Swiss Post Acquires Tresorit: Encrypted Cloud Security

Swiss Post Acquires Majority Stake in Tresorit

Swiss Post, which transitioned to a private limited company in 2013, has expanded its operations into logistics, financial services, transportation, and even drone delivery. Despite this diversification, it continues to function as Switzerland’s national postal service. Recently, Swiss Post has acquired a controlling interest in Tresorit, a Swiss-Hungarian startup recognized as a pioneer in end-to-end-encrypted cloud services within Europe.

Financial Details and Swiss Post's Strategic Shift

The specific financial terms of the acquisition have not been publicly disclosed. However, Swiss Post has experienced declining revenues in recent years, driven by a continuous decrease in traditional letter volumes. A 2019 assessment highlighted the necessity for the company to identify new revenue streams.

Tresorit's Funding History

Tresorit’s most recent funding round occurred in 2018, securing a €11.5 million Series B investment. Key investors included 3TS Capital Partners and PortfoLion. Additional support came from business angels and serial entrepreneurs such as Má́rton Szőke, Balázs Fejes and Andreas Kemi. Crunchbase data indicates that Tresorit raised under $18 million throughout its decade-long existence.

The Growing Importance of Data Security

This acquisition underscores the increasing value placed on data security. A well-established brand like Swiss Post recognizes the strategic benefit of enhancing its digital service offerings with a reputable startup specializing in end-to-end (e2e) encryption.

The Evolution of "Zero Access" Encryption

“Zero access” encryption, while initially a niche concept over a decade ago, has now become the industry standard for secure information handling. Numerous providers now offer e2e encrypted services to both businesses and individual consumers.

Collaboration and Future Development

In a joint press release, Swiss Post and Tresorit announced their intention to “collaborate to further develop privacy-friendly and secure digital services.” This will allow individuals and businesses to exchange information securely and privately.

Tresorit's Continued Independence

Following the acquisition, Tresorit will operate as an independent entity within the Swiss Post Group. The company will continue serving its existing markets in the EU, the U.K., and the U.S. The current management team, brand identity, and service offerings will remain unchanged.

Tresorit's Secure Cloud Services

Founded in 2011, Tresorit provides “ultra secure” cloud services, including storage, file synchronization, and collaboration tools. These services are primarily targeted towards business users, with a global customer base exceeding 10,000. A core feature is its “zero access” architecture, ensuring that Tresorit itself cannot decrypt customer data as it does not possess the encryption keys.

Expansion and Market Strengthening

Tresorit anticipates that the acquisition will facilitate further expansion in key markets, including Germany, Austria, and Switzerland. The strong brand recognition of Swiss Post is expected to be a significant asset in these regions.

Integration with Existing Swiss Post Services

The companies also foresee opportunities to integrate Tresorit’s technology into Swiss Post’s existing digital product portfolio. This includes services like a “digital letter box” application (ePost) and an encrypted email service, demonstrating a foundation for synergy.

Statements from Leadership

Istvan Lam, co-founder and CEO of Tresorit, stated: “From the very beginning, our mission has been to empower everyone to stay in control of their digital valuables. We are proud to have found a partner in Swiss Post who shares our values on security and privacy and makes us even stronger. We are convinced that this collaboration strengthens both companies and opens up new opportunities for us and our customers.”

Rationale Behind the Acquisition

When questioned about the decision to pursue an acquisition rather than alternative paths like an IPO, Lam emphasized Swiss Post’s “trusted” brand and the alignment of values and mission.

“Tresorit’s latest investment round concluded in 2018, marking the typical lifecycle for venture-capital-backed companies,” he explained to TechCrunch. “An IPO was a viable option within the next 3-4 years. However, Swiss Post’s commitment to data privacy perfectly aligns with our core values. This partnership provides long-term strategic advantages, combining Tresorit’s end-to-end encryption with the trusted reputation of Swiss Post.”

Swiss Post's Perspective

Nicole Burth, a member of the Swiss Post Group executive board and head of communication services, added: “Tresorit has paved the way for true end-to-end encryption across the software industry over the past decade. With the acquisition of Tresorit, we are strategically expanding our competencies in digital data security and digital privacy, allowing us to further develop existing offers.”

Switzerland as a Privacy Hub

Switzerland has historically been a center for privacy-focused startups and services, owing to its strong privacy laws.

Evolving Surveillance Landscape

However, recent reports indicate an increase in state surveillance activity in Switzerland, following a 2018 amendment that broadened intercept capabilities to include digital communications.

The Importance of Encryption in the Face of Surveillance

While concerning, these developments may reinforce the importance of e2e encryption as a technical safeguard against state-sanctioned privacy intrusions.

Potential Legislative Challenges to Encryption

Conversely, there is a risk that legislators may view widespread encryption adoption as a threat to national security and respond with legislation restricting its use. Australia has already enacted anti-encryption laws, and the U.K. expanded its surveillance powers in 2016.

EU's "Lawful Access" Agenda

At the EU level, lawmakers are pursuing an agenda of “lawful access” to encrypted data, while simultaneously expressing support for encryption’s role in data security and privacy. The practical implementation of this approach remains uncertain.

Positive Legal Developments

A recent ruling by Europe’s top court has complicated the transfer of personal data outside the region, particularly to countries like the U.S. where it may be subject to mass surveillance.

Increased Demand for European Cloud Services

Lam noted that Tresorit has observed growing interest in its services following the “Schrems II” ruling. “Being a European-based company has already been a competitive advantage, especially among our business and enterprise customers.”

EU Data Adequacy and Switzerland

EU law distinguishes between the national security powers of member states and those of third countries. While Switzerland is not an EU member, it maintains close ties to the bloc’s single market.

Sustainability of Switzerland's Data Adequacy Decision

Concerns persist regarding the sustainability of Switzerland’s EU data adequacy decision, given the potential for its expanding domestic surveillance regime to violate individuals’ fundamental rights.

Encryption as a Solution to Legal Uncertainty

If Switzerland loses EU data adequacy, it could impact the compliance requirements of digital services based in the country. However, e2e encryption could provide a technical solution for Swiss companies to navigate such legal challenges.

This report was updated to correct that Swiss Post is in fact still state-owned; we originally mischaracterized it as a “former” state-owned mail delivery firm