# Proton Drive privacy rating

End-to-end encrypted cloud storage from Swiss company Proton, with open-source apps for web, desktop and mobile.

## Summary

Proton Drive scores 75 out of 100 (grade B) on the encrypted cloud storage criteria. It meets 5 of 8 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration and security headers. It partly meets open source, no trackers or telemetry and independent audit. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://proton.me/drive
- Source code: https://github.com/ProtonMail/WebClients
- License: GPL-3.0
- Jurisdiction: Switzerland. Not in the Five, Nine or Fourteen Eyes. GDPR-style data protection law.
- Platforms: Web, Windows, macOS, Android, iOS
- Home page trackers: none found
- Category: [Encrypted cloud storage](https://privacyratings.com/cloud-storage/)
- Also rated: [Proton Mail](https://privacyratings.com/email-providers/protonmail/) (Email providers), [Proton Pass](https://privacyratings.com/password-managers/protonpass/) (Password managers), [Proton Authenticator](https://privacyratings.com/two-factor-authentication/proton-authenticator/) (Two-factor authentication), [Proton VPN](https://privacyratings.com/vpns/protonvpn/) (VPN providers), [Proton Calendar](https://privacyratings.com/calendars/proton-calendar/) (Calendars), [Proton Docs](https://privacyratings.com/office-suites/proton-docs/) (Office suites), [Lumo](https://privacyratings.com/ai-assistants/lumo/) (AI assistants)
- Grade: B (75/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | Apps are open source under GPL-3.0. The server is not. | https://github.com/ProtonMail/WebClients/blob/main/LICENSE |
| No trackers or telemetry | Partial | Website analytics are self-hosted. The apps include crash reporting, such as Sentry in the Android app, which is on by default and can be turned off. | https://proton.me/legal/privacy |
| No ads or data sales | Yes | Funded by paid plans, with no ads on any plan. | https://proton.me/drive/pricing |
| Independent audit | Partial | Securitum audited the Proton Drive apps and Proton links the report, but its date could not be confirmed. Proton's SOC 2 Type II report is not public. | https://proton.me/drive/security |
| Transparency report | Yes | Publishes yearly counts of legal orders received, complied with and contested. | https://proton.me/legal/transparency |
| Tells users about requests | Yes | Targeted users are notified of data requests, with delays only when Swiss law, a court order or a risk to life requires it. | https://proton.me/legal/law-enforcement |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=drive.proton.me&hideResults=on |
| Security headers | Yes | Grade A+ (115/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=drive.proton.me |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/cloud-storage/proton-drive/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/cloud-storage/proton-drive.md