Tresorit is a Swiss-Hungarian end-to-end encrypted cloud storage and file-collaboration service operated by Tresorit AG of Zurich (Swiss company register CHE-349.825.210), with affiliates in Hungary and Germany; since a July 2021 transaction it has been majority-owned by Swiss Post, Switzerland's state-owned postal group, and its own about page describes it as 'part of Swiss Post'. Tresorit's privacy policy and encryption pages state that files, file names and encryption keys are encrypted client-side so that Tresorit cannot decrypt stored content, while acknowledging that account, billing, folder-level metadata (folder name, size, members), device/IP analytics, sales-call recordings and marketing data are processed in the clear, and that a business Recovery Administrator can hold cryptographic access to employee files. The marketing website runs Google Analytics, Hotjar, Marketo/Pardot and advertising pixels from Facebook, LinkedIn, Bing and Google, whereas the in-service cookie policy describes first-party statistics only and honors Do Not Track. Tresorit publishes a series of third-party security artifacts -- an Ernst & Young source-code review and penetration test (2019), Computest (2021) and CCLab (2023) penetration tests, TÜV Rheinland ISO 27001:2022 certification, and an unnamed-auditor 2025 pentest with one medium server-side finding -- and an ETH Zurich cryptographic analysis (CCS 2024) found no plaintext-recovery attack against Tresorit but flagged unauthenticated metadata and certificate-authority trust as weaknesses. No breach or regulatory action was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
COLLECTION
Tresorit's zero-knowledge encryption page states that files are encrypted on the user's device before upload and that encryption keys are never stored by Tresorit in readable form, and it explicitly limits the claim: zero-knowledge 'does not mean' anonymous usage or no logging, and system activity may still be tracked for operational purposes.
Tresorit's Privacy Policy (effective 2025-04-05) states that files, encryption keys and passwords are never stored in unencrypted or invertible form and that Tresorit cannot decrypt or access Encrypted Content or file names, while disclosing that it processes clear-text registration and billing identity, folder-level metadata (folder name, size and members), IP address and approximate location for link downloads when the owner enables access logs, device/OS/client-version/IP analytics, recorded sales calls analysed by transcription and coaching bots, and marketing data received from advertising partners and LinkedIn that may be combined with details about the user's organization; encrypted content is deleted within 90 days of folder deletion.
Tresorit's About page states that Tresorit is part of Swiss Post's digital business services ('Swiss Post Digital'), was founded in 2011, has offices in Switzerland, Germany and Hungary, and names its executive team (CEO István Hartung, CCO Oliver Jaeger, CPO Stéphane Croisier, CFO Andrea Skaliczki, CTO Péter Budai, CHRO Gabriella Nyíri, CSO Peter Stössel).
TechCrunch reported on 2021-07-08 that Swiss Post, the state-owned postal firm, acquired a majority stake in Swiss-Hungarian Tresorit for undisclosed terms, that Tresorit would remain an independent company within Swiss Post Group with founders, brand and service unchanged, and that prior backers included 3TS Capital Partners and PortfoLion from a 2018 EUR 11.5 million Series B.
Tresorit's Privacy Policy identifies the service provider and data controller as Tresorit AG, company registration CHE-349.825.210, Pfingstweidstrasse 60b, 8005 Zurich, Switzerland, organized under Swiss law with affiliates in the EEA (Hungary and Germany), an EU representative, and a named DPO contact.
Tresorit's security page describes the sharing architecture: every file and relevant metadata is encrypted on the device with unique random keys never sent to servers unencrypted, key sharing uses RSA-4096 with OAEP padding and PKI certificates over a tree of symmetric keys so that Tresorit itself cannot access shared keys, clients apply HMAC/AEAD integrity protection, and non-convergent encryption prevents matching a user's content against others'; the same page states Tresorit is ISO 27001:2022 certified by TÜV Rheinland.
Tresorit's Privacy Policy states it will never sell personal data, and enumerates the sharing that does occur: disclosure to authorities where required including national-security or law-enforcement requirements; third-party service providers for application development, backup, storage, payment processing, analytics and online marketing (list hosted on support.tresorit.com); metadata visible to co-members of shared folders; Business Subscription administrators, who under Advanced Control can be given cryptographic access to a user's Encrypted Content; and transfer in a business acquisition or merger.
Privacy Guides lists Tresorit on its Cloud Storage recommendations page (criteria: end-to-end encryption, provider cannot read files), noting it is owned by Swiss Post and recording its audit history: ISO/IEC 27001:2013 certification by TÜV Rheinland InterCert Kft (2022), Computest penetration testing (2021, two vulnerabilities found and resolved) and Ernst & Young penetration testing and source-code review (2019).
ETH Zurich's Applied Cryptography Group study 'End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem' (Hofmann and Truong, ACM CCS 2024) analysed Sync, pCloud, Icedrive, Seafile and Tresorit under a malicious-server model, found severe vulnerabilities in the first four but not Tresorit; for Tresorit it documents that some file/folder metadata (size, type, creation time, creator identity) is unencrypted and unauthenticated and can be tampered with by the server, and that a compromised server able to obtain certificates from Tresorit's own CA could present non-authentic public keys when sharing (an attack the authors could not run end-to-end).
In a post dated 2019-11-24, Tresorit's then-CEO announced that Ernst & Young had completed a three-stage independent assessment (penetration testing, source-code review, and cryptographic key-differentiator review) and published EY's third-party memo; EY's Mihaly Zala is quoted concluding that data is encrypted client-side such that Tresorit servers and employees never receive cleartext data or keys.
Tresorit's ISO 27001 announcement states that it first obtained ISO/IEC 27001:2013 certification in May 2018, that a recertification audit against ISO/IEC 27001:2022 covering all Tresorit entities was concluded successfully by an independent audit firm in the TÜV Rheinland Group, and that the ISMS scope covers sales, development, maintenance and support of its end-to-end encrypted cloud services.
Tresorit's 2023-09-04 post reports that CCLab conducted Common Criteria-based penetration testing of Tresorit's cryptography, key management, network communications and Windows-client components and found no vulnerabilities, and records that Computest performed penetration testing of the apps in 2021 following the earlier Ernst & Young engagement.
Tresorit's 2025-12-15 post reports a gray-box penetration test of its end-to-end encryption and web, mobile and desktop apps by an unnamed 'internationally renowned third-party auditor', which found no critical or high findings and no deviation from Tresorit's data-confidentiality claims but did identify a medium-severity server-side race-condition vulnerability plus other medium/low issues; Tresorit commits to annual independent testing from 2025 onward and does not publish the report itself.
Tresorit's Service Cookie Policy for the logged-in product describes only essential and first-party performance-statistics cookies, states that no cookies are deployed before login, that Do Not Track requests are honored so analytics receive no activity information, and that Tresorit does not track users across the Internet.
Tresorit's website Cookie Policy (effective 2025-06-23) states that tresorit.com uses Google Analytics, marketing platforms Marketo and Pardot (Salesforce), and Hotjar, and lists third parties that place targeting/advertising cookies including Bing, Facebook, Google Marketing Platform, LinkedIn, N Technologies (N.Rich) and Rakuten, plus UserLike chat, YouTube embeds and Zuora billing; it states third-party cookies are limited to the websites and not used in the Services.