Tresorit Review 2026: AES-256 zero-knowledge and Swiss SOC 2 jurisdiction - worth the price?

Table of contents - Tresorit essentials

TL;DR - Tresorit in 30 seconds

Final score: 4.4 / 5. Tresorit is the most credible privacy-first cloud for regulated organisations (healthcare, legal, finance) in 2026. The reasons: zero-knowledge by default, enterprise certifications (SOC 2 Type II, ISO 27001, ISO 27018, HIPAA, FIPS 140-2) and independent compliance audits.

The main snag to know is the cost. The pricing grid stays 2 to 3× above pCloud Crypto and Proton Drive, with no lifetime deal to spread the cost. In return, Tresorit is one of the few vendors to offer enterprise-grade contractual promises (SLAs, self-service HIPAA BAA) that consumer rivals don't.

Recommended if: you run or work inside an SMB / mid-market organisation. There, compliance (strict GDPR, HIPAA, SOC 2, ISO 27001) must be proven by independent certifications and signed audits. Tresorit is one of the few vendors that offer a HIPAA Business Associate Agreement (BAA) with no manual deal-making.

Not recommended if: you are one person chasing the best price/zero-knowledge ratio over 5-10 years. In that case, pCloud Crypto on lifetime or Proton Drive bundled in Proton Unlimited cost 50-70% less in total.

Why Tresorit in 2026 - the business privacy market context

The business privacy cloud market is at a turning point in 2025-2026. Three forces make Tresorit unusually relevant in 2026. For years it was seen as a niche premium player up against Dropbox Business and Microsoft OneDrive for Business.

First, full enforcement of the European Data Act (September 2025) and the ongoing review of the Cloud Service Cybersecurity Certification Scheme (EUCS). These set new duties for cloud vendors. They cover subcontractor transparency, contractual data portability, and protection against unlawful cross-border transfers. Swiss and European vendors fall under these rules directly, so they gain an edge over US Big Tech players. Those players stay exposed to the CLOUD Act and FISA section 702, even through their EU subsidiaries. Tresorit is based in Wollerau and was bought by Swiss Post Group in 2021, so it gains from this shift.

Second, business usage keeps piling up on Microsoft OneDrive and Google Workspace. This came after several accidental disclosure incidents in 2024-2025. The main one was the March 2024 OneDrive incident: files marked "internal only" were indexed by Microsoft Search by mistake when sharing was set up wrong. Legal teams and DPOs in SMBs and mid-market firms now hunt hard for alternatives that contractually promise zero-knowledge. That is exactly Tresorit's pitch, since it can prove it holds no way to decrypt.

Third, the business privacy cloud segment itself is maturing. In 2026, Tresorit faces serious rivals. Proton Drive Business launched in November 2024, bundled in Proton Business Suite at €12.99/user/mo. A few European challengers also exist: Boxcryptor (bought by Dropbox in 2022 and shut down in late 2023, with users moving to Tresorit or Cryptomator), Cryptomator (open-source, but it needs an underlying cloud) and Cryptee (boutique but capped at 25 GB free). This pressure pushes Tresorit to sharpen its pitch on the strictly regulated segment. There, its certifications justify the higher price.

Our June 2026 review lands at a moment when Tresorit has clarified where it stands. It is the benchmark business privacy cloud for firms that need SLAs, independent audits, and signable HIPAA BAAs with no custom deal. For consumer use, pCloud Crypto or Proton Drive still make more sense on cost.

How we analyze Tresorit

This review is an editorial analysis built on facts you can check: Tresorit's official docs (encryption model, jurisdiction), its certifications and compliance reports (SOC 2 Type II, ISO 27001/27018, HIPAA, FIPS 140-2), its public pricing and its transparency report. We do not publish throughput or uptime figures shown as in-house tests.

The criteria we put first for a business privacy cloud:

• Encryption model: what is truly zero-knowledge by default, including file names.
• Contractual compliance: SLA, HIPAA BAA, certifications you can use in RFPs.
• Jurisdiction: the head office AND where the servers really sit.
• Real cost: enterprise pricing vs other options, over time.

Tresorit says its service is reliable. As far as we know, no major security incident is on public record on Tresorit's side. For speed, we reason from what full client-side encryption allows. We put forward no in-house numbers.

Cryptographic architecture - the real analysis

This is where Tresorit pulls away from most all-purpose rivals. Three protection layers stack up.

Layer 1 - In transit. TLS 1.3 is required (TLS 1.2 dropped in 2024), HSTS preload, certificate pinning on the iOS and Android apps. No fallback to HTTP. SSL Labs tests: A+ grade.

Layer 2 - At rest on Tresorit servers. AES-256 in GCM mode. Servers get files that are already encrypted client-side. So Tresorit only runs an encrypted-blob storage layer and cannot read it. File names are encrypted too. (Box Encrypted or Dropbox can see names even when contents are encrypted.)

Layer 3 - Client-side zero-knowledge. The encryption key comes from your password via PBKDF2-HMAC-SHA256 (100,000+ iterations on accounts made after 2024). An RSA-4096 asymmetric key then guards it (with Curve25519 + Ed25519 now in beta on some business accounts). Tresorit stores none of these: the plaintext password, the derived key, or the master key. This is the same model Bitwarden or 1Password use for their vaults, moved to file storage.

Independent validation: independent compliance audits, with executive summaries you can get on contractual request. SOC 2 Type II audited each year. ISO 27001 and ISO 27018 (three-year renewal). FIPS 140-2 Level 1 for the underlying crypto modules. For the exact, up-to-date list of certifications, see Tresorit's compliance page, which is authoritative.

Honest technical limit: Tresorit has not announced a public post-quantum roadmap as of June 2026. Proton has: it shipped a Kyber-768 + X25519 hybrid on Proton Mail, and it is working to bring it to Drive in 2026-2027. For data that must stay private for 15-25 years (medical archives, court files, industrial secrets), this is a gap to keep in mind. For most business use today (3-7 year retention), NIST still rates AES-256 + RSA-4096 as strong through at least 2030.

Tresorit pricing 2026 - real breakdown

Four plans as of June 2026, all on mandatory annual billing (monthly billing adds 20-25%).

5-year comparative cost (1 user, ~2 TB of zero-knowledge storage) - or run your own numbers with our cloud storage cost calculator:

Pricing verdict: For one person, Tresorit Premium only competes when lifetime is off the table (pCloud lifetime jurisdiction risk), or when audit and certification access matters (rare for consumers). The real Tresorit sweet spot is Business Plus at €24/user/mo. There the compliance features (HIPAA BAA, DLP, audit logs, SAML SSO) justify the price. And there the all-purpose rivals (OneDrive for Business, Dropbox Advanced) do not offer contractual zero-knowledge.

Performance - what to expect

Real throughput depends mostly on your connection and on server load. By design, Tresorit encrypts everything client-side including file names. That is a strong privacy win. But it adds a small latency and throughput cost versus an unencrypted service like Dropbox.

What we can honestly say:

• Throughput: Tresorit sits with other consumer encrypted clouds, neither the fastest nor the slowest. Upload speed is the most common choke point on consumer fibre (rarely symmetric).
• Sync latency: a bit higher than an unencrypted service, since encryption (file names included) runs before sending. For everyday office work, you won't notice the difference.
• Teamwork: on heavily shared folders (several users editing at once), Tresorit's differential versioning helps handle conflicts.
• Cost: Tresorit costs more by design (no lifetime, annual billing). Compliance promises justify this more than raw speed.

Compliance - the real reason to buy Tresorit

This is the pillar that justifies the higher price. Four concrete points.

SOC 2 Type II audited each year (report available on contractual request for Business Plus prospects). SOC 2 Type II shows that controls worked over a 6 to 12-month window. SOC 2 Type I only shows that controls were defined at one point in time. It is the de-facto standard for B2B cloud vendors in the US, and more and more in Europe.

ISO 27001 + ISO 27018 valid 2024-2027 (three-year renewal). ISO 27018 covers the protection of personal data in cloud services. It is the standard French and German DPOs cite most often in public tenders and large-enterprise RFPs.

HIPAA Business Associate Agreement (BAA) you can sign yourself from the Business Plus admin panel. This is rare. Most rivals (including Proton Drive Business as of June 2026) need weeks of manual deal-making to deliver a BAA. For US healthcare firms (hospitals, clinics, healthcare MSPs), this is a real edge in day-to-day work.

FIPS 140-2 Level 1 for crypto modules. NIST requires this level for US federal contracts and some sector rules (defence, finance, healthcare). Tresorit says it is aiming for Level 2 on the 2026-2027 roadmap, which would open the US federal segment.

Transparency report published by Tresorit. The key point: thanks to the zero-knowledge design, Tresorit cannot hand over data in clear, even facing a legal request. Big Tech is not encrypted by default and can disclose contents. For the exact figures on requests received/executed, see the report published by Tresorit, which is authoritative.

Tresorit vs pCloud Crypto vs Proton Drive - summary table

Final verdict - who should actually buy Tresorit?

Buy Tresorit Business Plus if:

• You run, or are CIO/DPO/CISO of, an SMB/mid-market firm in a regulated sector (healthcare, legal, finance, HR consulting, payroll)
• You need to prove zero-knowledge by contract to your clients or auditors
• You need a HIPAA BAA you can sign yourself (notably US healthcare)
• You need SOC 2 Type II + ISO 27001 + ISO 27018 in your RFPs
• Your budget can take the ~€24/user/mo extra cost

Buy Tresorit Premium as one person if:

• You cannot get the Solo tier (check with support)
• You want an audited zero-knowledge service (SOC 2 / ISO) with no paid add-on to turn on (vs pCloud Crypto)
• You accept the ~€430 extra over 5 years vs pCloud Lifetime + Crypto for this peace of mind

Buy pCloud Crypto instead if:

• Personal or family use, tight budget
• You can pay €199 lifetime + €125 lifetime Crypto add-on as a one-shot
• You accept that the "Switzerland" data region is a paid yearly option

Buy Proton Drive instead if:

• You already pay for Proton Mail Plus or Unlimited
• You want the most advanced post-quantum roadmap on the market as of June 2026
• You accept a slightly less polished desktop UX than Tresorit or pCloud

Our verdict for the Priviy target audience (privacy-first business users in 2026): Tresorit Business Plus is the clear benchmark for regulated firms. But it stays too big for 80% of personal use cases. There, pCloud Crypto Lifetime or Proton Drive Unlimited give a better cost-to-protection ratio over 5 years.

Going further

• Best encrypted cloud storage services 2026 - full provider comparison - how Tresorit benchmarks across six weighted criteria against all major competitors
• Proton Drive vs Tresorit vs pCloud Crypto - the Swiss head-to-head - complete 3-way technical comparison
• pCloud Review 2026 - lifetime deal - budget alternative for personal usage
• Proton Drive Review 2026 - integrated-ecosystem alternative
• E2E vs zero-knowledge cloud storage - what the marketing hides - why Tresorit is zero-knowledge by default while standard pCloud is not
• CLOUD Act vs GDPR 2026 - why server jurisdiction matters as much as HQ jurisdiction
• Priviy editorial methodology - how we analyze cloud services (specs, certifications, public pricing)
• Priviy Wikidata Q140050544 - Knowledge Graph entity
• Tresorit transparency reports (official): https://tresorit.com/transparency-report
• ISO 27018 standard (official ISO): https://www.iso.org/standard/76559.html

Related guides

To dig deeper, see secure encrypted file sharing and encrypted cloud storage for businesses.