Data cloud GDPR-compliant? An alternative to Dropbox, Google Drive, One Drive and the like.

I have integrated the Dropbox cloud service into my infrastructure for many years:
All backups, customer assets (graphics, images, text files and documents, Excel lists and database exports) that were required for the development of web projects were saved in my Dropbox.
It was easy to share data with my clients using the Dropbox sharing functionality. Collaboration on documents was possible and much more.

So as a freelance developer, I bought a business plan from Dropbox: the Professional plan with 3TB storage volume and lots of great features.

After the new GDPR regulations came into force in the EU in May 2018, I contacted Dropbox customer service to find out how I could use Dropbox as a business customer in a GDPR-compliant manner in future. I was informed that solutions would be made available shortly.

In fact, however, the EU Privacy Shield agreement was ultimately only invoked and no solution was provided. For companies and individual businesses based in the EU, it ended up being a legal gray area. To this day, Dropbox refers to this in its privacy policy to the resolution passed on 16.07.2020 by the ECJ invalidates EU Privacy Shield with legal effect.

Although EU standard contractual clauses have now been integrated into Dropbox's data protection guidelines, this is unfortunately not sufficient for Dropbox to be used as a German company. The locations of the servers on which the data is stored must also be in the EU. And it is precisely this data migration to a server in the EU that Dropbox only offers under the following conditions:

1. You must subscribe to at least the Business Standard tariff
2. At least 10 users must be booked
3. A subscription with annual billing must be taken out

The Dropbox included in my Business Professional plan, which is for a single user, isn't sufficient for this. The annual price for Business Professional is €198.96, but the annual cost for the minimum plan mentioned above—which is supposed to make Dropbox „somewhat“ GDPR-compliant—comes to at least €1,200 per year.

I received this information from Dropbox Business Support just a few days ago. Afterward, I looked into ways to use Dropbox in compliance with the GDPR—even without being able to migrate my data to the EU. In the process, I found a very promising tool called Boxcryptor. Boxcryptor first encrypts the data before storing it in Dropbox. The operating company has its headquarters and server location in Germany, an ISO/IEC 27001:2013-certified data center and can also securely encrypt the data that is to be stored in iCloud, Microsoft OneDrive, Google Drive and many other US cloud providers (currently 30 providers are supported) in advance, thus protecting it from unauthorized access. Info about Boxcryptor

Boxcryptor also offers a file-sharing service that allows you to share encrypted files via a share link—much like Dropbox's native file-sharing feature. The Sharing service from Boxcryptor is called Whisply and works browser-based.

It’s a great idea in theory and very functional. But when I tested it, I found this „workaround“ to be cumbersome. And it still didn’t guarantee an EU server location for my clients. Some of them, however, insisted on that.

So there was only one option for me: ditch Dropbox and store my work data on a self-hosted server in Germany. So I went in search of an open source cloud storage script that would

• has a release feature on board,
• that I can run on my own server,
• that is accessible from my other devices via app and
• ensures perfect synchronization.

My software solution is called „Seafile.“ The Pro version can be used with a free license for up to 3 users. But it’s also suitable for both small and larger teams Seafile price interesting.

I registered a user account on seafile.com and got access to the source files, the Github repository of Seafile and the extensive documentation. I then set up a LEMP stack on one of my root server at the company Netcup GmbH (Simply enter the voucher code for new customers worth € 5 during the order process: 36nc16160577660) in Karlsruhe for use with Seafile: Ubuntu 20.04 LTS, Nginx, MariaDB, a subdomain with a proxy setup for Seafile, PHP 7.4 and 8.x were also installed in addition to the Python libs required for the tool.

I then installed Seafile on the prepared server and put my new GDPR-compliant company cloud into operation. I removed all the data from my Dropbox, moved the data on my local computer to the new Seafile directory and started the synchronization. Both the installation and the setup went smoothly and without any problems.

Addendum on 18.11.2021: Even now, after some time of productive use, I am still very satisfied with this solution. It works flawlessly and is even much faster and better performing than my Dropbox ever was when syncing.

Addendum on 21.03.2023: In the meantime, I have found a data protection-compliant cloud solution for less tech-savvy users. The product Storage Share from Hetzner – For example, 5 TB of pre-installed Nextcloud for just €16.89 per month.

What do you think about these solutions? How have you solved the cloud storage issue in your company?
I look forward to your answers in the comments section.