Is Proton Mail Truly Private?

This page is part of the Proton Mail FAQ Hub.

Is Proton Mail private in the ways that matter?

Is Proton Mail private where it counts, meaning the actual content of your correspondence? Yes, and you do not have to take that on trust. Your messages are stored with zero-access encryption, so they exist on Proton’s servers as ciphertext the company cannot decrypt. Between two Proton users, mail is end-to-end encrypted, all of it resting on AES-256. This is real privacy, not a privacy-themed marketing exercise.

The distinction worth holding onto is between content and context. Content is what you wrote. Context is everything around it: who, when, from where. Proton is very strong on the first and partial on the second, and the whole honest picture lives in that gap.

What does Proton keep private, and what leaks?

Message bodies and attachments are the private core, sealed so that even Proton cannot read them. The leak, if you want to call it that, is metadata. Subject lines and the sender-and-recipient addresses are encrypted at rest but not end-to-end encrypted, which means Proton can technically see them. So the envelope is visible even though the letter inside is not.

There is also the awkward matter of the other end of the conversation. If you email someone on a standard Gmail or Outlook account, a plain-text copy lands on their provider’s servers, well outside Proton’s reach. Privacy is a two-party affair. You control your side, but not always the person you are writing to.

How private is the metadata, really?

Metadata is where ‘private’ needs the most careful wording, so here is the state of play, stated plainly.

• Subject lines: encrypted at rest but not end-to-end encrypted, so treat them as the least private part of any message.
• Sender and recipient: Proton can see the who, which is unavoidable if email is to be delivered at all.
• Timing: when a message arrives and leaves is inherently visible to any mail server.
• IP logging: off by default, but a binding Swiss order can compel it for a specific, named account going forwards.

Where does Proton’s privacy genuinely stop?

Here is the honest boundary. Proton cannot read your emails, and it cannot be forced to hand over content it has no way to decrypt. What it can be compelled to do, under a legally binding Swiss order, is log metadata for a targeted account from that point on. This has happened in a documented case, and Proton complied whilst never producing a single message body.

Your own device is the other hard limit. Once a message is decrypted on your screen, no server-side privacy protects it from spyware, a shoulder-surfer or a borrowed unlocked phone. Privacy is a habit as much as a feature. Proton supplies the encryption; the discipline is yours to add.

Is it private enough for you?

For keeping your correspondence out of advertising models, away from casual snoops and safe from a server breach, Proton is genuinely private and pleasantly boring about it. For hiding the mere fact that two people are in contact, no mainstream email can promise that, and Proton does not pretend to. Know which kind of privacy you actually need.

If content privacy by default is the goal, the free tier proves the point at no cost, and Proton Mail Plus adds custom domains and storage when you commit. We at BAIZAAR prefer a provider that maps the edges of its own privacy honestly, and Proton draws that map more clearly than most.

---