Your files in someone else's computer. Google scans them. Apple holds the keys for 90%. Only zero-knowledge providers can't read your documents.
6 devices analyzed. Set your privacy comfort level to filter.
What we found
Google Drive: DGoogle can read every file on your Drive.
Google holds encryption keys -- not zero-knowledge. Scans files for violations. Gemini AI caught reading PDFs (July 2024). PRISM since 2009. 150K+ govt requests H1 2023, ~80% compliance. Can provide full file contents.
iCloud: DApple sells privacy but 90% of iCloud users' data is readable by Apple.
Without ADP (<10% adoption), Apple holds keys for backups, photos, files, notes. 30K+ govt requests/year, ~82% compliance. Dropped E2E after FBI objections (Reuters 2020). iCloud Backup (default) undermines device encryption. PRISM since 2012.
Dropbox: DDropbox's AI features send your documents to OpenAI's servers, where they sit for up to 30 days.
Settings hidden. Default state varied (opt-in for some, opt-out for others). FAQ self-contradictory on OpenAI training. Documents on OpenAI servers 30 days. Amazon CTO warned users. Schneier: 'could tomorrow with a ToS change.'
OneDrive: DMicrosoft can read every file on OneDrive.
Microsoft holds keys. Not zero-knowledge. Scans for 'objectionable content.' PRISM first participant (2007). Same infrastructure: Outlook (801 ad partners), Copilot AI, Recall, DiagTrack.
How audits work in this category
Common standard: SOC 2 Type II / ISO 27001 What it covers: Verifies organisational security controls and information security management. What it misses: Does not verify end-to-end encryption claims or zero-knowledge architecture. A SOC 2 certified provider can still read your files if they hold the keys.