MEGA is a New Zealand-founded cloud storage and file-sharing service that markets itself as 'the privacy company' and offers client-side (user-controlled) end-to-end encryption of file and chat content. Its privacy policy is issued by two operating entities -- MEGA Privacy LLC, registered in Hungary since a March 2025 corporate restructuring, and Mega Privacy (NZ) Limited for standalone VPN/Pass plans -- and states MEGA cannot decrypt uploaded files or chats, while disclosing broad categories of unencrypted metadata it does retain (device IDs, IP addresses, browser/OS data, file sizes) and stating it never sells personal data. In 2022, researchers at ETH Zurich (mega-awry.io) published five practical attacks that fully compromised file confidentiality and integrity for a malicious-server adversary; MEGA patched the primary vulnerabilities within roughly two months of disclosure, published a technical remediation writeup, and a later independent re-analysis confirmed the patches were effective against an improved variant of the key-recovery attack. MEGA's App Store privacy label discloses that Location and Usage Data may be used to track users across apps and websites owned by other companies, and its policy separately discloses use of third-party advertising companies. No named third-party security audit of the current architecture and no regulatory action or data breach were found in this research; MEGA does publish a periodic transparency report with takedown and legal-order statistics.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
21 ON FILE
COLLECTION
MEGA's security page states that all data is encrypted with keys generated from the user's password, which functions as the main encryption key, and states that no one -- including MEGA itself -- has access to that password.
As assessed by PrivacySpy on 2021-03-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow you to permanently delete your personal data? — Yes, using an automated mechanism.
MEGA's Privacy Policy states that Your Files and Your Chats are not treated as personal data because MEGA cannot decrypt them, while separately disclosing that MEGA's systems retain a range of metadata in unencrypted form when the service is used, including device IDs, browser/device/OS type, IP address and port information (used for login, API usage, file uploads/links and VPN usage), file sizes, versioning order and parent-child file relationships.
As assessed by PrivacySpy on 2021-03-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.
MEGA's Transparency Report states that in March 2025 MEGA underwent a corporate restructuring under which the contractual provider of the MEGA Cloud and MEGA S4 services became MEGA Privacy LLC, a company registered in Hungary, with updated Terms of Service reflecting the change taking effect 15 May 2025; the report also states MEGA now operates from Hungary and is subject to Hungarian and EU law, while retaining an Auckland, New Zealand office.
MEGA's Privacy Policy states that for most services (including MEGA Cloud storage) it is issued by MEGA Privacy LLC, registered in Hungary under company register number Cg. 13-09-239012, while standalone MEGA VPN or MEGA Pass paid plans fall under the policy of Mega Privacy (NZ) Limited, New Zealand company number 9324253, with the agreement governed by Hungarian or New Zealand law respectively.
MEGA's security page states its zero-knowledge, user-controlled end-to-end encryption protects data 'even when sharing,' so that only the user and the specific people they share with hold the keys needed to see, read or listen to that data, and that to anyone else -- including MEGA -- the data would be unreadable.
As assessed by PrivacySpy on 2021-03-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.
MEGA's Privacy Policy states it will never sell personal data to third parties and that ancillary processing (such as payments) is limited to service providers, including Mega Cloud Services SL in Spain, located in Europe or in jurisdictions the European Commission has determined provide an adequate level of data protection.
Researchers at ETH Zurich's Applied Cryptography Group published 'MEGA: Malleable Encryption Goes Awry,' documenting five distinct attacks against MEGA's production user-controlled end-to-end encryption system that, together, allowed a malicious server to fully compromise the confidentiality of user files and to insert malicious files that passed the client's authenticity checks.
As assessed by PrivacySpy on 2021-03-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
MEGA's blog post dated 21 June 2022 announced that it had released software updates fixing the critical vulnerability reported by ETH Zurich researchers, stated it was not aware of any compromised accounts, credited the named researchers, and published a vulnerability-by-vulnerability remediation status; the post was later updated to note that a subsequent UC San Diego re-analysis confirmed MEGA's patches remained effective against an improved variant of the key-recovery attack.
MEGA's App Store privacy-nutrition label (id706857885) discloses that Location and Usage Data may be used to track the user across apps and websites owned by other companies, and separately lists Contact Info, Identifiers and Usage/Product Interaction Data as data linked to the user's identity.