Internxt vs HexaTransfer: European Privacy Showdown
Two European privacy-first services compared: Internxt vs HexaTransfer on encryption, GDPR compliance, open-source code, and transfer features.
Internxt and HexaTransfer both prioritize European privacy but solve different problems. Internxt is a Spanish-based zero-knowledge cloud storage and transfer platform with 10 GB free persistent storage, AES-256 client-side encryption, open-source clients on GitHub, and GDPR/CCPA compliance. HexaTransfer is a French-based ephemeral transfer service with 10 GB per transfer, AES-256-GCM encryption, no accounts, 7-day expiration, and French-only hosting. Both score well on European privacy criteria; the choice depends on whether you need persistent storage (Internxt) or zero-friction transfers (HexaTransfer).
Company Origins and Jurisdictions
Internxt is headquartered in Valencia, Spain, with data centers across the EU. Spain operates under GDPR directly and has its own Organic Law 3/2018 on Data Protection (LOPDGDD) adding national provisions. The Spanish data protection authority (AEPD) is one of the more active EU regulators.
HexaTransfer is French, hosting exclusively in France. CNIL jurisdiction, GDPR-native, no cross-border transfers. Both services provide EU-resident hosting with strong regulatory environments. Neither routes through the US, UK, or Asia.
Encryption Approaches
Internxt uses AES-256-CTR for file encryption with keys derived from user passwords. Files are chunked, each chunk encrypted independently, and distributed across nodes using a Merkle tree for integrity verification. The approach is based on the Sia/Storj decentralized storage patterns, though Internxt operates as a centralized service.
HexaTransfer uses AES-256-GCM (authenticated encryption) for the entire file, with keys generated fresh per transfer via the Web Crypto API. GCM mode provides built-in authentication that detects any tampering. When passwords are set, PBKDF2 with 600,000 iterations derives the wrapping key. Simpler architecture optimized for single-file ephemeral transfers.
Both are solid AES-256 implementations. GCM is the current best practice for general use; CTR is also acceptable when paired with separate integrity verification (which Internxt does via Merkle trees).
Open-Source Transparency
Internxt publishes its client code on GitHub (github.com/internxt), including the desktop apps, mobile apps, and web client. Security researchers can audit the encryption implementation directly. Internxt has also commissioned third-party audits from firms like Securitum, with reports published on their site.
HexaTransfer's web client code is inspectable in-browser (standard JavaScript from the web page), but there's no formal open-source repository with issue tracking and community contributions. For transparency-focused users, Internxt's posture is stronger.
Persistent Storage vs Ephemeral Transfer
Internxt is a cloud storage service. Files you upload persist until you delete them. 10 GB free, up to 10 TB paid (€9.99/month for 2 TB is a sweet spot). Cross-device sync via desktop (Windows, macOS, Linux) and mobile (iOS, Android). Shared links with password protection and expiration (1–30 days).
HexaTransfer is an ephemeral transfer service. Files exist for 7 days and then are cryptographically destroyed. 10 GB per transfer, free, no storage limit in the traditional sense because nothing persists. Browser-only — no apps, no sync, no folder hierarchy.
Features Beyond Transfer
Internxt Drive is accompanied by Internxt Photos (encrypted photo backup from mobile), Internxt Send (up to 5 GB ephemeral transfer), and Internxt Meet (encrypted video calls). The portfolio positions Internxt as a Proton-style privacy-focused suite.
HexaTransfer is single-purpose. No photo backup, no video calls, no mail. For users who want one tool that does one thing well, the focus is a feature. For users building a complete privacy stack, Internxt's suite is more comprehensive.
Comparison Matrix
| Feature | Internxt | HexaTransfer | |---------|----------|--------------| | Country | Spain | France | | Data location | EU | France only | | Encryption | AES-256-CTR | AES-256-GCM | | Key derivation | bcrypt + client key | PBKDF2 600k | | Zero-knowledge | Yes | Yes | | Open-source client | Yes (GitHub) | Partial (inspectable) | | Third-party audits | Yes (Securitum) | Not published | | Free tier | 10 GB storage | 10 GB per transfer | | Max paid | 10 TB | N/A | | Retention | Indefinite | 7 days | | Account | Required | None | | Desktop apps | Win, Mac, Linux | Browser only | | Mobile apps | iOS, Android | Browser | | Other services | Photos, Send, Meet | None | | GDPR posture | EU-resident | EU-resident |
Pricing and Sustainability
Internxt offers free 10 GB storage and paid plans starting at €1.99/month for 20 GB, scaling to €29.99/month for 10 TB. Lifetime plans are sometimes offered for one-time payments (€299 for 2 TB lifetime, for example). The freemium model is clearly sustainable with a path to revenue.
HexaTransfer is free without paid tiers currently. Business model sustainability is a fair question for any free-only service. For ephemeral transfers, the storage costs are lower than a persistent cloud (files only live 7 days), which helps unit economics.
Recipient Experience
Internxt Send links open in a browser and download files directly — similar experience to HexaTransfer. For Internxt Drive shares, recipients without Internxt accounts can access via link; authenticated access requires an account.
HexaTransfer recipients always use links in a browser. No account option exists, so there's nothing to sign up for. Decryption happens client-side, transparent to the user.
Regulatory Compliance
Internxt states compliance with GDPR, CCPA, and HIPAA (as a cloud service; BAA availability varies by plan). ISO 27001 certification is a work-in-progress noted on their roadmap. The Spanish jurisdiction plus open-source client gives them strong regulatory credibility.
HexaTransfer is GDPR-aligned with French hosting. No HIPAA BAA offered (consistent with the no-account model). No published SOC 2 or ISO 27001 certifications currently. For organizations needing specific certifications, Internxt is further along the audit path.
Choosing Between the Two
Choose Internxt for ongoing encrypted cloud storage with desktop/mobile apps, open-source client verification, bundled photos and video calling, and long-term persistent encrypted storage. If you're moving off Google Drive or iCloud and want a privacy-focused replacement, Internxt is the more complete suite.
Choose HexaTransfer for one-off encrypted transfers where the recipient shouldn't need to create an account, where French-specific hosting matters, and where automatic deletion is preferred over indefinite storage. If you want a simple "encrypted WeTransfer" without the subscription overhead, HexaTransfer is exactly that.
Using Both
The two services layer naturally. Internxt as the persistent encrypted cloud for your own files and team collaboration. HexaTransfer for external deliveries to clients, journalists, lawyers, or anyone who shouldn't have to sign up for Internxt just to receive a single file. The jurisdictional split (Spain + France) is also a minor hedge against any single jurisdiction's legal environment changing.
For individuals building a European privacy stack, adding both to your toolbox takes about ten minutes total. Bookmark HexaTransfer for sends; use Internxt's desktop client for ongoing sync. Zero conflict, maximum flexibility.
Try it at hexatransfer.com — free, no account, 10 GB max.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file