Sync.com

Sync.com is a cloud storage service from Toronto that encrypts files on your device before they are uploaded. It was founded in 2011 and sells three plans for individuals, with 1 TB, 5 TB and unlimited storage, plus a free plan with 5 GB.

Sync describes the service as zero-knowledge, meaning it cannot read your files. Its own terms narrow that claim: paid accounts keep a copy of the encryption key on Sync’s servers for email password reset unless you turn it off, and several features process files on Sync’s servers. A 2024 study by ETH Zurich cryptographers found that a compromised Sync server could read files uploaded after the attack and plant files in your account. The apps and the server are closed source, and no audit of the encryption is published.

Encryption & Key Custody

Sync says its desktop, mobile and web apps encrypt each file on your device with 256-bit AES before upload, and that the file name is encrypted together with the content. The metadata encryption stops there: the ETH Zurich study found that file size, file type, creation time and, in shared folders, the person who created a file are stored unencrypted, and that the server can change them.

Key custody depends on one setting. On paid plans, email-based password reset is on by default. It keeps a copy of your account encryption key on a separate Sync server, a form of key escrow, and Sync’s terms say that while it is on, the account is “not configured on a strictly zero-knowledge basis”. You can turn it off in the Privacy Center, the settings page for these features, which deletes the stored copy. On the free plan the box that turns it on is unticked at sign-up.

The same setting decides what a forgotten password costs. With email reset on, you set a new password from a link sent by email and keep your files. With it off, you can change the password only from the desktop app on a computer that is still signed in; without one, Sync’s only option is to delete the account with every file in it. That is the account recovery trade-off: the setting that protects your key from Sync also makes a lost password final.

The Privacy Center also lists features that do not work end to end: previews of Office, OpenDocument, Photoshop and other formats in the web panel, audio and video streaming, editing in Microsoft’s online editor, faster web downloads of files over 100 MB, and links without Enhanced privacy. When you use one of them, the file is processed on Sync’s servers or, for editing, passed to Microsoft. Sync’s terms say some of these features may be on by default and do not list which. PDFs, text files and common image formats are previewed inside the browser, and thumbnails are end-to-end encrypted.

Sharing stays end to end only in some cases. A shared folder hands other Sync users the folder key, encrypted with their public key. A link is end-to-end encrypted only when Enhanced privacy is switched on for it, which also turns off streaming, extended previews and editing for that link; without it, the link is encrypted in transit and Sync can process the file on its servers.

The ETH Zurich study showed what a server under an attacker’s control could do. Sync’s apps do not check that the encryption keys the server sends them are genuine, so such a server could swap in a key of its own and read every file you upload afterwards. It could also plant files and whole folders in your account that look as if you uploaded them, rename and move files, and change who appears to have shared a folder with whom. Links used to carry their password in the part of the address that reaches Sync’s servers, which exposed every file shared that way; Sync says this leak has been fixed.

The web panel decrypts files in your browser with code that Sync serves every time you open it, so in the browser you depend on Sync serving unaltered code; the desktop and mobile apps do not load their code on each visit.

Trust & Transparency

The Sync apps and server are closed source, and no security audit of the encryption or the apps is published. What Sync publishes is a SOC 3 report: the accounting firm Sensiba examined Sync’s internal security controls for 2024 and concluded that Sync’s claim that they were effective was fairly stated. Sync commissioned the report, and it describes how the company runs its systems, not whether the encryption holds up against a compromised server. The pricing page also claims SOC 2 Type 1 compliance.

The only independent review is the 2024 study by Jonas Hofmann and Kien Tuong Truong of ETH Zurich’s Applied Cryptography Group, presented at the ACM CCS conference. It tested five encrypted storage services against an attacker-controlled server and found the flaws described above in Sync. The researchers wrote to Sync on 23 April 2024 and recorded that, by 10 October 2024, Sync had not answered several attempts to reach it. Sync then told TechTarget it had learned of the issues on 11 October, that the link leak was already fixed, that fixes for the other issues were being fast-tracked, and that there was no evidence the flaws had been exploited. Sync has publicly confirmed a fix only for the link leak.

Users outside the United States contract with Sync.com Inc., registered in Ontario, and users in the US with Sync.com Corp., a Delaware company. The terms are governed by the laws of Ontario and Canada unless your own country’s law requires otherwise. Files are stored in Canada by default, in data centers Sync runs in co-located facilities; accounts in the US data region keep files in the United States. The privacy policy says Sync checks that a legal request is valid, hands over only what the law requires, and makes reasonable efforts to tell you.

Whatever the key setting, Sync sees your name, email address, billing address and phone number, IP addresses, device names, when you sign in, how much you store, and the unencrypted file details described above. The privacy policy says Sync tries to remove file names from its logs, that your actions on files may be logged, and that product analytics can be switched off in account settings, which makes the telemetry opt-out. The same policy allows advertising identifiers and cookies used to target ads, and says Sync may infer more about you from social media. There is no known data breach of Sync.

Features & Sync

The desktop sync app runs on Windows and macOS and keeps a Sync folder in step with the cloud. CloudFiles leaves files in the cloud until you open them, and Vault is cloud-only storage that does not sync to your computers. There is no Linux sync app: on Linux, Sync offers a WebDAV server that lets other tools reach your files. The mobile apps upload camera photos automatically and keep chosen folders offline.

File versioning is kept by time. Earlier versions and deleted files can be restored for 30 days on the free plan, 90 days on Personal 1TB, 180 days on Solo 5TB and 365 days on Personal Unlimited, and they do not count toward your storage. A restored version becomes the current file.

The desktop and mobile apps have no file size limit; Sync says the web panel slows down with files over 500 MB. Link passwords work on every plan, and Sync lists expiry dates, download limits, view-only links and file requests for Solo 5TB and team plans.

Collaborative editing runs through Microsoft. Edit in Office opens a Word, Excel or PowerPoint file in Microsoft’s online editor, and on Solo 5TB you can let people with a link edit it as well. Sync says this path is encrypted but not end to end, so Microsoft’s servers see the document while it is being edited. Switching off the Microsoft editor in the Privacy Center keeps Office files out of it.

Usability & Platforms

There are apps for Windows, macOS, Android and iPhone, plus the web panel in the browser. Every plan, including Personal Unlimited, connects at most 5 computers and mobile devices. Two-factor authentication is available on all plans, with codes by email or an authenticator app and single-use backup codes. What a forgotten password costs depends on the email reset setting described above.

Price & Value

The free plan gives 5 GB, three active links with up to 20 downloads per link per day, and three shared folders. Sync may close a free account that has not been used for six months. A cancelled paid plan is not moved back to the free plan: the account is closed and its files are deleted after 30 days.

Paid plans, billed yearly at the regular price: Personal 1TB costs $144 a year, Solo 5TB $336 a year and Personal Unlimited $540 a year. Paying monthly costs $16 a month for 1 TB, $32 for 5 TB and $54 for unlimited storage. The first year is 25% cheaper ($108, $252 and $405 on yearly billing), and the plan then renews at the regular price. Personal Unlimited has no storage cap, but Sync may slow uploads once an account passes 10 TB. A new purchase can be refunded in full within 30 days; renewals, upgrades and reactivations cannot.

Pros and Cons

Our Rating