Proton Pass
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Swiss zero-knowledge password manager (Proton AG / Proton Foundation), open-source apps + extensions, Cure53-audited, free unlimited tier.
Proton Pass is a European service hosted in Switzerland, with at most minor, transient US exposure under the CLOUD Act. It is listed under Password managers.
Assessment notes
Proton Pass is part of the Proton AG product portfolio (Plan-les-Ouates, Geneva, Switzerland), controlled since 2024 by the non-profit Proton Foundation which structurally shields the company from VC/PE acquisition. Launched June 2023 as freemium with open-source apps and browser extensions on GitHub, audited by Cure53 in 2023 (full audit, no critical issues) and re-audited January to April 2026 by Recurity Labs, which found no remote exploits and no encryption bypasses and rated the security posture 'well above par'; end-to-end zero-knowledge encryption, account data stored exclusively in Switzerland/Germany/Norway alongside the rest of the Proton estate. Swiss non-profit ownership, EU-adequate jurisdiction, open-source clients, independently audited; the US sub-processors (Zendesk support, Stripe/PayPal/Chargebee billing, HubSpot sales enquiries) are ancillary and never touch the end-to-end-encrypted vault data held on Proton's own infrastructure, so no US processor holds vault data at rest; however, every Proton IP range reaches the internet only through Cloudflare's network (AS13335 as the sole upstream, the pattern of Magic Transit DDoS scrubbing, verified via RIPEstat on 2026-10-03), which carries TLS-encrypted traffic and connection metadata but does not terminate TLS and is not named in Proton's processor lists, so CLOUD Act exposure is recorded as minor (a transient US network layer with no plaintext access and no data at rest), mirroring the rest of the Proton estate.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- 8 · 5 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Card-free payment available: YesAccepts Bitcoin and cash by mail alongside cards.
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Proton Pass
Proton Pass is the password-manager product in the Proton AG portfolio, the same Geneva-headquartered Swiss company operated under the non-profit Proton Foundation (CHE-418.863.304) since the 2024 founder share donation by Andy Yen, Jason Stockman, and Dingchao Lu. The product launched in beta on 20 April 2023 and globally on 28 June 2023 under a freemium model and now serves the broader Proton group's 100M+ accounts. Feature set covers password storage, passkey support, integrated 2FA authenticator, secure password sharing, file attachments, hide-my-email aliases (a Proton-network-native privacy feature for breach isolation), dark-web breach monitoring, and dedicated business tier with admin controls, SSO, and compliance reporting.
Compliance posture mirrors Proton VPN. End-to-end zero-knowledge encryption means Proton itself cannot decrypt customer vaults under any circumstance. The Android and iOS apps plus browser extensions for Firefox and Chromium-based browsers are open-source on GitHub (protonpass/ + ProtonMail/WebClients). Cure53 conducted a full security audit in May–June 2023 of the mobile apps, browser extensions, and API. No critical issues were found and moderate findings were fixed before global launch. A second independent audit has since been published: Recurity Labs reviewed the browser extensions, the mobile and desktop apps and the CLI between January and April 2026, found no remote exploits and no encryption bypasses, saw the memory-handling observations resolved at retest, and rated the overall posture well above par. Account data is stored exclusively in Switzerland, Germany, or Norway alongside the rest of Proton's portfolio (same DCs and same engineering ops as Proton Mail and Proton Drive). Switzerland's EU adequacy decision (Art. 45 GDPR) makes cross-border transfers between CH and EU SCC-free.
Pricing is freemium with one of the most generous free tiers in the category: unlimited logins / notes / credit cards / devices, plus 10 hide-my-email aliases, passkeys, and weak/reused-password alerts. That is comprehensive enough that many users never need to upgrade. Pass Plus is the entry paid tier (industry-reported ~€2/month, multi-currency CHF/EUR/USD); business plans with SSO and admin controls above. Best fit: privacy-maximalist consumers, families, and EU SMBs who want a password manager from the same structurally-protected ownership architecture that provides Proton Mail and Proton VPN, and any procurement-grade buyer who wants independently audited zero-knowledge encryption (Cure53 in 2023, Recurity Labs in 2026) with the lowest possible parent-jurisdiction risk (non-profit Swiss foundation).
Sub-processor map · 8
-
Chargebee, Inc. USUnited States
Payment data processing; ancillary
-
Hubspot, Inc. USUnited States
Business sales enquiries and requests; ancillary (added to the policy by the 12 May 2026 revision)
-
PayPal group USUnited States
Payment data processing (listed as US/Singapore); ancillary
-
Stripe, Inc. USUnited States
Payment data processing; ancillary
-
Zendesk, Inc. USUnited States
Customer support data processing; ancillary
-
Atlassian Pty Ltd non-USAustralia
Customer support data storage (policy now lists EU/US/UK locations)
-
ProtonLabs DOOEL Skopje non-USNorth Macedonia
Customer support / direct communications (Proton group entity)
-
ProtonLabs Taiwan Co., Ltd non-USTaiwan
Customer support / direct communications (Proton group entity)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Chargebee, Inc. | United States | Payment data processing; ancillary | US |
| Hubspot, Inc. | United States | Business sales enquiries and requests; ancillary (added to the policy by the 12 May 2026 revision) | US |
| PayPal group | United States | Payment data processing (listed as US/Singapore); ancillary | US |
| Stripe, Inc. | United States | Payment data processing; ancillary | US |
| Zendesk, Inc. | United States | Customer support data processing; ancillary | US |
| Atlassian Pty Ltd | Australia | Customer support data storage (policy now lists EU/US/UK locations) | non-US |
| ProtonLabs DOOEL Skopje | North Macedonia | Customer support / direct communications (Proton group entity) | non-US |
| ProtonLabs Taiwan Co., Ltd | Taiwan | Customer support / direct communications (Proton group entity) | non-US |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Proton Pass
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Germany · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
Germany · €3.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
heylogin
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
KeePassXC
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
— |
LC-Pass
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€3.99/mo |