Is SwissTransfer Really Secure? What You Need to Know in 2026
By Simon Themiot - freelance cybersecurity consultant. Published May 19, 2026.
Summary
- SwissTransfer encrypts your files in transit (TLS) and at rest (server-side AES), but Infomaniak holds the decryption keys. This is not end-to-end encryption.
- Switzerland is not in the EU, but benefits from a European Commission adequacy decision. The transfer therefore needs no additional safeguard solely because of its destination.
- SwissTransfer is generous for large files (50 GB free, up to 30 days). For confidential data, its documented model does not keep the content key from the provider.
- To reduce content exposure at the provider, PrivCloud offers optional browser-side AES-256-GCM E2E, French hosting, and open source code.
Table of contents
1. SwissTransfer: overview and how it works
SwissTransfer is a free large file transfer service operated by Infomaniak, a Swiss hosting company based in Geneva. Launched in 2019, it allows sending up to 50 GB per transfer without registration, with configurable availability (up to 30 days). SwissTransfer positioned itself as a European WeTransfer alternative, capitalising on the security and neutrality image associated with Switzerland.
SwissTransfer's advantages are real: generous file size (50 GB free), no intrusive advertising, password protection available, simple interface. But when it comes to cryptographic security, reality is more nuanced than the marketing image suggests.
2. What encryption does SwissTransfer use?
SwissTransfer uses two layers of encryption:
- Encryption in transit (TLS 1.2+): Your files are protected during transfer between your browser and Infomaniak's servers. This is the web standard in 2026 - every serious site uses it.
- Encryption at rest (server-side AES): Once stored on Infomaniak's servers, files are encrypted. But the encryption keys are managed and held by Infomaniak.
Encryption at rest protects media, backups, and snapshots. If the provider can deliver content without an external key, it is not a barrier against authorised provider access, a valid legal request, or a compromise reaching the application and its keys.
Important technical point
SwissTransfer's public documentation does not present E2E encryption that keeps the content key away from Infomaniak. The provider therefore remains technically able to process the file. The link password is useful access control, but does not by itself show that content is encrypted with a server-unknown key.
3. Is SwissTransfer zero-knowledge?
No. In a zero-knowledge model applied to E2E content, the provider does not receive the key needed to decrypt files. Key distribution must remain between authorised clients without passing through the server in usable form.
The transfer is protected by TLS, but no E2E key independent of the server is documented. In practice, that puts the service inside the content trust boundary. Password protection limits access to the link, which remains useful against accidental sharing.
When E2E is enabled, PrivCloud encrypts the file in the browser with the Web Crypto API (AES-256-GCM) before upload. For E2E links, the key is placed in the URL fragment (after #), which is not sent in the HTTP request. A storage leak then does not expose content, provided the key and endpoints are not compromised.
4. GDPR and Swiss hosting: the implications
Switzerland is not a member of the European Union. However, the European Commission has granted Switzerland an adequacy decision (Article 45 GDPR), meaning transfers of personal data to Switzerland are permitted without additional standard contractual clauses. This is a real advantage over the United States.
Nevertheless, for a French company subject to GDPR, using SwissTransfer still implies:
- Document the transfer to Switzerland in your activity register.
- Verify that Infomaniak's DPA covers Article 28 GDPR obligations.
- Review the process applicable to Swiss legal requests and Infomaniak's contractual commitments.
- Assess every breach according to actual risk: encryption at rest does not automatically remove the analysis and obligations under Articles 33 and 34.
Hosting in France can simplify mapping without eliminating every processor or security question. E2E reduces content exposure, but the data remains personal for the controller and metadata may remain readable. Incident obligations depend on context and risk.
5. When to use SwissTransfer and when to avoid it
SwissTransfer is an excellent service for certain uses. Here is a clear guide:
SwissTransfer is suitable for:
- Non-confidential large files (marketing videos, public photos, public archives).
- One-off transfers where content is not sensitive.
- Situations where file size (up to 50 GB) is the main criterion.
- Sending to recipients with no contractual confidentiality requirements.
SwissTransfer should be avoided for:
- Sensitive personal data (healthcare, HR, legal, banking).
- Documents subject to professional secrecy (lawyers, notaries, doctors).
- Intellectual property files with strategic value.
- Any transfer where you cannot accept the provider reading the content.
- Situations where your security policy requires zero-knowledge.
6. FAQ
Does the SwissTransfer password really protect my files?
The SwissTransfer password protects access to the download link. It is a useful barrier: without the password, you cannot download the file. But the file itself is not encrypted with that password. Infomaniak can still access the content server-side. It is the difference between a padlock on the door and a safe.
Is SwissTransfer better than WeTransfer for security?
Both document encryption in transit and at rest without an E2E model that withholds the key from the provider. SwissTransfer stands out with 50 GB free, up to 30 days, password support, and Swiss storage. WeTransfer states that EU-IP uploads are stored in the EU. The right choice therefore depends on volume, controls, and risk assessment.
Can Infomaniak scan my files on SwissTransfer?
The documented model does not remove Infomaniak's technical ability to process content. This does not prove proactive scanning occurs. Check the current privacy policy, terms, and legal procedures. In a zero-knowledge model, the provider may remain unable to deliver plaintext content while still holding metadata.
Related articles
Need a truly confidential transfer?
PrivCloud offers optional browser-side end-to-end encryption, temporary hosting in France, open source code, and up to 2 GB without an account. When E2E is enabled, the server does not receive the content key.
Last updated: July 14, 2026. Analysis based on Infomaniak's public documentation and SwissTransfer terms available on that date.