Proton Drive alternative: Kerveros
Proton Drive is end-to-end encrypted and backed by one of the strongest privacy brands around, with mobile and web apps and managed storage on a subscription. If you want a polished managed service from a privacy-focused company, it’s a great pick. Kerveros tackles the same core goal — keeping the host blind to your files — with different trade-offs. Here’s the honest comparison.
What the two have in common
- End-to-end / client-side encryption. Both encrypt your data so the storage host can’t read it. Kerveros uses XChaCha20-Poly1305 with keys derived via Argon2id from a passphrase that never leaves your machine.
- Privacy as a first principle. Proton has a strong reputation and an open-source posture; Kerveros publishes its source for review and ships a proprietary signed binary.
What Kerveros does differently
- You bring your own bucket and keys (BYOK). Proton Drive stores your data on Proton’s managed infrastructure as part of the subscription. Kerveros talks directly to an S3-compatible bucket you own — AWS S3, Backblaze B2, Tigris, or self-hosted MinIO. No Kerveros service sits in the data path.
- One-time purchase, not a subscription. €79 Personal / €299 Team (up to 5), one year of updates included, optional €29/year renewal afterwards. The version you bought keeps working forever.
- Encrypted filenames, always on. The manifest mapping file IDs to names is itself encrypted — your storage provider sees opaque blobs, not folder structure.
- Desktop-first collaboration with file locks. Kerveros is a native macOS, Windows, and Linux app. Atomic locks let a team coordinate edits to the same file with a tamper-evident audit trail of every check-in and check-out — rather than relying purely on sync.
- No vendor storage lock-in. Your files live in your bucket and decrypt locally with your passphrase. Switch storage providers whenever you like.
Side-by-side
| Capability | Proton Drive | Kerveros |
|---|---|---|
| Encryption model | End-to-end encrypted | Client-side (XChaCha20-Poly1305 + Argon2id) |
| Storage | Managed by Proton (included) | BYOK — any S3-compatible bucket you control |
| File-name encryption | Yes | Yes — always on, encrypted manifest |
| Multi-user lock coordination | Sync-based sharing | Yes — atomic S3 locks + audit trail |
| Platforms | Desktop, mobile, web | Desktop (macOS, Windows, Linux) |
| Vendor storage lock-in | Data on Proton infrastructure | None — your own bucket and keys |
| Pricing model | Free tier + subscription | €79 one-time (€299 Team), no subscription |
Who should choose which
Choose Proton Drive if… you want a managed end-to-end-encrypted cloud from a privacy-focused company, with mobile and web apps and a free tier to start, and a subscription works for you.
Choose Kerveros if… you want to own the storage bucket and keys, pay once instead of monthly, avoid vendor storage lock-in, and need desktop-first team collaboration with file locks and always-on filename encryption.
Migrating from Proton Drive
There’s no automated converter — the two store data in completely different ways — but the path is simple:
- Download your files from Proton Drive to your machine.
- Create a bucket on any S3-compatible provider — the Kerveros onboarding wizard recommends Tigris (5 GB free, no card) and auto-fills endpoints for Backblaze B2, AWS S3, and MinIO.
- Drag the files into Kerveros. They’re re-encrypted on your machine — contents, names, and structure — before upload.
The 14-day trial is full-featured with no card required, so you can run the whole migration before paying a cent.
Bottom line
Proton Drive is an excellent managed, privacy-first cloud for people who want encryption handled for them across desktop, mobile, and web. Kerveros is for people who’d rather own the storage and the keys, pay once, and keep a desktop-first team workflow with file locks — with their cloud provider blind to both contents and filenames.