If you chose Apple products, there is a good chance you did it for the design, the performance and the ecosystem. Things work together. Photos sync across iPhone, iPad and MacBook. AirDrop is effortless. Handoff moves work between devices without you thinking about it.

Cloud storage is the one place in that ecosystem where the details are worth reading, and it has nothing to do with storage tiers or pricing. It is about who holds the keys.

Where files are encrypted matters more than which device you open them on.

The iCloud Encryption Model, Accurately

iCloud is genuinely convenient, and Apple has invested more in privacy than most companies of its size. The nuance is in what is encrypted, how, and whether you have opted in.

By default, iCloud encrypts data in transit and at rest, with Apple holding the keys for most categories. Advanced Data Protection, which Apple introduced as an opt-in setting, extends end-to-end encryption to most iCloud categories including iCloud Drive, Photos and device backups. A few categories remain outside it for interoperability reasons, Mail and Calendar among them.

Two things follow from that, and both are fair to say. Advanced Data Protection is a real improvement and deserves credit. And it is off unless you turn it on, which means most users are running with Apple able to access more than they probably assume.

What to Check on Your Own Mac

Before shopping for anything, it is worth knowing where you actually stand. Advanced Data Protection lives in Settings under your Apple Account, then iCloud. Enabling it requires setting up account recovery first, because once it is on, Apple cannot recover your data for you if you lose access.

That trade-off is the honest centre of this whole subject. Stronger encryption means the provider cannot help you when something goes wrong, which is precisely why it is stronger. Any service offering both full end-to-end encryption and password recovery on request is not offering what it claims.

What Genuine Privacy Looks Like

1. Client-side encryption: files are encrypted on your Mac before upload, so they are never held in a readable state on someone else’s servers.
2. Zero-access architecture: the provider cannot read your content because it does not hold the keys, rather than because policy forbids it.
3. Sharing that carries its protection: a shared file should require cryptographic authorisation to open, not merely a URL that works for anyone who has it.
4. Published audits: independent review with results made public, rather than a security page describing intentions.

Features Mac Users Should Not Compromise On

5. A real native app: plenty of providers treat macOS as an afterthought. Finder integration, drag and drop, and offline access are the difference between a tool you use and one you avoid.
6. iOS that matches: photo backup and document access on iPhone and iPad, working the same way as on the desktop.
7. Document collaboration inside the encrypted environment, rather than exporting to something else to edit.
8. Version history, because overwriting a file is far more likely than being breached.

The Trade-Offs, Side by Side

This is not an argument against iCloud. It is a comparison of two different models, and which one suits you depends on what you store.

Consideration	iCloud	Privacy-first alternatives
Native Apple integration	Excellent	Good, varies by provider
End-to-end encryption, default	Limited categories	All files
End-to-end encryption, opt-in	Most categories via ADP	Already the default
Provider can assist recovery	Yes, unless ADP is on	Generally no
Published independent audits	Security certifications	Varies, some publish in full

Apple’s encryption coverage changes between releases. Worth verifying current status on Apple’s own support documentation before relying on any comparison, including this one.

A Layered Approach Works Fine

This does not have to be a replacement decision. A reasonable setup for a lot of people is to keep iCloud for everyday convenience and sync, and put the genuinely sensitive material, client work, financial records, unreleased projects, into cloud storage built around client-side encryption. You get the ecosystem where it helps and stronger protection where it matters.

If you want to go deeper on the underlying principle, the Electronic Frontier Foundation has published extensively on encryption and what users should expect from providers, including a fair amount of scepticism about marketing claims in this area. It is a useful counterweight to any vendor’s description of its own product, including the ones you are considering.

The Bottom Line

You chose Apple because the details were thought through. Applying the same standard to where your files live is consistent rather than paranoid.

Whatever you decide, make the decision deliberately rather than inheriting it from a default setting. Turn on Advanced Data Protection if it suits you. Understand what your provider can and cannot access. And for the files that would genuinely cause a problem if read by someone else, choose something where the answer to who holds the keys is you.