Pli Scellé vs SwissTransfer: zero-knowledge encryption is the real gap

SwissTransfer, made by Infomaniak, sends up to 50 GB for free, with no account, and keeps files for 30 days. Infomaniak is a respected Swiss host, its data centers sit in Switzerland, and the service encrypts your files during transfer (AES-GCM) and at rest on its servers (LUKS and AES-256). That is genuinely good engineering, and nobody here claims otherwise.

The question that matters is not «is it encrypted?» but «who can decrypt?». With SwissTransfer, the keys live server-side: Infomaniak encrypts files once they reach its infrastructure, so the operator technically holds the means to read them. With Pli Scellé, the key is generated in your browser and placed in the URL fragment (the part after the #), which is never sent to the server. As a result, we cannot read your files, even under a legal request. That is what zero-knowledge means.

Many comparisons describe SwissTransfer as «end-to-end encrypted». The term is misleading. Encryption in transit protects your data between your machine and the server, and encryption at rest protects it on disk. Neither stops the operator from decrypting, since the operator manages the keys. Infomaniak's own security page mentions an «ultra-secure tunnel» and a «double lock» on storage, without ever stating that the key stays out of the operator's reach. Privacy-minded users even advise caution for highly sensitive files.

Zero-knowledge moves the encryption into the browser before anything is uploaded. The server only ever receives already-encrypted content and never gets the key. For a password, a contract, an HR export or a legal file, that distinction changes everything.

Jurisdiction first. Switzerland holds an adequacy decision from the European Commission, so transferring data to Infomaniak remains GDPR-compliant. Still, many French organisations (public administrations, the public sector, cautious IT departments) prefer hosting and an editor directly subject to French and European law, without relying on an adequacy mechanism. Pli Scellé is published by SHPV FRANCE SAS and hosts exclusively in France.

Self-destruct next. Where SwissTransfer applies a fixed 30-day retention, Pli Scellé lets you pick a lifetime from 1 hour to 30 days depending on the plan. At expiry, the share is purged with no residual copy. A shared secret can vanish in an hour instead of sitting on a server for a month.

Enterprise features last. SwissTransfer targets fast consumer-grade sending. Pli Scellé adds SSO/SAML single sign-on from the Essential plan, SCIM provisioning from Pro, audit logs, an IP allowlist on Pro, two-factor authentication and passkeys. Receive links let a third party drop a file to you securely. ClamAV antivirus scans non-encrypted content. No advertising tracking.

On pricing, the free tier covers 5 shares, 100 MB, 1 day, without zero-knowledge encryption. Zero-knowledge starts at the Découverte plan (€185 excl. tax/year, around €17/month), then Essentiel at €560 excl. tax/year and Pro at €1,400 excl. tax/year. The Enterprise plan is tailored. SwissTransfer stays free with no subscription: an excellent choice for occasional, non-sensitive sending. As soon as real confidentiality, French jurisdiction and access control come into play, Pli Scellé answers a need SwissTransfer does not target.