Proton Mail is a real email service run by Proton AG, a Swiss company owned by the non-profit Proton Foundation. Proton says your messages are encrypted so it can never read them, and its code is open source. The catch is that encryption protects content, not everything: Proton says Swiss authorities can still compel the limited data it holds.
If you're thinking about moving off Gmail, Proton Mail is the name that comes up first, so it's no surprise people ask whether it's safe. I've read Proton's own security, privacy and terms pages and Wikipedia's summary, and I'll be clear about what's a company claim and what an outsider has said.
Who runs Proton Mail and where it's based
According to Wikipedia, Proton Mail is run by Proton AG, a Swiss firm, and the company is owned by the non-profit Proton Foundation. The public beta began in 2014 and the service launched publicly in 2016. Proton's privacy policy says Proton AG is based in Geneva and that its services are governed by the laws of Switzerland.
How Proton Mail says its encryption works
Proton's security page says emails are encrypted at all times, so it can never access your messages, and it describes a zero-access architecture. In plain terms, zero-access means the company says it holds your messages in a form it can't read.
Wikipedia adds some detail: keys are generated in your browser, the private key is encrypted under your mailbox password, and Proton stores only encrypted keys. That's why the company can't reset a mailbox password for you, and why losing it can mean losing access. Keep your recovery details somewhere safe.
One honest limit: when you email someone on another provider, the message isn't protected in the same way unless you use Proton's password-protected option. Encryption works best when both ends take part.
Open source code and independent audits
Proton says all its apps are open source so people can inspect them, and that all Proton Mail code has been independently audited by third-party security experts, with the results published on its website. Wikipedia names one example: Securitum audited the security and cryptography in 2021 and found no major issues.
Open source helps, but it isn't a guarantee on its own. It means outsiders can look, not that everyone has. Treat the audits as a sign of seriousness, and check the dates if the version you use is much newer than the report.
What Proton can be forced to hand over
This is the part people tend to miss. Proton's privacy policy says it will only disclose the limited user data it possesses if it's legally obligated to, and that under no circumstances can it decrypt end-to-end encrypted content and disclose decrypted copies.
Wikipedia reports that Proton must follow valid Swiss court orders, and that its 2021 privacy policy said it can be compelled to log IP addresses in Swiss criminal cases. Proton's current policy says that by default it doesn't keep permanent IP logs for your account, though logs may be kept temporarily for abuse and fraud.
| What I checked | What Proton's pages say |
|---|---|
| Who runs it | Proton AG, Geneva, per its privacy policy |
| Can it read my emails | Proton says no, under its zero-access design |
| IP logs | No permanent IP logs by default; temporary logs possible for abuse |
| Legal orders | Only valid Swiss requests; no decrypted content to hand over |
| Code | Apps are open source and audited, as the company states |
Proton Mail free accounts, refunds and rules
Proton's terms say its services are for people at least 13 years of age, and bots or multiple free accounts for one person are prohibited. Free accounts that stay inactive for 12 months or more may be deleted, with notices to your recovery email 30, 15 and 7 days in advance. That surprises people who use a free account only as a backup address.
On paid plans, the terms say you may cancel within 30 days of the initial purchase for a full refund. It's limited to one request per user, and cash and bank transfer payments aren't refundable. Read the current terms before you pay, because plans change.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Fake Proton Mail sites and phishing
Email is where most account takeovers start, and any well-known privacy brand attracts copycats. A message that claims to be from Proton and says your account will be closed unless you click a link is a classic phishing pattern. Proton says it can't read your mailbox, so it has no reason to ask for your password.
- Type the address into your browser or use the official app instead of tapping a link in an email.
- Never share your password or recovery details with anyone claiming to be support.
- Turn on two-step verification in your account settings.
- Use a separate, strong password you don't use anywhere else. My comparison of two password managers explains how to store them.
If you think someone got in, my guide on spotting a hacked account covers the warning signs, and the tips in stopping hackers touching a business site apply to email too.
Is Proton Mail worth switching to?
On the facts, it's a real company with a published design, open source apps and audits it describes publicly. It's strongest if your worry is a provider reading or scanning your messages. It won't stop phishing, fix weak passwords or hide that an email exists. If you run a business, check the cost of the plan you need, and see alternatives to Dropbox if file storage is part of the move.
Frequently asked questions
Is Proton Mail safe?
Proton Mail is a real service run by Proton AG in Switzerland. Proton says messages are encrypted so it can't read them, and its apps are open source. No email service stops phishing or weak passwords.
Can Proton read my emails?
Proton's security page says it can never access your messages under its zero-access design. Its privacy policy says it can't decrypt end-to-end encrypted content.
Does Proton Mail keep IP logs?
Its privacy policy says that by default it doesn't keep permanent IP logs for your account. Logs may be kept temporarily for abuse and fraud.
Can Proton Mail be forced to share data?
Proton says it only discloses the limited data it possesses when legally obligated by Swiss authorities. It says it can't give decrypted copies of encrypted content.
Is Proton Mail legit or a scam?
It's a real company with a public beta that began in 2014 and a public launch in 2016, per Wikipedia. Fake emails using its name do exist, so go to the official site yourself.
What happens to an unused free account?
Proton's terms say free accounts inactive for 12 months or more may be deleted, with notices at 30, 15 and 7 days in advance.
