iCloud Drive vs Filen: Encryption as a Setting or a Default
Published October 20, 2026· By Juan Martinez
iCloud Drive keeps your files from Apple only once you turn on Advanced Data Protection. Filen says it does so by default. What each one still sees, costs and lacks.
iCloud Drive vs Filen is a question most Apple owners face once they learn who holds the keys to their files. In iCloud Drive, Apple holds them by default and can decrypt your files. A setting called Advanced Data Protection moves the keys to your own devices, but you have to turn it on, and some file details, some kinds of sharing and all Pages, Numbers and Keynote collaboration stay under Apple’s keys even then. Filen says its keys come from your password and stay on your devices from the first upload.
So the question is not only “encrypted or not”. It is what Filen covers that iCloud Drive leaves open with the setting on, and what you lose by moving files out of a service that is built into every Mac, iPhone and iPad.
Filen is rated 7.0 and iCloud Drive 5.4. Filen is ahead in all five categories, with the widest gap in Encryption & Key Custody (8.0 against 4.5) and half a point in Trust & Transparency (5.0 against 4.5) and Usability & Platforms (7.0 against 6.5). The scores do not show where iCloud Drive is the more practical choice: built-in sync on Apple devices, one plan shared by a family, document editing together, and a recovery contact if you forget your password.
| iCloud Drive | Filen | |
|---|---|---|
| Rating | 5.4 | 7.0 |
| Who Holds the Keys | Depends on a setting | You hold the keys |
| End to End by Default | ❌ (only after you turn on Advanced Data Protection) | ✅ (Filen's description) |
| What the Company Can Still Read | Setting on: file type, size, dates, checksums of content and name. Off: the files too | Email, IP address, storage used, payment references, a little file-type metadata |
| If You Lose the Password | Setting off: Apple resets access. On: device passcode, recovery contact or 28-character recovery key | Only a master-key export made beforehand |
| Editing Together | Pages, Numbers and Keynote, on Apple's servers under Apple's keys | Encrypted notes only |
| Security Audit | None found | None found |
| Client Code | Closed | Open source |
| Apps | Built into macOS, iOS and iPadOS; Windows 11 app; no Android or Linux | Windows, macOS, Linux, Android, iOS, web, command line |
| Price for 2 TB | $9.99 a month (2 TB) | €89.99 a year or €8.99 a month (2 TiB) |
Want to compare every field side by side? Open the full comparison table.
Two states of iCloud Drive
Under the default, which Apple calls standard data protection, key custody sits with Apple. Your files are encrypted in transit and on Apple’s servers, and the keys are kept in hardware security modules in Apple’s data centers. Apple’s security guide says its servers can use these keys when you sign in on a new device, without anything from you. That access is how Apple restores your files after a forgotten password, and Apple’s US legal guidelines say iCloud Drive content can be handed over in response to a search warrant.
Advanced Data Protection changes this for iCloud Drive and nine other categories, including device backups, Photos and Notes. When you turn it on, your device deletes Apple’s copy of the keys and creates new ones that exist only on your trusted devices; Apple then says it cannot decrypt iCloud Drive. iCloud Mail, Contacts and Calendars stay under Apple’s keys either way.
The setting protects the content of your files, not all of their details. For iCloud Drive, Apple lists the following as kept under its own keys even with the setting on: file type, size, the dates a file was created, modified and last opened, checksums of the file content and the file name, app installer signatures and whether a file is executable. Apple’s wording does not make clear whether the file name itself stays under its keys or only the checksum of it. Apple uses the checksums to store identical files once, a method it calls convergent encryption.
The setting has conditions. You need two-factor authentication, a passcode on your devices, and every device signed in to the account updated to iOS 16.2, macOS 13.1 or later, or iCloud for Windows 14.1. The switch is on an iPhone, iPad or Mac, not in the Windows app, and managed and child accounts cannot use it. While it is on, you can sign in only on devices that meet those requirements, and iCloud.com cannot open your files until you allow web access and approve each session on one of your devices. Apple says it can no longer offer the setting to new users in the UK; for them, iCloud Drive stays under Apple’s keys.
What Filen encrypts
Filen’s apps turn your password into a master key on your device and give each file its own random key. Filen says it encrypts the file content, then the file name, size and type with your master key, and folder names the same way; its account event log too. This metadata encryption covers more than iCloud Drive does with the setting on: Filen says size, type and name are encrypted, while Apple keeps size, type and dates under its own keys. Filen’s documents do not say whether it can see when you upload or open a file, and its privacy policy says it keeps “a small amount of metadata about the file type”.
Filen calls this zero-knowledge encryption; that is Filen’s own description, not a finding by anyone outside the company. What Filen still sees is your email address, your IP address, how much storage you use and payment references from PayPal, Stripe or Coinbase.
Two weaker spots. Filen derives your master key from the password with PBKDF2 at 200,000 iterations, a key derivation method that Filen’s own whitepaper calls “not the latest, best or state of the art”, so a long, unique password matters more with Filen. And its web app loads its encryption code from Filen’s servers on every visit and keeps your keys in the browser’s local storage, so a browser user trusts Filen not to send altered code. Filen’s desktop and phone apps change only when you install an update.
If you lose the password
Here iCloud Drive offers more ways back in. Under the default, Apple can reset your access and your files come back. With Advanced Data Protection on, Apple cannot help, and account recovery depends on what you set up: the passcode of one of your devices, a recovery contact who can generate a code for you, or a 28-character recovery key. Apple asks you to set up a recovery contact or key before the setting turns on. If all of these are lost, the files are lost.
Filen has one method: exporting your master keys (“Export master keys” in the account settings) before you need them. Resetting the password without that export creates new keys that cannot open anything uploaded earlier. Filen’s two-factor login comes with its own recovery key, which restores your login if you lose the phone but does not restore access to your files. Store the exported master keys somewhere other than the Filen account itself.
Sharing and editing together
In iCloud Drive with the setting on, sharing stays end to end only when every person in the share has Advanced Data Protection on too. Under the default, shared files are not end-to-end encrypted. A link set to “anyone with the link” puts the item back under Apple’s keys even with the setting on. To set up any share, Apple receives the participants’ names and accounts and may keep a title and thumbnail of the item for a preview.
In Filen, both ways of sharing stay end-to-end encrypted. A file shared with another Filen user is encrypted with that person’s public key. A public link carries its own key after the “#” in the address, a part browsers do not send to the server, and can have a password and an expiry date. Public links need a paid plan; a free account can share only with other Filen users.
Collaborative editing is where iCloud Drive offers something Filen does not. Pages, Numbers and Keynote documents can be edited together in real time, in the apps and on iCloud.com in a desktop browser. Apple’s servers coordinate the changes, so the key of a shared document is uploaded to Apple, and the same happens when you open such a document from a shared folder; these documents are readable to Apple whatever the setting. Filen’s only shared editing is in its notes, which Filen says stay end-to-end encrypted. It has no editor for office documents and lists one only as planned.
Who has checked iCloud Drive and Filen
Neither service has a published security audit of its encryption. Apple’s statement that it cannot decrypt files under Advanced Data Protection and Filen’s description of its encryption are both the companies’ own.
Apple holds ISO/IEC 27001 and 27018 certifications that include iCloud and are renewed each year by an accredited registrar; they cover Apple’s security management, not the encryption design or code. Apple does publish a detailed description of how its iCloud keys work, a transparency report on government requests and legal guidelines that list what it can hand over. The iCloud apps and servers are closed source.
Filen publishes the code of its web, desktop, mobile and command-line apps under the AGPL-3.0 open-source licence, so anyone can read how the apps encrypt your files. The server code is not published, and Filen does not document reproducible builds, so you cannot confirm that a store app was built from that code. Filen says an external company will test it “in the future”; its roadmap puts the next audit after a backend rewrite that is itself only planned. Its technical whitepaper is from August 2021 and Filen calls it slightly outdated. It ended its public bug bounty and still reviews serious reports, with any reward at its discretion.
Neither has a known data breach. In 2014, after photos were stolen from celebrities’ iCloud accounts, Apple said the accounts were taken over through attacks on user names, passwords and security questions, not through a breach of its systems.
On telemetry, Apple says device analytics and iCloud Analytics are sent only with your consent, and both can be switched off later. Filen’s published app packages include no analytics or crash-reporting library.
Apps, sync and what stays in iCloud
On a Mac, iPhone or iPad, iCloud Drive needs no installation: it is in the Finder and the Files app, under the Apple Account you already use. On Windows, iCloud for Windows adds it to File Explorer, and the latest version needs Windows 11. There is no Android app, no Linux app, and Apple’s list of supported browsers for iCloud.com does not include Android.
Filen has to be installed everywhere, but it runs on more systems: apps for Windows, macOS, Linux, Android and iOS, a web app and a command-line tool. Its desktop sync works in five modes, including one-way backup, and can mount your storage as a network drive. The command-line tool can run a local WebDAV or S3 server for other software, and Filen is a built-in backend in rclone. The phone apps upload camera photos automatically. Filen has no file size limit and no block-level sync, so a changed file is uploaded again in full.
File versioning favours Filen: up to 100 versions of each file, kept as long as the file exists and counted toward your storage. iCloud Drive keeps earlier versions only of Pages, Numbers and Keynote documents; for other files Apple documents no version history. iCloud Drive keeps deleted files for 30 days, Filen for up to 30.
Moving your files to Filen does not move the rest of iCloud. Your iCloud storage also holds Photos, device backups and mail, and Advanced Data Protection is the setting that covers device backups and Photos end to end. Those stay where they are when you move your files.
Price for the same amount of storage
The prices are in different currencies (iCloud in US dollars, Filen in euros) and are shown as listed, not converted. Filen sells storage in GiB and TiB, about 7% and about 10% larger than a GB and a TB. Apple bills iCloud+ monthly only and lists no introductory price, so a year costs twelve monthly payments.
At 200 GB, iCloud+ costs $2.99 a month, or $35.88 a year. Filen’s Pro I costs €19.99 a year or €1.99 a month for 200 GiB. At 2 TB, iCloud+ costs $9.99 a month, or $119.88 a year, and Filen’s Pro III €89.99 a year or €8.99 a month for 2 TiB. At the small end, iCloud’s 50 GB plan costs $0.99 a month, and Filen’s smallest paid plan, Starter, costs €11.99 a year for 100 GiB. Above 2 TB, iCloud+ offers 6 TB for $29.99 and 12 TB for $59.99 a month; Filen’s next step is Pro X, 10 TiB for €399.99 a year or €39.99 a month.
Every iCloud+ plan can be shared with up to five other family members, and it includes Hide My Email, a custom email domain and iCloud Private Relay. Filen has no family plan yet, so each person needs a separate account and plan.
The free tier is 5 GB on iCloud, shared with photos, backups and mail, and 10 GiB on Filen. Filen may give no free storage to an account created through a VPN, Tor or a proxy, and deletes free accounts after 3 months without a login. Both refund a new purchase within 14 days; Filen does not refund renewals, and Apple does not refund fees after those 14 days.
Who runs each service
iCloud Drive is run by Apple Inc., a public company. Users in the US contract with Apple Inc. in California and users elsewhere with a regional Apple company, such as Apple Distribution International in Ireland, but Apple keeps the keys it can use in its US data centers. Without Advanced Data Protection, the keys to your files are therefore in the US wherever you live. Whatever the setting, Apple sees your name, address, email, phone number and payment details, and its legal guidelines say connection logs with IP addresses are kept for up to 25 days. In mainland China, iCloud is run by GCBD (AIPO Cloud (Guizhou) Technology Co. Ltd) under its own terms.
Filen is run by Filen Cloud Dienste UG, a small company in Germany, under German law. It says all its servers are its own hardware in German data centers, and that it has no outside investors and grew on sales of its earlier lifetime plans. Payments pass through PayPal, Stripe and Coinbase, which also process data in the US. Filen publishes a PGP-signed warrant canary every week; the version of 14 October 2026 states it has received no warrants, court orders or gag orders. Filen’s roadmap includes a change of legal form from UG to GmbH.
Which one to pick
Read the full Filen review if you want Filen’s encryption of your file names, sizes and types from the first upload, without a setting to remember, and you also use Android or Linux, want old versions of every file, or want WebDAV, S3 or rclone. You accept an unaudited service from a small company, no office editor and no family plan. Use a long, unique password and export your master keys on day one.
Read the full iCloud Drive review if you live on Apple devices, share storage with your family, edit Pages, Numbers or Keynote documents together, or want a recovery contact rather than a key file. Turn on Advanced Data Protection and set up a recovery contact or key first. You accept that Apple keeps file sizes, types and dates under its keys, that public links and shared editing fall back to Apple’s keys, and, if you are a new user in the UK, that the setting is not available to you.