Encrypted cloud storage
Proton Drive privacy rating
End-to-end encrypted cloud storage from Swiss company Proton, with open-source apps for web, desktop and mobile.
Summary
Proton Drive scores 75 out of 100 (grade B) on the encrypted cloud storage criteria. It meets 5 of 8 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration and security headers. It partly meets open source, no trackers or telemetry and independent audit. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.
Score 75 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
Apps are open source under GPL-3.0. The server is not.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Website analytics are self-hosted. The apps include crash reporting, such as Sentry in the Android app, which is on by default and can be turned off.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans, with no ads on any plan.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Securitum audited the Proton Drive apps and Proton links the report, but its date could not be confirmed. Proton's SOC 2 Type II report is not public.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Publishes yearly counts of legal orders received, complied with and contested.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Targeted users are notified of data requests, with delays only when Swiss law, a court order or a risk to life requires it.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Yes
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade A+ (115/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.