MEGA
Verified“New Zealand-governed, Hong Kong-owned — but its data sleeps in the EU.”
- Ultimate parent
- 🇭🇰 Hong Kong
- Where data lives
- 🇪🇺 EU only (no US)
- Encryption
- Zero-knowledge
- Users
- 300M+
36 = midpoint of Control 19 & Data 53
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 16 sourced facts across 7 independent sources, last verified 2026-06-12. 4 open questions hold confidence at 72% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
22
Operating entity is incorporated in New Zealand (Mega Cloud Services Limited) and the terms are governed exclusively by New Zealand law and arbitration. EU law reaches MEGA only indirectly via GDPR's extraterritorial scope (it serves and processes EU users), not via establishment or enforceable domicile. No EU operating entity holds the service. Scores low because the controlling legal home is firmly outside the EU.
Why 22? 4 sourced facts · click to expand
Operating entity incorporated in New Zealand
businesscheck.co.nz (NZ registry data) · as of 2026-06-12
Service governed by NZ law and arbitration exclusively
CyberInsider MEGA review · as of 2026-06-12
Claims GDPR compliance for all users worldwide despite non-EU domicile
WHTop MEGA review · as of 2026-06-12
Registered office is a foreign-tenanted Auckland tower (Huawei Centre)
businesscheck.co.nz · as of 2026-06-12
Control & Ownership
15
Voting and economic control sit outside the EU. The NZ operating company is 99.83%-owned by Hong Kong-based Cloud Tech Services Limited, named as the ultimate holding company. Behind that, control traces to Chinese investors (Li Zhi Min ~43%, Yang Jianhong ~24% per the 2015 majority-control raise) and the company's Megaupload/Kim Dotcom origins. Privately held, no listing. Zero EU voting or economic majority.
Why 15? 4 sourced facts · click to expand
Hong Kong holding company owns 99.83% and is the ultimate parent
businesscheck.co.nz (NZ registry data) · as of 2026-06-12
Chinese investors took majority control in 2015 raise
NZ Herald · as of 2015-08
Founded by Kim Dotcom as Megaupload successor; he severed ties in 2015
Wikipedia (Mega service) · as of 2026-06-12
Privately held; no public listing venue
NZ Herald · as of 2015-08
Data →
Where your data lives and who can reach it
Data & Infrastructure
62
Unusually strong for a non-EU company. User files are stored only in jurisdictions the European Commission deems adequate under GDPR Art. 45 — Belgium, France, Germany, Luxembourg, Netherlands, Spain, Sweden, plus Canada and Japan — and MEGA states none of your files are stored in or served from the US, removing direct CLOUD Act exposure. CloudRAID datacentres are concentrated in the EU. Critically, encryption is client-side/zero-knowledge: keys never leave the user's device, so even the operator cannot decrypt content. Held below 80 because the infrastructure is operated by a non-EU-controlled company and provider/datacentre operators are mixed (some leased, e.g. EU colocation), not EU-sovereign-owned, plus latency copies can transit other countries (e.g. Mongolia).
Why 62? 4 sourced facts · click to expand
Files stored only in GDPR Art. 45-adequate jurisdictions; none in the US
CyberInsider MEGA review · as of 2026-06-12
CloudRAID datacentres concentrated in EU
WHTop MEGA review · as of 2026-06-12
Client-side zero-knowledge encryption; operator cannot decrypt
CyberInsider MEGA review · as of 2026-06-12
Primary IPs resolve to EU colocation (Luxembourg)
myip.ms · as of 2026-06-12
Operations & People
40
Genuinely mixed. Head office and registered domicile are in Auckland, New Zealand (CEO Stephen Hall), with disclosed European operational footholds — a European office in Salamanca, Spain and a head office cited in Csomád, Hungary, plus representatives in Luxembourg. So real staff and operations touch the EU, but corporate leadership and reporting are NZ-centred. Workforce geography and reporting currency are not EU-anchored, so this lands mid-range rather than EU-centered.
Why 40? 4 sourced facts · click to expand
European offices in Salamanca (Spain) and Csomád (Hungary)
WHTop MEGA review · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
4 open questions — they lower confidence, never the score
- ?
Who ultimately controls Cloud Tech Services Ltd (Hong Kong) today, and what are the current beneficial-ownership percentages?
The 2015 figures (Li Zhi Min 43%, Yang Jianhong 24%) predate the consolidation into the HK holdco; current control could shift the ownership score up or down.
- ?
Are MEGA's EU datacentres owned/operated by EU entities, or leased from non-EU or hyperscaler operators?
If colocation is on US-controlled providers, CLOUD Act exposure could re-enter despite EU geography, lowering the infra score.
- ?
Exact current country list and proportion of data by jurisdiction (and the role of latency copies, e.g. Mongolia).
Affects how cleanly 'EU-resident' the data actually is and whether non-adequate transit occurs.
- ?
Whether MEGA has an EU establishment or only a GDPR Art. 27 representative.
Determines how directly EU regulators can enforce against the company versus relying on extraterritorial reach.
EU Cloud Sovereignty Framework lens
SEAL targets cloud-provider sovereignty; this is an analogous mapping for a consumer/B2B encrypted storage service, not a certification.
Strategic
Strategic control sits with a Hong Kong holding company and Chinese investors; no EU strategic anchor.
Legal & jurisdictional
Incorporated in NZ, governed exclusively by NZ law and arbitration; EU reach is only extraterritorial via GDPR.
Data & AI
Data stored only in GDPR-adequate jurisdictions, never the US; client-side zero-knowledge encryption keeps keys with the user.
Operational
HQ and leadership in NZ, but real operational offices in Spain and Hungary plus EU representatives.
Supply chain
EU/Canada/Japan datacentre footprint, but operator ownership of those facilities is unverified; some EU colocation confirmed (Luxembourg).
Technological
Proprietary CloudRAID + client-side crypto with source published for verification, but the platform is closed and non-EU-controlled.
Security & compliance
Strong zero-knowledge model and stated GDPR compliance; encryption design has historically drawn scrutiny and there's no public EU certification.
Environmental sustainability
No verified data found on energy sourcing or sustainability commitments.
EU alternatives
End-to-end encrypted storage with EU/Swiss datacentres and an EU operational base, but owned by Swiss Post (non-EU Switzerland) — strong privacy, control not EU.
Offers EU (Luxembourg) data region and client-side 'Crypto'; Swiss-headquartered, so outside EU jurisdiction though GDPR-aligned.
EU-incorporated (Valencia) zero-knowledge encrypted storage with EU data residency — a genuinely EU-controlled MEGA peer.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology