Yes — Dropbox is encrypted. Files are protected in transit with TLS/SSL and stored at rest with AES-256. But encrypted does not mean private from Dropbox: for standard storage, Dropbox generates and holds the keys, so it is not zero-knowledge or end-to-end encrypted — the encryption protects your files from outside attackers and stolen hardware, not from Dropbox itself. There is one narrower exception, encrypted team folders on higher Business tiers, covered below. This page explains what Dropbox actually encrypts, where that one exception applies and what it does not cover, whether Dropbox scans or trains AI on your files, whether it can be HIPAA compliant, and a 2026 account-security disclosure worth knowing about.
What Dropbox encrypts
Dropbox applies the two standard layers. In transit, files travel over TLS/SSL and cannot be read on the wire. At rest, Dropbox's general security documentation describes files being split into blocks and each block encrypted with 256-bit AES. (Its encrypted-team-folders feature, covered below, uses a more specific documented construction — AES-256-GCM over 4 MB blocks with per-block authentication chained via HMAC-SHA-256 — which is a property of that feature, not a description of baseline storage.)
That is a real, standard encryption design, and it protects against the threats server-side encryption is built for: a stolen disk, an intercepted connection, a breach of the storage layer itself. It does not protect your files from Dropbox, because for standard storage Dropbox holds every key in that chain — there is no step where only you hold a usable key.
Can Dropbox read your files?
Yes, it is able to, for standard storage. Holding the keys means Dropbox can access file contents, and several ordinary parts of the service depend on that ability:
- Product features like previews, search, thumbnails, and shared links require reading content.
- Abuse scanning. Dropbox states it uses industry-standard hash-matching — including PhotoDNA and hash lists from NCMEC and the Internet Watch Foundation — to detect known child-exploitation material, and reports the results in a biannual Transparency Report.
- Legal requests can compel Dropbox to produce data it can decrypt. Dropbox is a US-incorporated company, so it is subject to the US CLOUD Act, which lets US law enforcement compel disclosure of data in a provider's possession or control regardless of where it is physically stored.
This is the line between encrypted and zero-knowledge. Encrypted keeps outsiders out. Zero-knowledge keeps the provider out too, because files are encrypted on your device before upload and the provider never holds a usable key. For standard Dropbox storage, that line falls on the "encrypted" side.
The exception: encrypted team folders
Dropbox does offer a genuine end-to-end encryption feature, and it is worth naming precisely rather than gesturing at it vaguely. Encrypted team folders, launched in Dropbox's Spring 2024 release, let a team designate specific folders where file content is encrypted on a member's device before upload, with only folder members holding the decryption key — Dropbox states it cannot access the content of files inside one. Dropbox's own engineering writeup of the feature documents the construction: AES-256 in Galois/Counter Mode over 4 MB blocks, a random 96-bit nonce per block, and per-block authentication tags chained together with HMAC-SHA-256 across the whole file. It is available on Dropbox Business's higher tiers (Advanced and Enterprise, under the plan names current as of 2026), not on Standard, and not on any individual or consumer plan (Basic, Plus, Family, Professional).
Two limits matter if you are relying on this feature specifically. First, it protects file content; Dropbox's own description of the feature indicates filenames, folder structure, and sharing/activity metadata remain visible to Dropbox rather than being end-to-end encrypted along with the content. Second, it applies only to folders a team admin explicitly designates as encrypted, and it disables some ordinary Dropbox features (such as sharing outside the team) inside those folders — it is not a setting that changes the default for an account or for storage outside those folders.
Does Dropbox scan or train AI on your files?
Dropbox's own AI Principles pledge not to "build generative AI models using customer content without consent." Separately, and this is the part that pledge does not cover, Dropbox's Privacy FAQ states that its own machine-learning models "may be trained on your documents and metadata," powering features like search relevance, auto-sorting, and document summaries — a non-generative training use the generative-AI pledge does not reach. For its third-party AI partner (OpenAI), Dropbox says that integration is used only when you actively engage an AI feature, and that files passed to OpenAI are deleted within 30 days and not used to train OpenAI's models. None of this depends on whether the file sits in a standard folder or an encrypted team folder from a policy standpoint — but a provider that never holds a usable key structurally cannot train on or scan file content, where a provider that holds the key is choosing not to, as a matter of policy. The fuller sourced comparison across providers, including this same Dropbox split, is at can your cloud provider train AI on your files.
Is Dropbox HIPAA compliant?
Dropbox Business and Enterprise teams can sign a Business Associate Agreement (BAA) through the admin console, which is the precondition for storing PHI under HIPAA. Consumer plans — Basic, Plus, Family, Professional — are not HIPAA-eligible; Dropbox will not execute a BAA for them. Signing a BAA does not by itself make a specific deployment compliant: sharing defaults, link expiry, two-factor enforcement, and audit-log retention still have to be configured correctly, and Dropbox's default settings are not HIPAA-aligned out of the box. The fuller requirements are covered in HIPAA compliant file sharing.
Jurisdiction and data residency
Dropbox stores data in the US by default. It offers an EU data-residency option (Germany, with backup in France) for Business plans at Standard tier and above with a minimum license count, provisioned as an individually reviewed request rather than a self-service toggle. As a US-incorporated company, Dropbox itself remains subject to the US CLOUD Act regardless of where a given data center physically sits, the same jurisdictional exposure every US-headquartered provider carries.
A 2026 disclosure worth knowing
A Lenovo ID sign-in flaw let attackers into Dropbox accounts without a Dropbox password. Dropbox disclosed on September 1, 2026 that a flaw in Lenovo's email-verification process — used for a federated "Sign in with Lenovo ID" option — let an attacker register a Lenovo ID using a victim's email address, then use that identity to sign into the matching Dropbox account without ever having the victim's Dropbox password. Unauthorized access occurred between August 4 and August 21, 2026, affecting roughly 5,000 accounts, with files viewed or downloaded in fewer than about a third of them. Victims did not need to have ever created or linked a Lenovo ID themselves to be affected. Dropbox's remediation was to sever the Lenovo–Dropbox account-linking integration and require the Dropbox password even when signing in through Lenovo going forward. This was a flaw in a third-party sign-in integration, not a break of Dropbox's file encryption itself — but it is a reminder that "who can technically reach your account" is broader than the encryption question alone.
Is Dropbox safe for confidential files?
For a lot of content, Dropbox's model is fine, and its sync and collaboration work well. The question is narrower than "is Dropbox safe" — it is "is it safe for this file."
For files where a provider being able to read the contents is itself the risk — legal case files, medical records, financial statements, journalistic sources, unreleased work — "Dropbox can technically access this" is the exact property you are trying to eliminate for anything outside an encrypted team folder on a qualifying Business plan. No amount of at-rest encryption changes that for standard storage, because the provider holds the key.
What zero-knowledge changes
A zero-knowledge tool encrypts each file on your device before upload by default, for every file and every plan, so the provider stores only ciphertext it cannot decrypt. It cannot read, scan, train on, or hand over readable contents, because it never has a key — that is a property of the architecture, not a policy choice or a plan tier.
ShieldFive encrypts files on the device and stores ciphertext in the EU. The sign-in password never reaches its servers: the browser derives a separate login value with Argon2id and sends only that, and the vault key is derived separately on the device. The web app's code is served by ShieldFive, so the client delivered on each visit stays part of the trust boundary; this is not an absolute provider-cannot-decrypt guarantee. Web uploads default to ML-KEM-1024/XChaCha20-Poly1305 with AES-GCM fallback; Android also defaults to the hybrid format, with the same AES-GCM fallback, and reads both formats. The crypto core is open source, the apps are not fully open source, and no external security audit has been completed. Proton Drive, Tresorit, and Sync.com are zero-knowledge options with different tradeoffs. If you are evaluating this specifically to move sensitive files off Dropbox, the Dropbox alternative for sensitive files guide and the best zero-knowledge cloud storage comparison compare the choices on jurisdiction, audits, and post-quantum protection.
This page reflects Dropbox's public documentation and multi-outlet press coverage as of 2026-09-12 and will be updated as the product changes.