Can Proton VPN See What You Are Doing?

This page is part of the Proton VPN FAQ Hub.

What is a VPN server technically able to observe?

Can Proton VPN see what you are doing? The technical part of that question is really about what sits at the exit of the tunnel. Your device encrypts traffic to the VPN server, the server strips that outer layer, then forwards your requests onward. At that instant the server knows your real IP address, the destination address, the port, and the size and timing of the packets.

That is the same vantage point your internet provider occupies when you are not using a VPN. Using one moves the observation post rather than demolishing it. The useful question is therefore not whether such a position exists, because it always does, but who occupies it and what they do with what they see.

How much does HTTPS already hide?

A great deal, and this is the part VPN marketing consistently undersells. HTTPS encrypts the contents of every request and response between your browser and the site, so the VPN server handles an opaque stream. It cannot read the page you loaded, the form you submitted, your password, or the text of anything you sent.

What leaks through is the destination. Historically that meant a plaintext DNS lookup plus the hostname in the TLS handshake, though encrypted DNS and encrypted client hello have been closing both gaps. A VPN server, or an internet provider with no VPN in the way, can often tell that you visited a particular site whilst learning nothing at all about what you did there.

What does Proton say it records?

Proton’s stated position is that Proton VPN does not log browsing activity, connection timestamps, session durations, or which of its servers you used. It retains a timestamp of the last successful login attempt to your Proton account for abuse prevention, and that value is overwritten each time rather than accumulating into a history.

It also, unavoidably, holds the account: the email address you signed up with and, on paid plans, a payment record. Anyone telling you a VPN company can bill you without keeping a billing record is not being straight with you. The distinction that matters is between an account record and an activity record, and the activity record is the one that is absent.

Can any of this be verified?

Partly, which beats the alternative. The Proton VPN apps are open source, so anyone can read what the client sends and check it is not quietly reporting telemetry. Independent security firms have audited both the apps and the no-logs policy, with reports published rather than summarised in a press release. The evidence on offer breaks down like this:

What none of that proves is the state of a running server at any given moment. An audit is a point in time inspection carried out by people who were shown specified systems. It makes sustained dishonesty expensive and much likelier to be caught, which is a meaningful signal, and it is not the same as being incapable of lying. Anyone claiming an audit makes logging impossible has misunderstood what an audit is.

• Open source clients for Windows, macOS, Linux, Android and iOS, published for public inspection.
• Annual external audits of the no-logs policy, with the reports made public each year.
• A transparency report covering the legal requests the company receives.
• Swiss incorporation, so legal demands have to run through Swiss courts.
• Full disk encryption on Proton’s own bare metal servers, so a seized machine gives up very little without the keys.

Where does the real visibility sit?

DNS is the honest answer. Your DNS queries are resolved by Proton whilst you are connected, so the resolver sees the domains you ask for even when the traffic contents stay unreadable, and that is the one layer at which can Proton VPN see what you are doing gets a straight yes. NetShield, the DNS-level tracker blocker, included with Proton VPN Plus, operates at precisely that layer to block tracker and malware domains, which necessarily means inspecting the query as it passes.

The second point of visibility is your own Proton account. If you use Proton Mail and the VPN under one login, the company holds an identity for you, even though it says the two are not linked to your VPN sessions. Whether that is acceptable depends on your threat model, and for most people it comfortably is.

So can Proton VPN see what you are doing or not?

Proton VPN is positioned to see less than your internet provider would, it says it records none of it, it has published evidence supporting that claim, and it operates under a legal system that is comparatively favourable. That combination sits near the top of what the market currently offers.

It remains a trust decision. If your situation cannot survive a provider being wrong or being compelled, a VPN alone is the wrong architecture and Tor is the tool built for that problem. For keeping your browsing away from an internet provider that sells it, this is a proportionate and sensible answer.

---