The honest answer to "can my cloud provider read my files" is: with the standard configuration of every mainstream consumer service, technically yes.
That's not a scandal and it's not a reason to abandon cloud storage. It's a design consequence, and understanding it lets you decide which files that's acceptable for.
Why the provider can technically read your files
Your files are encrypted in transit and encrypted at rest. Both are real and both matter — they protect against network interception and against someone stealing a physical drive from a data centre.
The question is who holds the decryption key. In the standard arrangement, the provider does.
They hold it because it's what makes the features work:
- Showing you a preview of a document in a browser
- Searching inside your files
- Scanning for malware
- Letting you back in when you forget your password
- Generating thumbnails, transcripts, and automatic categorization
Every one of those requires the provider's systems to read the content. You cannot have both provider-side features and provider-side blindness; it's a genuine trade-off, not a failure of will.
Who realistically has access
Automated systems: yes, routinely. Content is processed by automated systems for malware scanning, indexing, feature generation, and — importantly — detection of illegal material, particularly child sexual abuse material, which major providers are legally required or strongly expected to scan for. This is machine processing, not human reading.
Employees: rarely, and with controls. Major providers restrict employee access to customer content, log it, and treat unauthorized access as a firing offence. It's not zero — insider incidents have occurred across the industry — but it's not casual browsing either.
Law enforcement and governments: on valid legal process. Providers respond to lawful requests, and publish transparency reports showing volumes. The applicable law depends on where the data is stored and where the provider is incorporated, which is why data residency matters to some organizations.
Anyone you shared with: obviously, and for longer than you think. Sharing links you created years ago are still live. This is by a wide margin the most common way cloud files are seen by people who shouldn't see them — not provider access, but a forgotten link.
Third-party apps you connected: often extensively. More on this below, because it's the most underestimated item on the list.
Anyone who gets into your account. Which makes account security a privacy measure, not just a security one.
The one people forget: connected apps
At some point you clicked "sign in with" or "allow access to your Drive" for a document scanner, a PDF tool, a note app, a photo editor, an AI assistant, a productivity integration.
Many of those permissions grant broad, ongoing access to your entire storage. They persist after you stop using the app. They persist after you delete the app. They persist after the company is acquired or shuts down and sells its assets.
Audit them. Every provider has a page listing third-party apps with access to your account — look for "connected apps," "third-party access," or "security" in your account settings.
Go through it and revoke anything you don't currently use and trust. This is a five-minute task with a larger privacy return than almost anything else in this article, and most people have never done it.
When granting access in future, read what's being requested. "Access to files this app creates" is very different from "access to all your files."
What to actually do about it
Three levels, and most people want the middle one.
Level one: sensible defaults
Enough for most people and most files.
- Two-factor authentication on your account, using an app or a hardware key rather than SMS
- A strong unique password, from a password manager
- Regular audit of sharing links — revoke what's stale
- Regular audit of connected apps
- Don't put credentials, identity documents, or other people's personal data in casually-shared folders
Most privacy incidents involving cloud storage are account compromises and forgotten shares, not provider access. Fix those first.
Level two: encrypt the sensitive subset
You don't need to encrypt everything. You need to encrypt the small pile that genuinely matters — identity documents, financial records, medical information, sensitive client material.
Two approaches:
An encrypted container. Create an encrypted volume or archive on your computer, put the sensitive files in it, and store the container in your cloud folder. The provider sees an opaque blob. Tools for this exist on every platform, including strong-encryption options built into archive utilities.
The trade-off: the whole container re-syncs whenever you change anything inside it, so keep it modest in size. And if you lose the password, the contents are gone permanently — there is no recovery.
A client-side encryption tool that encrypts files individually before they sync, presenting you with a normal-looking folder locally. This handles the re-sync problem and preserves per-file syncing. Several established options exist.
Either way, the password becomes irreplaceable. Store it in a password manager, and make sure someone you trust can reach it if something happens to you.
Level three: a zero-knowledge provider
Some providers offer genuine end-to-end encryption, where they hold no key and cannot read your data. Some mainstream providers offer this as an optional mode.
What you give up:
- Web-based preview and editing, in many cases
- Content search
- Easy account recovery — lose your credentials and recovery key and your data is unrecoverable
- Some collaboration features
- Sometimes, mobile app quality and third-party integrations
For people with a genuine requirement — journalists, lawyers, therapists, anyone handling regulated data — this is the right answer and the trade-offs are worth it. For general personal use, it's usually more friction than the benefit justifies, and level two gets you most of the way.
What providers do with your data beyond storing it
Read the terms, but the general shape for reputable providers:
Content is processed to provide the service — indexing, previews, malware scanning, sync.
Content is generally not used for advertising in mainstream paid storage services, though this has varied historically and by product.
Whether content is used to train machine learning models is an active and changing area. Policies differ between consumer and business tiers, and have been revised repeatedly. If this matters to you, check the current terms specifically rather than relying on what was true a year ago, and check whether an opt-out exists.
Metadata is retained regardless — filenames, sizes, timestamps, access patterns, who you share with. Encryption of content doesn't hide most metadata, and metadata is informative.
The practical rule
Ask one question of any file: would it be a serious problem if this were read by someone at the provider, disclosed under a legal order, or exposed in a breach?
For the overwhelming majority of files — holiday photos, meeting notes, receipts, drafts — the answer is no, and standard cloud storage with good account hygiene is entirely appropriate.
For the small remainder, encrypt before uploading. That's a one-time setup and it removes the question entirely.
The mistake isn't using cloud storage. It's treating all files as equivalent, and therefore either worrying about everything or worrying about nothing.
The thirty-minute privacy pass
- Two-factor authentication on, using an app or key
- Audited and revoked stale sharing links
- Audited and revoked connected third-party apps
- Identified the sensitive subset of files
- Put that subset in an encrypted container or client-side encrypted folder
- Password for that container stored in a password manager, and recoverable by someone you trust
- Checked your provider's current terms on data use and training
Provider policies on encryption, data use, and content processing change. Verify current terms directly with your provider.
Next in this series: How to Use Two Cloud Services Together Without Duplicating Everything