"Encrypted" does not mean nobody can read your files
Emilien Mantel
Every business handles documents it would rather not see circulate: contracts, payslips, bank statements, copies of identity documents, drawings, client files. To exchange them, it relies on online services, and almost all of them describe themselves as "encrypted".
That is usually not false. But the word covers three different realities, and in two cases out of three, the service can read your documents. You do not need to understand the technology to find your way around. It is enough to ask a single question, at every step: who can read my files in plaintext?
A picture to start with: the storage company
Imagine you hand a confidential file to a furniture storage company.
- The armoured truck. The file travels in an armoured truck. Nobody can read it on the way. Once at the warehouse, it is taken out of the truck and put on a shelf, readable by the staff.
- The warehouse safe. The warehouse puts the file in a safe. But the warehouse is the one who knows how to open it. The staff opens it whenever they need to, and will have to open it if an authority asks them to.
- Your own sealed box. You seal the file in a box before handing it over. Only the recipient knows how to open it. The warehouse transports the box, stores it, delivers it. It has never opened it, and it could not do so, even under orders.
These three situations match the three levels of encryption found in file sharing services.
Level 1: encrypted in transit
This is HTTPS, the padlock you see in your browser's address bar. It protects your data while it travels between your computer and the service, for instance when you work from the Wi-Fi of a hotel or a train station.
Once it reaches the service's servers, your data becomes readable again. This level is the armoured truck: essential, but it says nothing about what happens on arrival.
It has also become the norm: according to Google's transparency report, between 95 and 99% of pages loaded in Chrome are served over HTTPS. A service that highlights its "SSL encryption" or its "secure connection" is therefore not describing an advantage, but the minimum expected of any website.
Source: https://transparencyreport.google.com/https/overview?hl=en
Who can read your files? The service, its employees, an attacker who breaks in, an authority that asks for them.
Level 2: encrypted on their servers (at rest)
The service stores your files in an unreadable form on its hard drives. If someone steals or recovers a drive, they get nothing out of it. This is what is called encryption "at rest".
But the service is the one who knows how to make the files readable again, and it does so all the time: to show you a preview, to scan them for viruses, to let you find them with a search, or to answer an access request. This is the warehouse safe.
This is where most misunderstandings come from. When a service advertises "AES-256 encryption" or "military-grade encryption", it is almost always talking about this level. The lock is excellent. But the service is the one who opens it.
Who can read your files? The service, its employees, the hosting provider or an attacker who takes control of the software, an authority that asks for them.
Level 3: encrypted on your side, before sending (end to end)
Your files are made unreadable on your own computer, before they leave. The service only receives, transports and stores a sealed box. It does not know how to open it. Only the recipient can, on their own device. This is what is called end-to-end encryption: the protection is never interrupted between the sender and the recipient.
The consequences are direct:
- If the service is hacked, the attacker gets sealed boxes, not documents.
- The service can neither read, nor scan, nor preview your files.
- If an authority demands your data, the service can only hand over what it is itself unable to read.
- If you lose your password, the service cannot restore your access to your files.
That last point often comes as a surprise. It is, however, the proof that the mechanism works: a service that can give your files back after you lose your password is a service that can read them. This constraint can be managed: a company password manager and an internal procedure for backing up access are enough in most cases.
Who can read your files? You and your recipients. Nobody else.
Do your files stay unreadable? The three levels against the same situations
| Your files are protected if... | Encrypted in transit | Encrypted in transit and at rest | Encrypted end to end |
|---|---|---|---|
| an attacker eavesdrops on the network | ✅ | ✅ | ✅ |
| a hard drive is stolen from the data center | ❌ | ✅ | ✅ |
| an attacker breaks into the service | ❌ | ❌ | ✅ |
| an employee of the service looks at your files | ❌ | ❌ | ✅ |
| an authority demands your files from the service | ❌ | ❌ | ✅ |
The first two levels are standards, and any serious service applies them. They protect against real risks. But they do not protect you from the service itself, nor from those who manage to get inside it.
What the breaches of 2026 show
This is not theoretical. The file leaks documented this year almost all follow the same scenario: the service could read the files, someone gained access to the service, and the files came out in plaintext.
HubEE and Service-Public.fr, January 2026. HubEE is the French State's document exchange platform, used in particular for the online procedures of Service-Public.gouv.fr. The interministerial digital directorate (DINUM) detected an intrusion on 9 January 2026, and the State then confirmed the theft of about 70,000 case files, or 160,000 documents submitted by citizens during procedures: supporting documents, scans of identity cards, proofs of address. The documents were stored on a platform that could read them, so they were readable by whoever got in.
Jinko, September 2026. This French platform supporting cancer patients confirmed an exfiltration. The data published online includes more than 2,600 files from its storage space at Google, including PDF documents, audio recordings and images, nearly 2,000 of them related to patients' health. Google encrypts that storage at rest by default. It was not enough: whoever gains access to the application gets the files in plaintext.
BlgCloud, August 2026. This French publisher of online business management software, used by equipment rental and distribution companies, saw an attacker access its customers' environments. The publisher acknowledged 13 affected customer environments, 5 of them with exfiltrated documents, on top of professional contact details and business emails. The companies concerned had done nothing unusual: their documents were with a provider that could read them.
In none of these cases was encryption at rest "broken". It was simply not involved: the attackers came in through the door the service itself uses to read the files.
Sources:
- HubEE, confirmation by the State: https://www.lesnumeriques.com/societe-numerique/l-etat-confirme-la-catastrophe-160-000-documents-de-service-public-gouv-fr-sont-entre-les-mains-de-pirates-n249974.html
- HubEE, details from DINUM (70,000 case files, administrations concerned): https://www.it-connect.fr/piratage-hubee-letat-confirme-la-fuite-de-160-000-documents-avec-des-donnees-sensibles/
- Jinko, incident record: https://frenchbreaches.com/alertes/jinko-mtr8ebuvqi0us4ljpbi
- Jinko, details of the exfiltrated files: https://frenchbreaches.com/blog/des-donnees-medicales-de-patients-atteints-de-cancer-exposees-apres-le-piratage-presume-de-jinko
- Google, encryption at rest for Firebase services: https://firebase.google.com/support/privacy
- BlgCloud, the publisher's position: https://frenchbreaches.com/alertes/bergerat-rent-blgcloud-mt1zdsa2pfwxiwrzeuf
- BlgCloud, initial claim: https://frenchbreaches.com/alertes/actis-location-blgcloud-mtck051io55urdgqnxe
What about "zero-knowledge"?
The term comes up often in sales pitches, rarely with an explanation. A zero-knowledge service is a service that cannot read what it hosts. Not because it promises not to look, but because it has no technical means to do so.
It is level 3 taken all the way. Some services do encrypt your files before sending, but keep what it takes to reopen them "to help you out" if you forget your password. They are not zero-knowledge: they have simply put the safe back in the warehouse.
At Retyc, this means concretely that we can read neither the content of your files, nor their names, nor the messages that accompany them. If a user forgets their encryption password, we cannot recover it, nor decrypt their data on their behalf.
Two clarifications. The term has no official definition in this usage: any service can claim it. And the guarantee is verified rather than declared. The simplest test is a single question to support: "if I forget my password, can you give me my files back?" If the answer is yes, the service can read them.
"I use Microsoft, so it's secure"
This is the objection we hear most often. It rests on a simple idea: a large provider, therefore good security.
In Microsoft 365, OneDrive and SharePoint, your files are encrypted in transit and on the servers. You are at level 2: Microsoft can read your documents. The service does so all the time, for search, previews, antivirus scanning, or to make them available to an administrator in the event of legal proceedings.
The major digital service providers are also mostly American, and Microsoft is no exception. Their data, even when hosted in Europe, can be subject to US laws (Cloud Act, FISA) that allow US authorities to access it.
In June 2025, before a French Senate inquiry committee, Microsoft France acknowledged that data belonging to French citizens can be handed over to US authorities without the consent of the French authorities.
For documents covered by professional secrecy or trade secrets, the conclusion is simple: a service that can read your documents is a point of access to those documents.
Three questions to ask any service
They require no technical expertise, and the answers place a service without ambiguity.
- If I forget my password, can you give me my files back? If yes, the service can read them.
- Can you show a preview of my files, or search their content? If yes, the service can read them.
- If an authority asks you for my files, what can you hand over? An end-to-end service can only hand over unreadable data.
In short
Encryption in transit and on the servers is now a given everywhere. It protects against interception and hardware theft. It does not protect against the service itself, nor against those who manage to get inside it, as the breaches of 2026 remind us. End-to-end encryption is the only one of the three levels where nobody but you and your recipients can read your files. When a service calls itself "encrypted", this is the only question that deserves an answer: who can read my documents in plaintext?
For a full description of the architecture Retyc has chosen and of its limits, the white paper is freely available.