Should Your Invoices Live in Dropbox?
After the backup article I keep getting the same email: "Vlad, I already pay for Dropbox. Can't the invoices just live there?" Short answer: yes, as one copy. No, as the only one. The long answer is this page.
Key takeaways
- The question is not where the files live. It is who controls them.
- The cloud is a fine copy and a bad home.
- Dropbox as the offsite copy in 3-2-1: fine. As the only copy: one password from disaster.
- Never sync a live database. Sync exports and closed copies.
- The rule: primary local, cloud as one of the copies, restores tested.
The question is not where. It is who.
"Where should my invoices live?" feels like a practical question. It hides the real one: who can read them, change them, delete them, and charge you for the privilege?
A folder on your disk answers all four with "you." A cloud account answers them with "the vendor, and you too." That is not an argument against the cloud. It is an argument for knowing which one you chose.
Run the Cloud Trap check on your storage: if the vendor disappears tomorrow, can you still read your history? If the answer is no, your invoices are guests in someone else's house. Sovereign data means the opposite: your business files answer to you.
I have watched a freelancer keep five years of invoices in one Dropbox folder. It worked. Right up to the first sync conflict after a laptop change. Then the folder showed three versions of the same database, and none of them opened. The cloud had done its job perfectly. The job just was not his.
When the cloud is the right call
I do not hate Dropbox. I hate unexamined defaults. The cloud earns its place in specific roles:
- The offsite copy in your 3-2-1 setup. Something has to survive a fire. An encrypted export in Dropbox does that cheaply.
- Sharing with an accountant. A shared folder of PDFs and CSVs is fine. It is output, not the source of truth.
- Version history for documents you iterate on. Contracts and proposals, yes.
- Access while traveling. Grabbing a PDF from a phone beats carrying a laptop.
Notice the pattern. In every good role, the cloud holds a copy or an export — never the original. The full argument for the copies is in the backup problem article.
Why Dropbox alone is not enough for invoice storage
The problems start when the copy becomes the home:
- The only copy. One suspended account, one forgotten password, one "unusual activity" flag between you and your business history.
- A live database under sync. Sync tools copy files mid-transaction and write them back from two places. That is exactly how SQLite databases get corrupted — the whole story is in the corruption article.
- Terms you did not read. The provider can change retention, pricing, or access. You find out by email, after the fact.
- Keys you do not hold. If the vendor holds the encryption keys, the vendor can decrypt — for support, for compliance, in a breach.
And the vendor risk list is not theoretical: a forgotten password, a suspended account, a pricing change, a provider shutdown, a deleted file. Any one of them, and a cloud-only setup becomes an evening of reconstruction.
Why sync and SQLite do not mix
SQLite expects exclusive write access to its file. A sync client copies files block by block, on its own schedule, sometimes from two machines at once. Those two models do not meet well. The sync tool sees a file. SQLite sees a transaction. When they disagree, the file loses.
Some free services also analyze usage data or build revenue on behavioral data. Read the privacy policy before your financial history becomes part of that model. That is vendor lock-in in its quiet form — and the opposite of data portability.
The 3-2-1 rule: local primary, cloud copies
One rule settles every version of this question: the primary lives local; the cloud holds copies.
- Primary: a local database or folder you fully control.
- Copy two: an external drive on your desk.
- Copy three: an encrypted export in Dropbox, Drive, or OneDrive. The brand does not matter.
- Sync exports and closed PDFs. Never the live database file.
- Once a quarter, restore one file from the cloud copy and check it. Verification, not possession.
That is the whole setup. It costs one external drive and five minutes a season. Offline-first primary, plain-text exports, and the cloud demoted to what it is good at: being somewhere else.
Moving everything out of a single Dropbox folder
- Export CSV and PDFs from the current place.
- Move the primary to a local folder or tool.
- Point Dropbox at encrypted exports only.
- Add the external drive.
- Test one restore next quarter.
If your current setup is "everything in one Dropbox folder," the fix is an afternoon, not a migration project. See how a local primary works >
The decision matrix
| Property | Local disk | Dropbox as the only copy | Dropbox as one of the copies |
|---|---|---|---|
| Works without internet | Yes | No | Yes — the local copy works |
| Vendor can lock you out | No | Yes | No |
| Provider holds the keys | No | Yes | No, if the archive is encrypted |
| Survives a disk fire or theft | No | Yes | Yes |
| Good as primary | Yes | No | n/a |
| Good as offsite copy | n/a | Risky | Yes |
| Your situation | Verdict |
|---|---|
| Encrypted exports as the offsite copy | Yes — that is what offsite means |
| Shared folder of PDFs for the accountant | Yes — output, not source |
| The only place your invoices exist | No — one password from disaster |
| Live database file under sync | Never — sync corrupts live databases |
| Working documents you edit with others | Fine for the draft; the signed copy lives local |
Primary > copies. Not copies > primary.
What LockMargin does here
LockMargin keeps the primary on your machine: a local SQLite database, encrypted, in open formats. It does not sync, on purpose. It exports CSV, JSON, and PDF — exactly the files your cloud copy should hold. The division of labor is honest: your machine owns the record; the cloud holds a spare. The three-level automatic backup system behind that primary is documented in How We Built a Backup System Nobody Asked For.
Honest limits: no mobile app, no real-time sync. If those are your real need, the cloud is your answer — just go in knowing it is rent. The storage side of this argument is in Own Your Data.
If your invoices hold client data that deserves extra care, read the GDPR guide. And if you want the philosophy behind "primary local," it is in the manifesto.
Questions freelancers ask
Is Dropbox a good backup for invoices?
Yes, as one offsite copy among several. No, as the only one. The cloud earns its place as the offsite copy in a 3-2-1 setup, not as the home of your records.
What is wrong with keeping invoices only in the cloud?
Control. A suspended account, a forgotten password, or a terms change can sit between you and your history. If the vendor can delete, lock, or read your files, your records are guests in someone else's house.
Can a cloud provider read my invoices?
By default, yes. Dropbox, Google Drive, and OneDrive encrypt your files, but they hold the keys — so they can decrypt for support, legal requests, or a breach. Client-side encryption, where only you hold the key, is the exception you have to configure.
Should I sync my accounting database to Dropbox?
No. Sync tools copy files in the middle of transactions and write them back from two places. That is exactly how live databases get corrupted. Sync exports and closed copies, never the live file.
What is the simplest safe setup?
A local primary you control, an external drive on your desk, and an encrypted export in any cloud folder. Once a quarter, restore one file from the cloud copy and check it.
Does this apply to Google Drive and OneDrive too?
Yes. The brand is not the issue; the model is. Any service where the vendor holds the keys and the terms behaves the same way.
How long should I keep invoices as a freelancer?
Keep invoices and supporting records for as long as your tax authority can ask about them — commonly three to seven years depending on the country. After that window, keep the archive anyway: it is your business memory, and storage is cheap.
Is Dropbox GDPR compliant for client invoices?
Dropbox offers GDPR tools such as DPAs and EU storage options, and compliance is shared: the provider secures the infrastructure, you control what you upload and who can access it. For sensitive client data, encrypt before upload or keep it local. The obligation stays with you.
About the Author
Vlad (Volodymyr) Shiyan — Founder & Developer, Kharkiv, Ukraine. Building LockMargin since December 2025. Offline-first invoicing for freelancers who are tired of subscriptions. Standard is $49 one-time. Read more about Vlad →
Ready to own your freelance data?
Own your tools for $49 once → Read the Manifesto →Get the Client Data Protection Checklist — PDF, no email required.
Not ready to own yet? Start is free — 5 clients, 5 projects a month, unlimited invoices.
No subscription · No account required · Your data stays yours forever