otherwise.
Which one fits you
Dropbox fits you if your work is collaboration-first, you rely on its integration ecosystem and collaboration features, and your files do not carry confidentiality obligations that conflict with provider-side key access.
Consider ShieldFive if its workflow, EU ciphertext storage and client-code trust model fit your requirements. It has no completed external security audit. ShieldFive encrypts files on the device, and the password never reaches its servers: the browser sends only an Argon2id-derived login value. The key that opens the vault is derived separately and stays on the device, but the web app code is delivered by ShieldFive, so the client served on each visit remains part of the trust boundary. This is not an absolute provider-cannot-decrypt guarantee.
Try it
Start with disposable files: upload, open, export, share with expiry and revoke. Retain independent backups and confirm that the trust model and client-specific formats fit your requirements before moving sensitive data. See current plans and the security explanation.
This comparison reflects each vendor's public documentation as of 2026-06-25 and will be updated as the products change.