Tresorit alternative: Kerveros
Tresorit is a well-regarded end-to-end-encrypted cloud — Swiss-based, audited, with a clean desktop, mobile, and web experience and built-in managed storage. If you want a fully managed service and don’t mind a subscription, it’s a solid choice. Kerveros solves the same core problem — keeping your cloud provider blind to your files — with different trade-offs. Here’s the honest comparison.
What the two have in common
- End-to-end / client-side encryption. Both encrypt your data so that the storage host can’t read it. Kerveros uses XChaCha20-Poly1305 with keys derived via Argon2id from a passphrase that never leaves your machine.
- A real privacy posture, not marketing. Tresorit has a long track record and independent audits; Kerveros publishes its source for review and keeps a proprietary signed binary.
What Kerveros does differently
- You bring your own bucket and keys (BYOK). Tresorit stores your data on its own managed infrastructure as part of the subscription. Kerveros talks directly to an S3-compatible bucket you own — AWS S3, Backblaze B2, Tigris, or self-hosted MinIO. There’s no Kerveros service in the data path.
- One-time purchase, not a subscription. €79 Personal / €299 Team (up to 5), one year of updates included, optional €29/year renewal afterwards. The version you bought keeps working forever.
- Encrypted filenames, always on. The manifest mapping file IDs to names is itself encrypted — your storage provider sees opaque blobs, not “Q3-payroll.xlsx”.
- Local-first desktop with file locks. Kerveros is a native macOS, Windows, and Linux app. Atomic locks let a team coordinate edits to the same file with a tamper-evident audit trail of every check-in and check-out.
- No vendor storage lock-in. Your files live in your bucket and decrypt locally with your passphrase. Switch storage providers, or keep a plain copy of the bucket, whenever you like.
Side-by-side
| Capability | Tresorit | Kerveros |
|---|---|---|
| Encryption model | End-to-end encrypted | Client-side (XChaCha20-Poly1305 + Argon2id) |
| Storage | Managed by Tresorit (included) | BYOK — any S3-compatible bucket you control |
| File-name encryption | Yes | Yes — always on, encrypted manifest |
| Multi-user lock coordination | Sync-based collaboration | Yes — atomic S3 locks + audit trail |
| Platforms | Desktop, mobile, web | Desktop (macOS, Windows, Linux) |
| Vendor storage lock-in | Data on Tresorit infrastructure | None — your own bucket and keys |
| Pricing model | Subscription | €79 one-time (€299 Team), no subscription |
Who should choose which
Choose Tresorit if… you want a fully managed end-to-end-encrypted cloud with mobile and web apps out of the box, you’re happy not to run your own storage, and a subscription fits your budget.
Choose Kerveros if… you want to own the storage bucket and keys, pay once instead of monthly, keep your data in an S3 provider you can switch at will, and need desktop-first team collaboration with file locks and encrypted filenames.
Migrating from Tresorit
There’s no automated converter — the two store data in completely different ways — but the path is simple:
- Download your files from Tresorit to your machine.
- Create a bucket on any S3-compatible provider — the Kerveros onboarding wizard recommends Tigris (5 GB free, no card) and auto-fills endpoints for Backblaze B2, AWS S3, and MinIO.
- Drag the files into Kerveros. They’re re-encrypted on your machine — contents, names, and structure — before upload.
The 14-day trial is full-featured with no card required, so you can run the whole migration before paying a cent.
Bottom line
Tresorit is a strong managed service for people who want encryption handled end-to-end without touching infrastructure. Kerveros is for people who’d rather own the storage and the keys, pay once, and keep a desktop-first team workflow with file locks — with their cloud provider blind to both contents and filenames.