Dropbox
Verified“US company, US-controlled, US-hosted by default.”
- Listing
- Nasdaq: DBX
- Paying users
- 18.22M
- FY2024 revenue
- $2.548B
- Employees
- 2,204
12 = midpoint of Control 10 & Data 13
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 13 sourced facts across 8 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 90% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
12
Incorporated in Nevada, USA and run from San Francisco; the operating entity is wholly US and subject to US law (CLOUD Act, FISA 702). No EU establishment governs the core service.
Why 12? 3 sourced facts · click to expand
Dropbox completed reincorporation from Delaware to Nevada effective March 5, 2025; it remains a US corporation.
SEC EDGAR - Dropbox Form 8-K (2025) · as of 2025-03-05
Dropbox's principal executive offices are at 1800 Owens Street, San Francisco, California, placing the operating entity squarely under US jurisdiction.
SEC EDGAR - Dropbox Form 10-K FY2024 · as of 2024-12-31
As a US-incorporated and US-operated provider, Dropbox is subject to the US CLOUD Act and FISA, which can compel disclosure of data regardless of storage location.
SEC EDGAR - Dropbox Form 10-K FY2024 · as of 2024-12-31
Control & Ownership
8
Founder-CEO Drew Houston holds ~77% of voting power through 10-vote Class B shares; the company trades on Nasdaq with US economic majority. Voting and economic control are firmly US.
Why 8? 3 sourced facts · click to expand
Drew Houston controls roughly 77% of voting power via Class B shares carrying 10 votes each, giving the US co-founder a voting supermajority.
Reuters/Investing.com - Half Moon Capital proposal · as of 2025
Dropbox has a dual-class structure: Class A (1 vote) held by public investors and Class B (10 votes) held by insiders including the founders.
SEC EDGAR - Dropbox Form 10-K FY2024 · as of 2024-12-31
Dropbox Class A common stock is listed on the Nasdaq Global Select Market under the ticker DBX, a US listing venue.
SEC EDGAR - Dropbox Form 10-K FY2024 · as of 2024-12-31
Data →
Where your data lives and who can reach it
Data & Infrastructure
10
Default user content lives in Dropbox's own 'Magic Pocket' data centers in the US. EU data residency exists but is seat-gated and runs on AWS (a US hyperscaler) in Frankfurt/Paris, so even the EU option carries CLOUD Act exposure.
Why 10? 4 sourced facts · click to expand
Dropbox migrated ~90% of its data off AWS into its own 'Magic Pocket' infrastructure across three US data centers around 2015-2016.
Data Center Knowledge - Dropbox reverse migration · as of 2021
Dropbox's default storage region is the United States; EU/Germany residency is an opt-in choice rather than the default.
Dropbox Help - data residency · as of 2025
EU data-hosting for Dropbox Business/Enterprise/Education is delivered via Amazon Web Services infrastructure in Germany, i.e. on a US hyperscaler.
Dropbox Blog - European infrastructure · as of 2018
EU data residency is gated to higher-seat business tiers, so most individual and small-team users' content remains in the US.
Dropbox Community / DataCenterDynamics · as of 2018
Operations & People
18
HQ in San Francisco, US-majority workforce (1,755 of 2,204 employees in the US), USD reporting and US leadership. Operations are US-centered with a minority abroad.
Why 18? 3 sourced facts · click to expand
As of December 31, 2024, Dropbox had 2,204 full-time employees, of which 1,755 were in the US and 449 outside the US.
SEC EDGAR - Dropbox Form 10-K FY2024 · as of 2024-12-31
Dropbox reported fiscal 2024 revenue of $2.548 billion, reported in US dollars.
Dropbox Investor Relations - Q4/FY2024 results · as of 2024-12-31
Dropbox is led by US co-founder and CEO Drew Houston from its San Francisco headquarters.
SEC EDGAR - Dropbox Form 10-K FY2024 · as of 2024-12-31
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
What share of total user content is stored under EU data residency vs the US default?
If only a small fraction of EU customers qualify and opt in, the practical infra exposure is even more US-concentrated than the headline option suggests.
- ?
Exact current Class B voting percentage held by Drew Houston post any 2025 sales or the Half Moon Capital proposal outcome.
Confirms whether founder voting control remains a supermajority; the ~77% figure is from press reporting, not the latest proxy.
- ?
Whether Dropbox has any EU-incorporated subsidiary that is a controller/processor with meaningful local governance.
Could marginally raise EU legal reachability, though it would not change US parent control or CLOUD Act exposure.
EU Cloud Sovereignty Framework lens
The EU Cloud Sovereignty Framework (SEAL) is designed to certify cloud service providers; applying it to Dropbox is an analogous mapping for comparison, not an actual certification or assessment.
Strategic
US-headquartered, US founder-controlled public company; EU has no strategic leverage over its direction.
Legal & jurisdictional
Incorporated in Nevada, run from San Francisco; subject to US CLOUD Act and FISA, with no EU-governing entity for the core service.
Data & AI
Default storage is the US in Dropbox's own data centers; EU residency is opt-in, seat-gated and runs on AWS.
Operational
Operations and leadership are US-centered; majority of staff in the US, USD reporting.
Supply chain
EU data-residency option depends on AWS (US hyperscaler); core stack and vendors are US-anchored.
Technological
Owns and operates its own Magic Pocket storage tech rather than renting hyperscaler storage by default, but the technology and IP are US-controlled.
Security & compliance
Holds common certifications (e.g. ISO 27001, SOC) and offers GDPR DPAs, but US legal access undermines sovereignty-grade compliance for EU buyers.
Environmental sustainability
Publishes corporate responsibility data, but EU sovereignty-relevant environmental criteria were not assessed here.
EU alternatives
Swiss-owned and Swiss-hosted with strong privacy; Switzerland is outside the EU but has a GDPR adequacy decision.
End-to-end encrypted; Hungarian-founded, now Swiss Post-owned, hosted in the EU/EEA. Non-EU ultimate owner.
EU-incorporated (Spain), zero-knowledge encrypted cloud storage marketed as a GDPR-native Dropbox alternative.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology