Your Client NDA Probably Requires Encrypted Storage. Here's What That Actually Means.

_Last updated: 2026-05-28_

> Not legal advice. This article discusses general patterns in data security obligations common to contractor agreements. For anything binding on your specific situation, consult a lawyer.

The Clause You Probably Skimmed

Pull up the last NDA you signed. Look for language around any of these phrases:

• "commercially reasonable security measures"
• "reasonable care to protect"
• "industry-standard safeguards"
• "encryption at rest and in transit"
• "no less protective than measures used to protect Recipient's own confidential information"
• "comply with applicable data protection regulations"

If the client is a tech company, a financial services firm, a healthcare organization, or any enterprise with its own legal and security team, there is a strong chance at least one of these phrases appears in your agreement.

The weaker versions ("reasonable care") leave interpretation open. The stronger versions name specific standards or require encryption by specification. But even "commercially reasonable security measures" has shifted in meaning — what qualified as reasonable in 2018 is not what qualifies in 2026. Courts and regulators have increasingly treated client-side encryption as a baseline expectation for sensitive professional data, not a premium feature.

The implication: "I stored it in Google Drive" is an increasingly weak defense when client data appears in a breach disclosure or a contract dispute.

---

What "Reasonable Measures" Actually Means in 2026

Legal standards for data security in contracts tend to track industry norms with a lag — but a few things have shifted enough to matter.

Encryption is no longer the differentiator — key control is. Ten years ago, "encrypted storage" meant using a service that encrypted data at rest. Every major cloud provider does this now. The harder question is: who holds the encryption keys?

When you store files in Google Drive, Google encrypts them at rest using Google's keys. Google can decrypt those files. Google has done so in response to law enforcement requests and in the course of content scanning. From a practical security standpoint, "Google Drive encrypts your data" means Google encrypts it — not you.

If your NDA requires that confidential information remain protected from unauthorized disclosure, a fair question follows: is a third party's ability to decrypt your files "authorized"? In most cases, your client didn't authorize Google to have access. They authorized you.

Data residency has become a clause in enterprise NDAs. For clients with EU operations, NDAs now commonly specify that their data cannot be stored on infrastructure subject to US legal jurisdiction. The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) extended US government reach to data stored by US companies anywhere in the world — including EU data centers. If your client is EU-based or handles EU citizen data, storing their files with Google, Microsoft, or Amazon creates a potential CLOUD Act exposure that your NDA may explicitly prohibit.

This isn't theoretical for freelancers doing work for European fintech companies, legal firms, or healthcare providers. If your contract specifies EU data residency and you're storing client files in Google Drive, you're out of compliance before anything bad has happened.

---

Why Standard Cloud Storage Creates a Liability Gap

To be precise about what you're accepting when you use standard cloud storage for client work:

The service provider can read your files. Google, Dropbox, and Microsoft use their own encryption keys, not yours. Their terms of service give them broad latitude to access, scan, and disclose content for policy compliance, service improvement, and law enforcement cooperation.

Breaches expose plaintext. When a provider that holds server-side keys is breached, an attacker gains access to both encrypted data and the keys needed to decrypt it. When a zero-knowledge provider is breached, the attacker gains only ciphertext with no viable path to the plaintext.

You have limited visibility into who has accessed client files. If a government agency subpoenas Google for a user's files, Google can comply — and is frequently restricted from notifying the user by non-disclosure orders. You would not know your client's confidential files had been accessed. Your NDA obligation to maintain confidentiality would have been violated by a process you couldn't see or control.

Metadata is readable even when content is "encrypted." Standard cloud providers encrypt file contents but store metadata — filenames, folder structure, access timestamps, sharing history — in readable form. Someone with server access doesn't need to decrypt your files to learn a great deal about your work: who you're sharing with, what projects you're working on, when you're accessing what.

None of this means your data will definitely be exposed. It means the exposure is architecturally possible in ways that a well-drafted NDA may prohibit, and in ways that create liability in a dispute.

---

The CLOUD Act Problem for International Client Work

If you do any work for clients with European operations, or for clients who handle data subject to GDPR, this deserves specific attention.

The CLOUD Act (2018) requires US-based cloud providers — Google, Microsoft, Amazon, Dropbox — to provide user data to US law enforcement when legally compelled, regardless of where the data is physically stored. A US government warrant can reach Google Drive files stored in EU data centers.

This creates a compliance conflict for work governed by both a US-signed NDA and GDPR. GDPR restricts the transfer of EU personal data to non-EU jurisdictions without adequate safeguards. If a US government request compels Google to disclose EU citizen data you're storing on Drive, GDPR was violated through a mechanism neither you nor your client could prevent — and your NDA may have named you as responsible for that protection.

Swiss-based providers like Tresorit operate under Swiss data protection law, which has a robust framework but is not subject to CLOUD Act jurisdiction. Swiss law requires domestic legal process for data requests, with significant procedural protections that make US-style emergency disclosure orders inapplicable. For clients specifying non-CLOUD-Act-subject storage, Swiss jurisdiction specifically satisfies the requirement.

---

How Zero-Knowledge Storage Changes Your Exposure

Zero-knowledge storage changes the compliance picture in a specific way: it removes the provider from the threat model entirely.

With Tresorit, files are encrypted on your device before they leave it. Tresorit's servers store ciphertext. Tresorit does not hold decryption keys. When law enforcement contacts Tresorit with a data request, Tresorit can provide the encrypted data and genuinely cannot provide decryption keys — because they don't possess them.

This architectural distinction has concrete implications for the clauses in your NDA:

"Confidential information shall be encrypted using industry-standard encryption at rest and in transit." Tresorit uses AES-256 client-side encryption. This clause is satisfied with auditable documentation — Tresorit publishes its security architecture and holds ISO 27001, SOC 2 Type II, and GDPR certifications.

"No unauthorized third party shall have access to confidential information." With zero-knowledge storage, the storage provider is not an authorized third party with access — it's an infrastructure provider with no ability to access the content. The cryptographic architecture, not a contractual promise from Google, enforces this.

"Data shall not be transferred to jurisdictions without adequate data protection." Swiss jurisdiction with no CLOUD Act applicability satisfies EU data residency requirements that US-based providers cannot meet by design.

The posture shift: instead of arguing "we trust Google's security team," you're asserting "it is cryptographically impossible for the storage provider to disclose plaintext data, regardless of who asks." Those are categorically different defensive positions.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

---

The Compliant Freelancer File Stack

Building a workflow that satisfies even demanding NDA data security requirements doesn't require rebuilding everything from scratch.

Tier 1: Documents and deliverables → Tresorit

Everything a client gives you and everything you give them belongs here. Tresorit Drive integrates with your file system as a standard sync folder. Your existing applications — text editors, design tools, IDEs — write to local paths that sync transparently. The encryption is invisible at the application layer.

Specific practices that matter:

• Create a separate vault per client. Clear separation makes it obvious that Client A's data cannot be accessed when working on Client B's vault.
• Use Tresorit's share links with expiry dates and download limits for all external deliverables — not Drive links, not email attachments of raw files.
• Store signed NDAs and contracts in Tresorit itself. Storing the NDA in unencrypted cloud storage while trying to comply with its security provisions is a gap worth closing.

Tier 2: Communication records → consider encrypted alternatives for sensitive threads

If your client correspondence references their confidential information, email is in scope. Proton Mail provides end-to-end encryption for client communications when both parties use it. For clients on standard email, consider moving sensitive exchanges out of email threads and into Tresorit's secure message feature, or use Signal for time-sensitive communications that don't need archiving.

Tier 3: Working notes → zero-knowledge notes app

Standard Notes provides E2EE note-taking that syncs across devices. If your working notes contain client-specific analysis, proprietary terminology, or confidential project details, keeping them in a notes app that can read them creates the same exposure as standard cloud storage.

What you're not required to change:

Your code editor, your task manager, your time-tracking app, your calendar. The goal is protecting client-designated confidential information specifically, not rebuilding your entire workflow around maximum privacy at every layer.

---

Before You Sign Your Next NDA

A few things worth doing before the next agreement lands in your inbox:

Read the data security section. It's usually 2-4 paragraphs. Look for the phrases listed at the top of this article. If you find specific technical requirements — named encryption standards, compliance frameworks, data residency restrictions — flag them explicitly and confirm you can satisfy them before signing, not after.

Ask about their data classification policy. Enterprise clients often classify information by sensitivity tier (confidential, restricted, internal, public — terminology varies). Ask whether they have a data handling policy and what storage tools are approved or prohibited for each classification level. This gives you clear guidance rather than forcing you to interpret "reasonable measures" on your own.

Document your security stack. If you're using Tresorit for client work, you can document this proactively. ISO 27001 cert, SOC 2 Type II report availability, encryption standard, jurisdiction. If a question ever arises, your defense isn't "I think Drive is probably fine" — it's a documented compliance posture with third-party certifications attached.

Add a data security schedule to your own contracts. If you issue statements of work or agreements to clients, consider adding a brief schedule naming the tools you use for their data and their relevant security certifications. This sets expectations before you start work rather than negotiating them under pressure after a dispute arises.

---

Honest Trade-Offs

If your current clients don't have meaningful data security clauses, the compliance argument may not apply to your situation yet. Tresorit is still worth considering on general privacy grounds, but the liability argument is specific to contracts that are actually enforced.

Tresorit has no web-based document editing. Unlike Google Drive, you can't open a document in a browser and edit it in-place. Files are downloaded, edited locally, and re-uploaded. This is an expected trade-off for any zero-knowledge storage system — browser editing requires the server to decrypt the file to render it. It's an adjustment from a Google Workspace workflow, though not a burdensome one for most desktop-based work.

The price is deliberate. Individual plans run around $10-15/month. Business plans start around $15/user/month and add admin controls, audit logs, and policy enforcement. For a contractor billing $5K+ per month on client work, this is a marginal cost against the liability exposure. It's worth acknowledging it's not free-tier software.

Recovery key setup requires deliberate action. Zero-knowledge means no password recovery on Tresorit's end. Configure your recovery key before you rely on the vault for client work. Store it somewhere that won't be lost if your primary device is — a hardware password manager, an offline encrypted backup, a secure physical location.

---

The Bottom Line

The data security clause you skimmed in your last NDA is probably more specific than you remember. "Commercially reasonable security measures" in 2026 increasingly means client-side encryption, access controls, and documented compliance — not "we use a reputable cloud provider."

The gap between what you've committed to in contract language and what standard cloud storage actually provides is real. Zero-knowledge storage closes that gap — not by making you more secure in an abstract sense, but by removing the third parties who could compromise your NDA obligations from the threat model entirely.

Try Tresorit free for 14 days — no credit card required. Set up one client vault, do one secure delivery, and see whether it fits your workflow before committing.

---

Stay Current on Privacy and Compliance for Independent Tech Workers

NDAs, data residency law, and cloud provider terms evolve faster than most freelancers track. I cover the changes that actually affect independent tech workers handling sensitive client work.

---