Tresorit
File storage · tresorit.com · last read 2026-11-09
At a glance
- Is Tresorit GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Tresorit itself publishes, each answer linked to its source and the date we read it.
- Is Tresorit ISO 27001 certified?
- Tresorit states ISO/IEC 27001 (2022 edition, as Tresorit names it) on its own page, but does not say there how to get the certificate. In Tresorit's words: “Tresorit has certification for compliance with ISO 27001:2022. Tresorit was audited and certified by TÜV Rheinland, an independent third-party auditor.” We read this on 2026-11-09. Source and date
- Does Tresorit offer EU data residency?
- The EU is the default region for this vendor. Source and date
- Who are Tresorit's subprocessors?
- Tresorit lists 8 third-party subprocessors; 2 of them name at least one processing country outside the EEA. We last read the list on 2026-11-09. Source and date
- How do you report a security vulnerability to Tresorit?
- Tresorit publishes a security.txt at tresorit.com naming [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Tresorit AG |
|---|---|
| HQ | CH |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | tresorit.com · 2026-11-09 |
Tresorit data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | tresorit.com | 2026-11-09 |
EU: The document says that by default Tresorit stores data in European or Swiss data centers. Choosing a specific storage region is described as a feature of business and enterprise plans, but no plan or extra cost is named for the default European storage.
The same question for every vendor: where SaaS vendors store EU data.
Tresorit's subprocessor list names Microsoft for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
8 third parties · 2 of the vendor's own group companies · 2 with a country outside the EEA · all read 2026-11-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon | LU, IE | Simple Email Service (SES) for transactional and notification emails |
| Anthropic | IE | (No earlier than 26 November) AI-assisted code writing and deployment for developers, internal process optimization, and access to and analysis of CRM records to support sales operations |
| HubSpot | DE | HubSpot Marketing Hub for marketing automation and campaigns |
| Microsoft | IE | Application performance monitoring (APM), customer service, product development, Microsoft Copilot, Databricks, and Power BI business and data analytics services |
| Microsoft | IE | Azure cloud storage, compute, and networking services |
| Salesforce | IE | Customer relationship management (CRM) |
| Twilio | US | Messaging (two-factor authentication via voice and SMS); transactional and notification emails |
| Zendesk | US | Customer support tools |
Tresorit's own group companies listed as subprocessors (2)
| Company | Country | Purpose |
|---|---|---|
| Tresorit GmbH | DE | — |
| Tresorit Kft. | HU | — |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
No data processing agreement read yet.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Is Tresorit ISO 27001 certified?
Tresorit states ISO/IEC 27001 (2022 edition, as Tresorit names it) on its own page, but does not say there how to get the certificate. We read this on 2026-11-09.
- Claimed “Tresorit has certification for compliance with ISO 27001:2022. Tresorit was audited and certified by TÜV Rheinland, an independent third-party auditor.”
Source: tresorit.com, 2026-11-09
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | tresorit.com | 2026-11-09 |
| GDPR | Claimed | — | tresorit.com | 2026-11-09 |
| HIPAA | Claimed | HIPAA compliant cloud storage solution; signs HIPAA Business Associate Agreements (BAA) with customers | tresorit.com | 2026-11-09 |
| ISO 27001:2022 · ISO27001 | Claimed | — | tresorit.com | 2026-11-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Tresorit; Tresorit AG
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Tresorit; Tresorit AG
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Tresorit; Tresorit AG
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Tresorit; Tresorit AG
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Tresorit; Tresorit AG
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Tresorit; Tresorit AG
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2027-02-01; read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-11-09 |
| residency | Public | full | 200 | 2026-11-09 |
| subprocessors | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.