Most cloud storage services claim they "take every precaution" to keep your data secure. For example, most use encryption to make sure your files are secure in transit. They "have internal policies and controls" to ensure that employees don't access your files. But things do go horribly wrong.

For many cloud-storage users, privacy and robust encryption are top priorities. It is essential for data and documents to be encrypted before leaving their device, and it is essential that no other entities have their encryption key or any other way to gain clear-text access to their files.

On-the-fly encryption is the the most convenient way to protect your files in transit and in the cloud. That's where client-side products like SpiderOak, Tresorit, Sync and Cryptomator come in. Client-side on-the-fly encryption assures that your files never leave your computer in an unencrypted state. And your encryption key should never leave your computer.

Once it is properly set up, good client-side, on-the-fly encryption applications require no direct action by users. They and their client-side processes have fast, direct access to unencrypted files. But encryption adds complexity (things do go horribly wrong), and local backups are still important.

Common ways to implement on-the-fly, sometimes called transparent encryption

There are pitfalls and limitations in most systems for cloud-storage encryption. Perhaps you can spot them below, but this list might be best used as a reminder. Go learn more about these encryption methods in the Selecting an Encryption Method for Cloud Storage article and then come back here.

Type 1 = [Unencrypted folder] << >> [Integrated encryption & cloud sync] << >> [Cloud storage]

Examples: Tresorit | SpiderOak

Type 2 = [Virtual Drive - virtual clear-text files] << >> [Encryption] << >> [Folder - encrypted files] << >> [Cloud sync] << >> [Cloud storage]

Examples: BoxCryptor | Cryptomator | Cloudifile | Viivo |

Type 3 = [User Folder - clear-text files] << >> [Encryption] << >> [Folder - encrypted files] << >> [Cloud sync] << >> [Cloud storage]

Example: Cloudfogger

Type 4 = [Virtual drive - clear-text files are virtual only] << >> [Encryption] << >> [Encrypted volume - single encrypted file] << >> [Cloud sync] << >> [Cloud storage]

Examples: VeraCrypt | TrueCrypt (not recommended, see in Related Products and Information below)

Tresorit is a significant entry in the client-plus-cloud encryption arena. It includes integral free cloud storage (3 GB plan, expandable by completing a few "tutorial tasks", etc.). Tresorit provides seamless sync via the cloud, encrypted links for sharing, and secure collaboration. Tresorit operates under Swiss laws, and uses Irish and Dutch servers (no Patriot Act).

Tresorit uses Type 1 encryption (defined above in the Introduction), including its pros and cons. Files are unencrypted on all your synced devices, but are always encrypted for transmission and storage in the cloud. They describe the features of their system quite well. The Tresorit interface is well organized. They have an impressive analysis of why they doubt that Tresorit has been hacked. Being based in Switzerland doesn't hurt either. Tresorit may be the most secure way to encrypt files/folders for the cloud. ;)

Tresorit support is comprehensive and well written, and they have added tutorials for all platforms (look at the bottom of the left column of the interface). You should be able to easily figure out how to get Tresorit going.

I've been using Tresorit for my most sensitive data since September, 2013, and it has performed flawlessly. There is a sizable development team at Tresorit, and they are actively introducing new apps and features. For example, they have recently implemented file versioning, and a clever secure URL method for sharing individual files securely.

SpiderOak is not just an encryption program. It combines client-side encryption with 2 GB of free cloud storage (more storage is availale for a fee). In other words, you don't need a separate cloud-storage service. SpiderOak also provides sync between PCs and portable devices in addition to backup. In sum, SpiderOak provides encryption (Type 1 as defined above in the Introduction), backup, sync and storage space. Backup and sync can be automatic.

SpiderOak uses Type 1 encryption (defined above in the Introduction), including its pros and cons. Files are unencrypted on all your synced devices, but are always encrypted for transmission and storage in the cloud. You can use SpiderOak for as many folders as you like. Of course you can use up the free 2 GB pretty quickly, but it is inexpensive to get more. It is challenging to discover all the functions of SpiderOak intuitively, but they have excellent "getting started" guides and a users manual.

The SpiderOak statement on privacy and passwords is a good example of what you should look for to evaluate the security of any encryption service for cloud storage. In particular, be very leary of any service that offers password recovery. If there is a mechanism for password recovery, it is likely your data on the server is also accessible to a determined hacker or agency.

I used SpiderOak for some time, and I liked the way it worked. One thing to understand is that SpiderOak breaks files into blocks so that only the changed or added sections of files need to be stored. That way many versions of the file by just storing the incremental blocks. It offers fine-grain control of the backup/sync process, which helps you stay within the 2 GB of free storage. It's a bit tricky to use SpiderOak until you get used to how it processes backups and syncing.

Sync, a fairly new encrypted cloud service located in Canada (no Patriot act). It is similar to Tresorit and SpiderOak, providing sync, sharing and storage. You get 5 GB of free storage, along with software to sync files with the encrypted cloud storage (or, you can use the cloud interface associated with your account without installing anything). You might use up the free 5 GB pretty quickly, but 500 GB is surprisingly affordable.

Sync employs Type 1 encryption for the cloud (defined above in the Introduction), including its pros and cons. Files are not encrypted on your synced devices, but are always encrypted (2048 bit RSA, 256 bit AES, SSL and TLS) for transmission and storage in the cloud.

Sync has the most straightforward installation & cloud setup I've experienced. Every step of the process, including installing the software was perfectly clear and presented in a smooth flow. You can easily have Sync up and running in under three minutes. The process creates a special "Sync" folder on your device and your "web-panel" in the cloud. You can upload/download files directly from the cloud or work with them in the installed Sync folder.

Sync allows "selective sync" so that you can choose which folders are stored on each device. This lets you keep just the files you need on devices with limited storage. Sync also has a unique cloud management feature that sets it apart. They provide a "Vault" section in the cloud where you can copy or move any of your files or folders. These files are available from the cloud (only), which means none of them take up space on your devide(s). You can temporarily access just the ones you need at the time you need them.

Cryptomator is a new entry in this category of encryption for cloud storage. It is well matched to the needs of many of the readers of this article and most home users. One key design objective is security through simplicity. Cryptomator provides transparent (on-the-fly), client-side encryption for cloud storage. Cryptomator is free and open-source software, which assures that backdoors are unlikely.

Cryptomator is platform independent, and especially suitable for less technically experienced users. The user interface is very simple, and it is fairly easy to intuitively discover all the functions and options of Cryptomator. A FAQ and a rough version of a user manual already exist. They provide good help in getting started. The architecture is "Type 3" as discussed above in the Introduction.

Cryptomator is based on simple, clean, and straightforward architecture, which uses time-proven, standard encryption functions. It is open-source, which makes independent cryptographic review possible. Those factors, and the evident attention to detail and documentation by the developers lend a great deal to my confidence in the security of Cryptomator.

The developers consulted with university mathematicians and other encryption experts, and received extensive feedback from the encryption community in their quest to avoid and eliminate vulnerabilities. They recently received a CeBIT Innovation Award (from the German Federal Ministry of Education and Research and a sponsoring Partner) for their design.

Cloudfogger has a simple, clean user interface and is easy to work with. Cloudfogger is integrated with the file system so that many operations can be performed via context menus in the file manager. For example, their "auto-fogg" feature allows you to encrypt/decrypt any file or folder (cloud connected or not) with a simple right-click.

Cloudfogger is a seasoned product. It can be used with a wide range of cloud storage services, e.g., Dropbox, OneDrive (you must disable Office collaboration though), and Google Drive. Optional password recovery and "emergency decryption app" options are available. There is a helpful manual and an informative FAQs for Cloudfogger.

They describe their encryption system at a high level: "Cloudfogger encrypts files with AES 256 Bit (Advanced Encryption Standard), an industry-grade encryption standard. Each file is encrypted with its own, unique AES Key that will be saved RSA encrypted within the file's header. ... User passwords are never transmitted to the Cloudfogger servers..." Cloudfogger is a proprietary product so I have found little in way of authoritative independent vetting. One question for example, is not answered: Do the optional recovery features introduce accessible backdoors?

Cloudfogger uses a unique file-handling scheme. In effect they integrate the encryption process directly in the folders to be protected. Users work in what I'll call "encrypting folders". Those dual-function folders store and present unencrypted files to users but upload encrypted versions of the files to the cloud. This is similar to the way Tresorit works, but Tresorit integrates their encryption process with their own cloud storage servers. That's a critical difference. Read on.

In one way, the Cloudfogger scheme is great. It preserves the appearance of native file management for users. No confusing virtual drives or linked folders are required for file access by users. It's simplicity itself. But there's a dark side. If users add files to protected folders when Cloudfogger is not running the files will be uploaded in unencrypted form by the cloud service. That's right, they will not be encrypted in the cloud. Their approach is not as foolproof as Tresorit's method.

Cloudifile is a cloud encryption entry from an established organization. I applied my criteria for encryption software, and while it is relatively new I am comfortable including Cloudifile in this encryption category. Cloudifile is offered by Cloud Labs, which is a product spin-off of Apriorit. Apriorit has extensive experience in security projects that relate to a product like Cloudifile.

Here's how it works: Cloudifile creates a new folder in Dropbox, and encrypts and moves the files you want to store in the cloud to that Dropbox folder. It also creates a virtual drive where you can access the files (when you are logged in). Your local files are always encrypted at rest on your computer as well as in the cloud, but available in cleartext when you are logged in to Cloudifile. There is also a right-click context menu item for Windows Explorer that allows you to "Cloudify" any other files you want to encrypt and add to Dropbox.

BoxCryptor and Viivo both use a virtual-drive interface that is linked to an ordinary folder. They encrypt a single folder, and augment it with the virtual-folder overlay to give cleartext access. With this approach, you work directly with an unencrypted local files, which is faster, but not as secure against local attack. Viivo is not open source, but it is a seasoned product offered by an encryption-centered enterprise.

Their two folder approach leaves users open to fatal mistakes. All files to be encrypted must be placed in the unencrypted local folder. or they will not be encrypted in the cloud-facing folder. Any files placed directly in the encrypted folder will not be encrypted. That could be hard to remember, and there is no warning or other indication of mistakes.