If you need a file sharing service that is genuinely European, the first thing to check is not where the servers are — it is where the company is incorporated. A US-owned company storing your files in Frankfurt is still subject to US legal process, and that one distinction rules out most of the services people assume are fine.
It matters more than it used to, because "EU data centre" has become a standard marketing line while "EU company" has not.
The distinction that decides this
Data residency is where the bytes physically sit. Almost every large provider offers an EU region now.
Jurisdiction is which government can compel the company to hand data over. That follows the company, not the disk.
A US-incorporated provider can be served with a legal demand for data it controls, wherever that data is stored. The longer explanation is here, and it is worth reading before you look at features, because it eliminates options rather than ranking them.
For most work this stays theoretical. It stops being theoretical with health data, legal files, public-sector material, or anything where a client's own compliance obligations flow down to you.
Europe is not the EU
Switzerland, Norway and the UK are in Europe and outside the EU. Adequacy decisions make transfers there generally straightforward — but if your requirement is written as "data must remain within the EU", which is how a lot of procurement is literally worded, a Swiss or British service does not meet it on its face, whatever its privacy record.
This catches people with SwissTransfer in particular: an excellent service, run by Infomaniak, a Swiss company. Excellent, and not EU.
The candidates
All figures from each company's own documentation, on the date stated. No competitor prices on this site.
SwissTransfer — Swiss, free, generous
From Infomaniak's own guide, checked 1 August 2026: 50 GB per transfer, free, no account, deleted after 15 days unless extended to 30, and archives over 10 GB downloaded one file at a time. The most generous free tier in the category from a company with a serious privacy reputation — Swiss, so read the section above before assuming it meets an EU requirement. Yungle vs SwissTransfer goes into the rest.
WeTransfer — founded in the Netherlands
From WeTransfer's plan-limits documentation, checked 31 July 2026: 3 GB or 10 transfers free across a rolling 30 days, ad-supported. One of the few household names in this category with European roots. If EU jurisdiction is the requirement and familiarity matters, it belongs on the list — but confirm today's corporate structure and sub-processors with them directly, not from a blog, mine included. Ownership changes, and this page cannot track it. Yungle vs WeTransfer sets out what its own pages say today.
Yungle — mine
Free is 10 GB per transfer, as many as you like, 7 days, no account, no ads. On a subscription, nothing expires.
Run by an EU business, hosted at Hetzner in Germany, with a published data processing agreement. Every file is always encrypted with its own key.
Since this page is about being checkable rather than persuasive, here is the part that answers my own question five below: files live with Hetzner, a German company, in Germany, and nightly backups go to a second Hetzner data centre in Finland. No US company holds the files or their backups. Weigh that exactly as you would for anyone else. Security lists the rest.
Filemail, Smash, Dropbox Transfer, Google Drive
Filemail and Smash are worth evaluating on capability: Filemail Pro sends up to 250 GB per transfer (checked 1 August 2026), and Smash's paid plans list transfer size as unlimited (checked 21 September 2026). If jurisdiction is your requirement, establish incorporation and sub-processors with each directly.
Dropbox and Google are US companies. Both offer EU storage and both take security seriously; neither removes the jurisdiction question. Whether Dropbox is GDPR-compliant is a fuller answer than a one-line dismissal.
What to actually verify
Do not take a comparison page's word for any of this — this one included. Ask the vendor, in writing:
- Where is the company incorporated? Not where the servers are.
- Who are the sub-processors, and where do they operate? A European company on US-owned infrastructure has moved the question, not answered it.
- Can we have a DPA? If the answer is a link to a marketing page, that is a no.
- Whose courts can compel you to produce customer data?
- Where are backups held, and by whom? Primary storage in the EU with backups elsewhere is a common gap — and yes, I asked it of myself above.
Question two is the one that catches European resellers built on US cloud. It is not automatically disqualifying — plenty of compliant setups look like that — but you need to know, because it changes the analysis.
If you are filling in a compliance questionnaire
The order that saves time: jurisdiction first, the DPA second, features only then. The other way round, you fall for a product you then cannot use.
And read what the GDPR actually requires before the questionnaire arrives. Most of what people believe it demands is not in it, and several things it does demand are routinely missed. If you are leaving US providers altogether, the European alternative page walks through the switch.