Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Proton Mail

VERIFIED
Private email · Switzerland
Founded 2014 · proton.me/mail ↗

Swiss end-to-end encrypted email by Proton AG (Geneva); 100M+ users, Foundation-controlled since June 2024.

In short

Proton Mail, in the Private email category, is an EU-owned service with Switzerland as its hosting location and no identified CLOUD Act exposure.

Assessment notes

Proton Mail is operated by Proton AG (Geneva CH), controlled by the non-profit Proton Foundation since June 2024, with end-to-end + zero-access encryption, Swiss jurisdiction (outside EU but under FADP + strong privacy law), own Swiss data centres, ISO 27001, 100M+ users, fully open-source clients, independently audited; Foundation-controlled (non-profit, no VC/PE pressure); the US sub-processors (Zendesk support, Stripe/PayPal/Chargebee billing) are ancillary and never touch the end-to-end-encrypted mailbox data, which sits on Proton's own Swiss data centres, so under a customer-data-at-rest definition CLOUD Act exposure is none, consistent with the rest of the Proton estate.

CLOUD ACT
OWNERSHIP
SUB-PROCS
7 · 4 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
  • Card-free payment available
    Accepts Bitcoin and cash by mail alongside cards.
Privacy
  • End-to-end encryption
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Proton Mail

Proton Mail is the original product within the Proton AG ecosystem (Geneva, Switzerland) and the flagship of the privacy-first email category: end-to-end + zero-access encryption (Proton itself cannot read user emails or attachments), 100M+ users, 100,000+ organisations. Since June 2024 Proton AG is controlled by the Proton Foundation, a Swiss non-profit, which structurally rules out future VC / PE acquisition pressure. Pricing: Free (1GB), Mail Plus (€4.99/mo, 15GB + custom domain), Proton Unlimited (€9.99/mo bundle with Mail + Drive + Pass + Calendar + Docs + Sheets + VPN). For the full Proton ecosystem profile see proton-drive and protonvpn. Swiss jurisdiction places ownership_signal: other (Switzerland is non-EU but strong-privacy-law); CLOUD Act exposure none.

SUB-PROCESSORS

Sub-processor map · 7

Source ↗
  • Chargebee, Inc. US
    United States

    Payment data processing; ancillary

  • PayPal group US
    United States

    Payment data processing; ancillary

  • Stripe, Inc. US
    United States

    Payment data processing; ancillary

  • Zendesk, Inc. US
    United States

    Customer support data processing; ancillary

  • Atlassian Pty Ltd non-US
    Australia

    Customer support data storage

  • ProtonLabs DOOEL Skopje non-US
    North Macedonia

    Customer support / direct communications (Proton group entity)

  • ProtonLabs Taiwan Co., Ltd non-US
    Taiwan

    Customer support / direct communications (Proton group entity)

4 of 7 sub-processors are US-incorporated. These are ancillary processors that do not hold protected customer data, so they do not change the assessment. CLOUD Act exposure is rated none.
CERTIFICATIONS

Frameworks & certifications

ISO/IEC 27001
ACTIVE
FEATURES

Capability matrix

Encryption TLS E2E
Mailbox storage 15 GB
Email aliases 10 aliases
Custom domain Yes
IMAP / SMTP Yes
Calendar Yes
Contacts Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
PRICING

Pricing & tiers

FREEMIUM
from €4/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

  • Data Processing Addendum (DPA)
    proton.me/legal…
    Open ↗
  • Sub-processors list
    proton.me/legal…
    Open ↗
  • Terms of Service
    proton.me/legal…
    Open ↗
ALTERNATIVES

Alternatives in this category

Tuta
Germany · Founded 2011
EU-SOVEREIGN

Hannover-based end-to-end encrypted mail (formerly Tutanota); post-quantum crypto, own DE data centre, ISO 27001.

E2E Public DPA Sub-processors Open source
FROM
€3/mo
CLOUD ACT
NONE
View profile →
Mailbox.org
Germany · Founded 2014
EU-SOVEREIGN

Berlin-based private email + drive + meet + office bundle (Heinlein Support GmbH); ISO 27001 + BSI C5, €1/mo entry.

E2E Public DPA Sub-processors Open source
FROM
€1/mo
CLOUD ACT
NONE
View profile →
Posteo
Germany · Founded 2009
EU-SOVEREIGN

Berlin one-person-shop privacy email at €1/mo (Posteo e.K., since 2009); anonymous signup, BSI TR-03108 certified.

E2E Public DPA Sub-processors Open source
FROM
€1/mo
CLOUD ACT
NONE
View profile →
See all private email alternatives →