Most cloud storage services claim they "take every precaution" to keep your data secure. For example, most use encryption to make sure your files are secure in transit. They "have internal policies and controls" to ensure that employees don't access your files. But things do go horribly wrong.

On-the-fly encryption is the the most convenient way to protect your files in transit and in the cloud. That's where client-side products like SpiderOak, Tresorit and Cryptomator come in. Client-side on-the-fly encryption assures that your files never leave your computer in an unencrypted state.

Once it is properly set up, good client-side, on-the-fly encryption applications require no direct action by users. They and their client-side processes have fast, direct access to unencrypted files. But encryption adds complexity (things do go horribly wrong), and local backups are still important.

There are pitfalls and limitations in most systems for cloud-storage encryption. They are briefly described below in the "Minuses" for each system type.

The analysis of common ways to implement on-the-fly, sometimes called transparent encryption is here in the introduction because deciding which type of encryption you need is often the quickest way to narrow your choices to what will work for you.

Type 1 = [User Folder - clear-text files] << >> [Encryption & Cloud sync] << >> [Cloud storage]

• Examples: Tresorit | SpiderOak
• Description: Implements on-the-fly encryption straight to the cloud. Encryption and syncing are combined.
• Pluses:
  • There is no way that clear-text files will be sent to the cloud through user error.
  • Combined encryption and sync facilitates finer-grain processes. Functions like economical storage of previous versions in the cloud, file-by-file shareable encrypted links, and collaboration are examples.
  • Local files are always available in plain-text , even when the encryption process is not running.
• Minuses:
  • Local files are not encrypted by the process, as they are in Type 3. You need to add independent local encryption if you want those files to be encrypted at rest.
  • There are not many free versions of Type 1 encryption.

Type 2 = [User Folder - clear-text files] << >> [Encryption] << >> [Folder - encrypted files] << >> [Cloud sync] << >> [Cloud storage]

• Examples: Cloudfogger
• Description: User files are contained in a local clear-text folder. The encryption software places encrypted files in a location associated with the cloud sync/storage service being used. Choice of those services is independent from the encryption software.
• Pluses:
  • Compatible with a wide range of cloud storage services, e.g., Dropbox, OneDrive, Amazon AWS.
  • The flexibility cloud provider choice enables choice of features, functions and price.
• Minuses:
  • Pitfall: The folder for encrypted files is an ordinary folder. If the user places any clear-text files directly in that folder they will not be encrypted in the cloud.
  • Local files are not encrypted by the process, as they are in Type 3.

Type 3 = [Virtual Drive - virtual clear-text files] << >> [Encryption] << >> [Folder - encrypted files] << >> [Cloud sync] << >> [Cloud storage]

• Examples: BoxCryptor | Cryptomator | Cloudifile | Viivo |
• Description: The key words here are Virtual Drive, not User Folder of Type 2. User files are always encrypted. They are accessed as virtual clear-text files. The encryption software stores encrypted files in a location associated with the cloud sync/storage service being used. Choice of those services is independent from the encryption software.
  • The target folder -- [Folder - encrypted files] -- is located in the local "Cloud storage" service file structure. for example, in the Dropbox folder of your choice. The cloud storage process will uploaded/downloaded files to keep the local and cloud copies in sync. The "Virtual drive - clear-text files" element only appears when the encryption process is started.
  • The virtual drive is integrated with the local file system and has a drive letter assigned, for example R:\. It shows up in the top level of the storage structure. That's in "This PC" for Windows 10 for example. Both users and client-side processes interact with the contents of that virtual drive just as they would with any physical drive. The virtual drive resides in PC memory. Both it and its contents evaporate when the encryption process is not running.
• Pluses
  • Compatible with a wide range of cloud storage services, e.g., Dropbox, OneDrive, Amazon AWS.
  • The flexibility cloud provider choice enables choice of features, functions and price.
  • Physical (local) files are always encrypted at rest.
• Minuses
  • Pitfall: The folder for encrypted files is an ordinary folder. If the user places any clear-text files directly in that folder they will not be encrypted in the cloud.

Type 4 = [Virtual drive - clear-text files are virtual only] << >> [Encryption] << >> [Encrypted volume - single encrypted file] << >> [Cloud sync] << >> [Cloud storage]

• Examples: VeraCrypt | TrueCrypt (not recommended |
• Description: User files exist only in the encryption container, and are always encrypted. The encryption container/vault/volume is a single encrypted file. They are accessed as virtual clear-text files. Cloud sync and storage is provided by independent cloud services.
• Pluses:
  • Very robust encryption is available. I use VeraCrypt in this Type 4 configuration, but watch out for the pitfall (below in minuses) if you do.
• Minuses:
  • Cloud sync will be slow and use a large amount of bandwidth if the cloud service does not use block-updates (syncing just the changed part of that big encrypted file-continer file).
  • Pitfall: Unless the encryption process is set up exactly right, the cloud sync process will not detect that the encrypted volume contents have changed. That means the changed volume will not be synced with the cloud.

Type 5 = [User Folder - clear-text files] << >> [Encryption] << >> [Encrypted archive - single encrypted file] << >> [Cloud sync] << >> [Cloud storage]

• Example: CryptSync (Augmented 7-zip process, which also provides 7-zip compression) | Others?
• Description: The encryption process mirrors the clear-text files directly in an encryption container ("archive" in the case of CryptSync/7-zip). They can be accessed independently (directly from the archive).
• Pluses:
  • 7-zip is encryption is time-tested.
  • 7-zip compression is fast and effective.
• Minuses:
  • This is an unconventional encryption system.
  • Cloud sync will be slow and use a large amount of bandwidth if the cloud service does not use block-updates (syncing just the changed part of that big encrypted file-continer file).
  • Local files are not encrypted.
  • Pitfall: The encryption container is an editable multi-file archive. If the user places any clear-text files directly in that archive they will not be encrypted in the cloud.