In short, while a great choice compared to most other similar service providers, Proton’s track record has started showing inconsistencies between their privacy/security claims and the truth.

Lets start off with proton mail’s E2E encryption. While the ideal is awesome, the fact is metadata isn’t encrypted. This results in sender/receiver info, the subject lines, timestamps, and IP addresses available in the logs. Meaning if the Swiss government wants that data, proton legally must comply. Their 2025 transparency report had over 9,000 legal requests, and they complied with 89% of them. This counters the many proton promotions claiming they have no access to user info. Along these same lines, proton identified a political activist to Swiss authorities due to a US legal request that led to about 60 activists being brought up on RICO charges. Additionally, proton made a similar mess by suspending the accounts of journalists working on a North Korean hacker story at the request of a cybersecurity agency they refused to name. While they eventually reinstated the accounts, this rightfully led to public criticism, seeing as proton promotes being a private, secure, and journalist-friendly service.

There are also controversies surrounding the inaccurate or incorrect use of the terms non-profit and open-source. Proton has framed itself as a nonprofit organization pretty hard more recently, this being the Proton Foundation, which is the biggest shareholder of Proton AG. But Proton AG is without question a for-profit business, and it also runs all the services offered by Proton. It’s said this was done to prevent another tech company from buying the majority of the share but seems more to be a cover for the fact they’re ultimately in it for the money. This being the case actually helps make more sense of their AI controversy. Since day one, they said Lumo was an open source privacy-focused model, but the only code published so far is for the website and mobile apps, with nothing at all for Lumo itself, even though it was released in June 2024.

So while there’s no doubt they do a number of things extremely well, they also talk a real big game and seem to be unable to back it up across the board.