protonmail

Note that Proton Mail servers don't hold your private master key directly — it is always stored encrypted with your password. Also, Proton Mail allows you to import your keys: https://proton.me/support/pgp-key-management

There is no comparison between Crypto AG and us. Our encryption occurs client-side, our cryptographic code is open source ( https://proton.me/community/open-source ), and our tech can and has been independently verified. More about this here: https://proton.me/blog/is-protonmail-trustworthy.

In the case you shared, the name/address of the terrorism suspect was actually given to police by Apple, not Proton. The terror suspect added their real-life Apple email as an optional recovery address in Proton Mail. Proton can't decrypt data, but in terror cases Swiss courts can obtain recovery email. Moreover, the case concerns Proton Mail not Proton VPN, and Proton VPN's no-logs policy has been proven in both independent audits (https://protonvpn.com/blog/no-logs-audit) and in court (https://protonvpn.com/blog/transparency-report).

With Proton Mail you can send password-protected emails too: https://proton.me/support/open-password-protected-emails

We most certainly are not a crypto company. We don't run a crypto exchange, didn't create a cryptocurrency, and don't speculate in crypto. We're an encryption company, but don't lump that in with crypto.

No, this is not correct. Proton Scribe cannot read user emails, and relies on the open-source Mistral model.

Hi! We're sorry to hear that. Can you report to us at: https://proton.me/support/troubleshooting?product=account which exact bank and insurance company these are, so we can see what we can do? Thanks in advance.

You can now, with this recently introduced feature: https://proton.me/blog/enhanced-sharing-drive

For a full account of the new service we're offering check this blog article: https://proton.me/blog/docs-proton-drive

You can upload .docx and .txt and you can export documents in those two formats, as well as in .pdf, .txt, .md, and HTML.

Recipients who do not have a Proton account need to create a free or paid Proton account to access the shared content. The email invitation includes a link to the Proton sign-up page.

Once account creation is successful, they will receive another email with the link that allows them to access the file.

We made it possible, you can learn more here: https://proton.me/blog/email-forwarding

Just providing the information on the most recent correspondents is never enough to provide access to a Proton account. Please share your support ticket number with us so we can see what happened exactly.

You can learn more in our Privacy Policy: https://proton.me/legal/privacy and Transparency Report: https://proton.me/legal/transparency.

Hi! No, this is not the same Proton, we are a privacy-first email, cloud storage, VPN, calendar and password manager provider: https://proton.me/

To learn more about our transition to the non-profit structure, check this article: https://proton.me/blog/proton-non-profit-foundation

No, in fact we have no way to decrypt the emails on our servers, nor can we share them in an unencrypted format with any third parties (law enforcement included). All the data requests we comply with only include metadata which needs to remain unencrypted for the services to function properly.

>How do they get peoples passwords / keys? Easy. They just wait for you to log in and they swipe it then. It’s targeted.

Under Swiss law, Proton cannot be compelled to do this. Nor is this "easy" to execute if you are using the open source mobile or desktop apps.

Honestly, if you try it, you will find it doesn't really work this way. A lot of heuristics are used for recovery, many which are not visible to the outside for security reasons. Also, data recovery is never possible because of the use of zero access encryption.

This is inaccurate. First, Swiss law does not allow the breaking of E2EE. All of Proton's client side code is open source. We cannot arbitrarily change keys in an undetected way due to Key Transparency: https://proton.me/support/key-transparency. We also have open source mobile and desktop apps, so you don't even need to rely on the web app if you don't want.

This is pretty inaccurate. Proton's E2EE works by encrypting client side, and we can't just replace the GPG key because we have both key pinning and key transparency: https://proton.me/support/key-transparency

Proton does not claim no logs and has never claimed no logs. We do not retain logs by default, but our privacy policy has always been clear that we are legally obligated to follow Swiss court orders, which can ask for IP logging on specific accounts.

In the last few months, we have reduced the SMS verification upon signup to a minimum.

Happy to hear you're relying on our privacy-first services! No, this is not true, and we have addressed such allegations with our user community directly: https://www.reddit.com/r/ProtonMail/comments/14demhj/debunki....

We understand your concerns, however there is no comparison between Crypto AG and us. Our encryption occurs client-side, our cryptographic code is open source ( https://proton.me/community/open-source ), and our tech can and has been independently verified. More about this here: https://proton.me/blog/is-protonmail-trustworthy.

Proton's encryption provides privacy by default - we cannot access any of the email content, email attachments, calendars, files stored on Proton Drive or passwords, 2FA codes, notes etc. on Proton Pass, and therefore cannot share any of this with any third parties. We have also discussed such baseless claims of connections to NSA with our users on multiple occasions, including here: https://www.reddit.com/r/ProtonMail/comments/14demhj/debunki....

Verification emails are, as previously explained, hashed only, so we have no access to them. Additionally, they are not tied to a particular account.

Recovery emails are, on the other hand, only stored as long as the users themselves need them - as soon as you delete your recovery email from your account, it's deleted from our systems too.

There is no such requirement. You seem to be conflating a verification email address with the recovery one. The verification email address is sometimes required upon signup, but is not tied to the particular account, and also hashed so we don't have access to it: https://proton.me/support/human-verification. Therefore, we cannot share it with any third-parties (authorities included).

Recovery address (which is what this case is about), on the other hand, is completely optional, and it's not the only option we offer for account recovery: https://proton.me/support/set-account-recovery-methods. Also, it is removed from our systems as soon as you remove it from your account.

No, a recovery email is an optional recovery method, and there are other options besides email that we offer: https://proton.me/support/set-account-recovery-methods

Thanks for the clarification. We only need to check one more thing - have you activated content search on the Proton Mail desktop app too? Because if you activated it on the web app only, it doesn't apply to the desktop app, it needs to be activated on desktop separately. If you have done so, please report this to us at: https://proton.me/support/troubleshooting?product=mail so we can look into it. Thanks.

The treatment of recovery address has been explained in our Privacy Policy: https://proton.me/legal/privacy. From a technical perspective, one can't end-to-end encrypt a recovery email as it needs to be accessible to send the recovery email, which is typically initiated by an unauthenticated user who has lost their password.

Note that even in those cases when additional verification is requested, the email addresses are not tied to your account - we only save a cryptographic hash of your email. Due to the hash functions being one-way, we cannot derive it back from the hash: https://proton.me/support/human-verification

Indeed, we do offer both: https://proton.me/calendar and https://proton.me/drive.