The Cloud You’re Already Using
‘The cloud’ is the server infrastructure that stores your files when you use iCloud, Google Drive, Dropbox, or OneDrive; that processes your email when you use Gmail or Outlook; that runs the apps you access through your browser; and that backs up your photos automatically when you take them on your phone. For most users, the cloud isn’t a deliberate technology choice — it’s the default infrastructure that the devices and services they use have adopted, usually in ways that aren’t prominently disclosed.
This ubiquity makes cloud security relevant to nearly everyone rather than to the technically sophisticated subset who consciously chose cloud services. Understanding what happens to your data when it’s in someone else’s infrastructure — who can access it, how it’s protected, and what the risks are — is basic digital literacy in an environment where cloud storage is the default.
The Shared Responsibility Model
Cloud security operates under a shared responsibility model: the cloud provider is responsible for the security of the underlying infrastructure (the physical data centres, the network, the virtualisation layer), and the customer is responsible for the security of what they put in that infrastructure (their own data, their access configuration, their user management). This division means that a data breach resulting from a provider’s infrastructure failure is the provider’s responsibility; one resulting from a customer’s misconfigured access settings or stolen credentials is the customer’s responsibility.
Most cloud data exposures that make news — the S3 bucket with sensitive data publicly accessible, the database exposed to the internet without authentication — are the customer-responsibility portion of this model: the cloud infrastructure was secure, but the customer’s configuration wasn’t. Understanding that the cloud provider’s security doesn’t automatically protect your specific data and access settings produces the appropriate level of active security management rather than passive assumption that ‘the cloud is secure.’
Encryption: At Rest and In Transit
Your data in major cloud services is encrypted at rest (stored in encrypted form on the provider’s servers) and in transit (encrypted during transmission between your device and the provider’s servers). The distinction that matters for privacy is who holds the encryption keys. In most major consumer cloud services (Google Drive, iCloud, Dropbox), the provider holds the encryption keys — meaning they can decrypt and read your data, comply with legal orders requesting your data, and potentially expose your data if their key management systems are compromised.
End-to-end encrypted cloud storage (where the encryption keys are derived from your password and never leave your device, meaning the provider genuinely cannot read your data) is available through providers like Proton Drive, Tresorit, and some configurations of Cryptomator for use with existing storage. This is the appropriate choice for genuinely sensitive content; standard cloud encryption is adequate for most personal content but doesn’t provide the same level of provider-inaccessibility.
Access Control: Who Else Can Reach Your Files
The most common way cloud data becomes accessible to unintended parties isn’t a provider breach — it’s sharing configurations that grant broader access than intended. Files shared with ‘anyone with the link’ in Google Drive are accessible to anyone who has the URL, including people who find it through search engine indexing if the file is publicly linked. Folders shared with a team member may grant that team member access to files in the folder that were intended to be personal.
Regular review of sharing settings in cloud storage is the practice that catches unintended access: Google Drive’s ‘Shared with me’ view and ‘Sharing’ settings on individual files and folders, iCloud’s shared albums and files, Dropbox’s sharing dashboard. Looking at each item that’s shared and confirming the sharing is intentional and appropriately scoped takes less than 30 minutes quarterly and catches the configurations that accumulate without review.
What Providers Do With Your Data
Cloud providers use the data you store with them in ways that vary significantly by provider and service type. Google’s consumer services explicitly use your content (emails, documents, searches) to improve their products and to target advertising, though Google has made changes to how this works following regulatory attention. Apple’s privacy position is that most iCloud data isn’t used for advertising and is processed with on-device and private cloud compute approaches that limit Apple’s access. Microsoft’s approach varies between consumer OneDrive and enterprise Microsoft 365 configurations.
The provider’s terms of service and privacy policy are the authoritative sources for what they actually do with your data — not the marketing page. The specific questions worth checking: does the provider use data from personal files and documents for product improvement or advertising? What happens to data if you cancel the service? What happens in a government legal demand? How are data breaches disclosed? These questions separate providers whose privacy practices align with user interests from those where the data relationship is primarily in the provider’s favour.