WHAT THE POLICIES SAY

Proton AG is a Geneva-based company operating end-to-end encrypted mail, drive, calendar, password, and VPN services, whose privacy policy states its overriding aim is to collect as little user information as possible and that it lacks the technical means to access encrypted content. Since June 2024 its primary shareholder has been the nonprofit Proton Foundation, endowed with shares donated by its founders. In September 2021 Proton was legally compelled by a binding Swiss order, with no avenue of appeal, to log and disclose the IP address of an account used by a French climate activist -- encrypted content remained inaccessible, Proton disclosed the episode the same day, and it subsequently won a Swiss ruling exempting email services from telecom data-retention obligations.

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

Proton

THIS FILE HEADS ITS OWN CHAIN.

SUBSIDIARIES ON FILE (2)

TOOLS WE RECOMMEND

PLUS

RECEIPTS

12 ON FILE

[2026-05-12] · COLLECTION

Proton's privacy policy, last updated 2026-05-12, states that its overriding policy is to collect as little user information as possible, that it does not retain permanent IP logs by default, and that IP addresses may be kept temporarily to combat abuse or permanently where terms are violated.

proton.me ↗

[2024-06-17] · OWNERSHIP TRANSPARENCY

Proton announced on 2024-06-17 that the nonprofit Proton Foundation had become the primary shareholder of Proton, endowed through share donations from founder Andy Yen, co-founder Jason Stockman, and first employee Dingchao Lu, with Proton pledging 1% of net revenues to the foundation when conditions allow.

proton.me ↗

[2026-05-12] · OWNERSHIP TRANSPARENCY

Proton's privacy policy identifies the operating company as Proton AG, domiciled in Geneva, Switzerland, placing the service under Swiss jurisdiction.

proton.me ↗

[2026-05-12] · SHARING

Proton's privacy policy states that it will only disclose the limited user data it possesses if legally obligated by a binding request from the competent Swiss authorities; the policy describes no advertising, analytics, or data-partner sharing of user data.

proton.me ↗

TRACK RECORD

Proton runs a funded public bug bounty program with published scope and reward bands: its program page sets a maximum reward of USD 100,000, critical severity at USD 25,000-50,000, high at USD 2,500-25,000 and medium at USD 1,000-2,500, enumerates in-scope categories for web, desktop, mobile and server targets, points researchers to a published vulnerability disclosure policy, and states that safe-harbor terms protect qualifying good-faith testing from liability.

proton.me ↗

[2021-09-06] · TRACK RECORD

As reported by TechCrunch on 2021-09-06, ProtonMail logged the IP address of an account used by a French climate activist after receiving a legally binding order from Swiss authorities, routed from French investigators via Europol; the data contributed to an arrest in France. Proton subsequently won an October 2021 Swiss ruling that email services are not telecommunications providers and are therefore not subject to telecom data-retention requirements.

techcrunch.com ↗

[2021-09-06] · TRACK RECORD

In its same-day 2021-09-06 clarification, Proton stated it had received a legally binding order from Swiss authorities it was obligated to comply with, that there was no legal possibility to resist or fight that particular request, that authorities could obtain only IP address information and not encrypted content, and that Proton did not know the account belonged to climate activists because it does not know user identities by design.

proton.me ↗

[2021-10-26] · TRACK RECORD

Proton documented a legal challenge it brought against the Swiss government and its public outcome: in a post published 2021-10-26 Proton stated it launched the challenge in May 2020 against what it described as an improper use of telecommunications law, and that the Swiss Federal Administrative Court confirmed email services are not telecommunications providers and are therefore not subject to the data-retention requirements imposed on telecommunications providers. The post notes the ruling followed an April 2021 Swiss Supreme Court decision in a case brought by Threema (2C_544/2020) reaching the same conclusion for instant messaging.

proton.me ↗

[2026-01-06] · TRACK RECORD

Proton publishes a transparency report carrying per-year request and compliance counts. The edition updated 2026-01-06 reports for Proton Mail 9,301 legal orders in 2025 (988 contested, 8,313 complied with), 11,023 in 2024 (655 contested, 10,368 complied with) and figures back to 2017; for Proton VPN it reports 59 orders in 2025, 53 in 2024, 60 in 2023, 80 in 2022, 121 in 2021 and 37 in 2020, all recorded as denied because Proton states it holds no VPN activity logs to produce. Proton states that only requests arriving through official Swiss channels are legally binding on it.

proton.me ↗

[2026-06-16] · TRACK RECORD

Proton VPN has commissioned recurring independent no-logs audits from the European security firm Securitum and publishes the resulting reports. The audit page, last updated 2026-06-16, describes a fifth consecutive annual third-party audit of Proton VPN's server infrastructure and operating procedures, with links to the 2022, 2023, 2024, 2025 and 2026 reports; Proton states Securitum experts spend several days on site each year reviewing VPN and server configuration files and interviewing staff.

protonvpn.com ↗

[2021-09-06] · TRACKING TECH

In its 2021-09-06 statement on the climate-activist case, Proton stated that under no circumstances can its encryption be bypassed, meaning emails, attachments, calendars and files cannot be compromised by legal orders -- content protection is architectural rather than discretionary.

proton.me ↗

[2026-05-12] · TRACKING TECH

Proton's privacy policy states that it does not have the technical means to access the content of users' encrypted emails, files, calendar events, passwords, or notes, and that under no circumstances can Proton decrypt end-to-end encrypted content and disclose decrypted copies.

proton.me ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7