GrosFichiers alternative: simplicity or content confidentiality?

1. GrosFichiers: 10 GB free and without sign-up

GrosFichiers lets you transfer up to 10 GB for free and without signing up, for individuals and businesses alike. The sender uploads the files and enters the recipients, who each receive an email containing a download link.

The service puts care into tracking. As soon as a recipient downloads a file for the first time, the sender receives an email, and a page shows who downloaded each file and when. Files remain available for 14 days by default and up to 6 months at most. Ad-free paid packs are also available, including a Standard pack with 50 GB per transfer.

2. What security does GrosFichiers document?

The GrosFichiers FAQ mentions an "SSL-encrypted transfer authenticated by Sectigo". This is encryption of the connection between the browser and the server, whose identity is vouched for by a certificate issued by Sectigo. It prevents files from being intercepted on the network.

The pages reviewed, however, describe neither encryption of stored files, nor encryption in the browser, nor password protection for links. A lack of documentation does not prove these measures do not exist. For a sensitive file, it is a good reason to ask the provider for a written description of its security measures before using it.

3. SSL or end-to-end encryption: who can read the file?

SSL/TLS protects the path, not the destination. The encrypted connection ends on the provider's server, which then receives the file as it was sent. Without client-side encryption, content protection relies on the provider's organisation: access rights, disk encryption, backup handling. We cover this in our article on encryption at rest.

PrivCloud adds a layer before upload: the file is encrypted in the browser with AES-256-GCM, then sent. The key is placed in the link fragment, after #key=, which the browser does not send to the server. This encryption is enabled by default for account shares and can be turned off by explicitly deleting the key. The full process is described in our article on browser-side encryption.

The two layers are not competing. TLS remains essential, and end-to-end encryption addresses a different risk: access to the content once it is stored on the server.

4. France, Switzerland and GDPR

GrosFichiers says it owns its servers, located in Switzerland and France, and states that it complies with the General Data Protection Regulation. Switzerland benefits from a European Commission adequacy decision: a transfer to that country requires no additional safeguard solely because of its destination.

PrivCloud hosts files in France and publishes a data processing agreement (DPA). In both cases, GDPR is not just about server location: the controller must document the purpose, retention period, recipients and processors. See our guide to sending sensitive files under GDPR.

5. Size, retention and tracking: where GrosFichiers leads

GrosFichiers leads on free volume, with 10 GB without an account versus 3 GB per share on a PrivCloud Free account, and on retention, with 14 days by default versus 5 days at most on Free.

PrivCloud makes different choices: account required, short retention and encryption before upload. The Free plan is also limited to 15 shares per rolling 30 days and 6 GB of storage, and paid plans go up to 250 GB per transfer.