TransferNow alternative: server-side SSE-C or end-to-end encryption?
By Simon Themiot - freelance cybersecurity consultant. Published September 15, 2026.
Summary
- TransferNow Free: up to 5 GB per transfer, kept for 7 days at most, no sign-up, with password protection and antivirus scanning.
- TransferNow encrypts transfers with SSL/TLS and stored files with 256-bit AES. Paid plans add SSE-C, server-side encryption with a passphrase the service says it does not keep.
- PrivCloud encrypts the file in the browser (AES-256-GCM) before upload, by default for account shares. The server never receives the content key.
- TransferNow is more direct for a one-off transfer without an account. PrivCloud is built for files whose content the provider must not be able to read.
Table of contents
1. What TransferNow's free plan offers
TransferNow is a French large file transfer service operated by Highsense, a company based in Garches. Its free plan lets you send and receive up to 5 GB per transfer without creating an account. Files are kept for 7 days at most, and both password protection and antivirus scanning of transfers are included.
To send a presentation to a client or photos to a printer, the flow is quick: drop the files, get a link, the recipient downloads. The real security question starts once the files are stored: can the provider technically read their content?
2. TransferNow encryption: TLS, AES-256 and SSE-C
TransferNow documents two baseline protections: SSL/TLS encryption during transfer and 256-bit AES encryption of stored files. The first protects the network path, the second protects disks and backups. With standard encryption at rest, the service manages the keys and can therefore decrypt files to serve them to recipients. That is why encryption at rest is not enough for confidential documents.
On paid plans, TransferNow offers an additional option, presented on its security page as "Server-side encryption of your files with SSE-C". Stored files are encrypted with a key derived from a passphrase chosen by the customer. TransferNow states that it does not store this key and that files become unrecoverable if it is lost.
As its name says, SSE-C is still server-side encryption. The service applies it once the file has been received, with TLS protecting the path. It is a clear improvement over provider-managed encryption at rest, but it is not end-to-end encryption: the file is not encrypted on the sender's device before upload.
3. What PrivCloud's end-to-end encryption changes
PrivCloud encrypts each file in the browser with AES-256-GCM, through the Web Crypto API, before it leaves the device. For an end-to-end encrypted link, the key is placed in the URL fragment, after #key=. Browsers do not send this fragment in the HTTP request: the server stores encrypted content without receiving the key that can read it. The details are in our article on in-browser encryption.
This encryption is enabled by default for shares created with an account. Users can turn it off by explicitly deleting their key, in which case their shares are sent without end-to-end encryption. A file is only protected this way if E2E is active when it is sent.
The model also has limits. It protects neither an already compromised device nor a recipient who forwards the decrypted file. To avoid exposing the key contained in the address, PrivCloud does not embed any third-party analytics, advertising or tracking tool.
4. Limits, account and retention
The two services follow different logic. TransferNow lets you send 5 GB without an account, available for 7 days. PrivCloud requires an account, including on the free plan: the Free plan accepts 3 GB per share, 6 GB of storage, 15 shares per rolling 30 days and a maximum expiration of 5 days.
PrivCloud paid plans go up to 250 GB per transfer. At TransferNow, SSE-C is reserved for paid plans and choosing the storage country for Premium accounts and above.
5. Hosting and GDPR: look beyond the head office
By default, TransferNow stores files in the continental region closest to the user (Europe, America or Asia), even without an account. Choosing a specific country, among France, the Netherlands, Germany, Singapore and the United States, is reserved for Premium accounts and above. For a free transfer sent from France, the page therefore indicates a European region without naming the country.
Its privacy policy, last updated on April 29, 2025, lists several processors for file storage: Scaleway and OVH in France, DigitalOcean and Cloudflare in the United States.
PrivCloud is published by THEMIOT Informatique, hosts files in France and publishes a data processing agreement (DPA). No service makes processing GDPR compliant on its own: the controller still has to document the purpose, recipients, retention period and processors. See what the CNIL expects from a file transfer.
6. TransferNow and PrivCloud comparison table
Data checked on September 15, 2026 on TransferNow's official pages and in PrivCloud's default configuration.
| Criterion | TransferNow | PrivCloud |
|---|---|---|
| Free transfer without an account | Yes, up to 5 GB | No, account required |
| Free plan | 5 GB per transfer, 7 days | 3 GB per share, 5 days, 15 shares per 30 days |
| Encryption in transit | SSL/TLS | TLS |
| File encryption | 256-bit AES in storage | AES-256-GCM in the browser, before upload |
| Key chosen or held by the user | Server-side SSE-C, paid plans | Key generated in the browser, not sent to the server |
| Storage in France | Country choice with a Premium account or above | Yes |
| Password | Yes, included for free | Yes |
| Public source code | Not mentioned on the pages reviewed | Yes, BSD 2-Clause license |
7. Verdict: TransferNow or PrivCloud?
Choose TransferNow for an immediate transfer without an account, up to 5 GB, when the content is not confidential or when a password and antivirus scanning are enough. On a paid plan, SSE-C strengthens storage protection, keeping in mind that it is server-side encryption.
Choose PrivCloud when the provider must not be able to read the files: contracts, HR records, legal documents, financial documents. Encryption happens before upload, the code is public and hosting is in France. For personal data, complement this technical choice with the DPA and your own GDPR assessment.
8. FAQ
Is TransferNow end-to-end encrypted?
Not in the strict sense. TransferNow encrypts transfers with SSL/TLS and stored files with 256-bit AES. The SSE-C option on paid plans uses a passphrase the service says it does not keep, but this encryption is applied server-side, not in the sender's browser.
Is TransferNow free?
Yes. The free plan lets you send up to 5 GB per transfer without signing up, with retention of up to 7 days, a password and antivirus scanning. SSE-C requires a paid plan and choosing the storage country requires a Premium account or above.
Where does TransferNow store files?
By default in the continental region closest to the user. Premium accounts and above can choose a country, including France. The privacy policy names Scaleway, OVH, DigitalOcean and Cloudflare among its storage processors.
Can PrivCloud read my files?
Not when the share is end-to-end encrypted, which is the default with an account. The file is encrypted in the browser and the key stays in the link fragment, which the browser does not send to the server. The server does keep the metadata the service needs, such as file size and expiration date.
Related articles
Send files the server cannot read
The Free account includes 3 GB per share and 15 shares per rolling 30 days. End-to-end encryption is enabled by default, files are hosted in France and the source code is public.
Sources
Last updated: September 15, 2026. Information about TransferNow comes from the official pages listed above, accessed on that date. Plans and limits may change.