Is Tresorit HIPAA compliant?
Yes, Tresorit states plainly that it signs business associate agreements, which is more than most encrypted-storage vendors will say, but you still have to ask for one and plan for what zero-knowledge encryption costs you.
Applies to Tresorit encrypted cloud storage. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Ask Tresorit for the business associate agreement and have it executed before patient files are uploaded. Tresorit states it 'signs HIPAA Business Associate Agreements (BAA) with customers seeking HIPAA compliance'.
- Understand what zero-knowledge means for recovery. End-to-end encryption is the reason the product suits this data, and it is also why a lost account key can mean permanently lost records: set up admin recovery deliberately.
- Control external sharing. Share links are the ordinary way files leave an encrypted store; set expiry, passwords and open limits as policy rather than per file.
- Keep a record of which tresors hold patient information, so the vendor register and any later access request have something to work from.
- Check device access. Encryption at rest does nothing about a synced laptop that is not itself encrypted and locked.
Does Tresorit sign a business associate agreement?
Yes. Tresorit offers one. Not stated. Tresorit's security page says it signs agreements with customers seeking HIPAA compliance without naming a plan. Not described on the security page beyond the statement that Tresorit signs them. Request it through Tresorit sales or support before uploading patient data.
What this means in practice
Tresorit is one of the few encrypted-storage vendors that says the quiet part publicly: it signs business associate agreements. That single sentence is worth more than a page of security marketing, because in this category most vendors describe their encryption at length and never say whether they will contract.
What zero-knowledge buys you is that Tresorit cannot read the files. What it costs you is that Tresorit cannot recover them either. For a practice, that trade is usually right and occasionally catastrophic: it is the reason to set up administrative recovery on day one rather than after the first departing employee takes their key with them.
The sharing surface is where encrypted stores leak. Not through the encryption, through a share link somebody set to never expire.
How organizations get this wrong
- Uploading first and asking for the agreement afterwards, on the assumption that a vendor which advertises HIPAA has already covered you.
- Skipping admin recovery setup, then discovering the design guarantees the data is gone.
- Creating share links without expiry, password or open limits, which is the ordinary way files leave an encrypted vault.
- Assuming a personal or free tier carries the same terms as a business subscription. Tresorit does not say it does.
What the agreement does not cover
- Anything you copy out of Tresorit. The protection is a property of the store, not of the file.
- Recovery of data whose keys are lost, which is the direct consequence of the zero-knowledge design.
- Plan scope, which Tresorit's security page does not state: confirm the agreement covers the subscription you actually hold.
Keep a record of your Tresorit agreement
Sources
- Security and compliance at Tresorit: Tresorit. Read August 24, 2026.
Tresorit can change these terms at any time. If something here no longer matches what Tresorit tells you, tell us.