Is Proton VPN safe? What it logs, who checked, who asked

One question, three parts

“Safe” can mean three different things, and the pages we read answer them separately. The first is what the company records about you. The second is what a court can make it hand over. The third is whether the apps leak your address or fail when a connection drops. Proton’s own pages speak to the first two. Two review sites, Business Insider and security.org, speak to the third, from tests they describe.

Both review sites say they may earn money if readers buy a subscription: Business Insider writes that it may earn an affiliate commission, and security.org that it may earn compensation from some providers. Proton is the seller of the product it is vouching for. Two more sources, The Record and SecurityWeek, are not reviews at all: they reported in September 2021 on a legal case involving Proton Mail, the company’s email service. The Proton and review pages we read do not mention that case.

The sections below take the three parts in order, and give each claim with its source and date. Where two sources disagree, both versions are given. We tested nothing ourselves, and the last section lists what we did not read.

What Proton says it logs

Proton’s privacy sub-policy for the VPN, last modified on 30 July 2025, calls Proton VPN a no-logs VPN service. It lists what Proton says it does not do: log users’ traffic or the content of any communications, discriminate against devices, protocols or applications, and throttle the connection. It says the free service is covered by the same policy, with one reservation: Proton reserves the right to impose speed restrictions in cases of excessive consumption on free servers. The same page says the data needed to maintain an account sits on servers in Switzerland, Germany or Norway, that Proton owns all of its Secure Core servers and a majority of its VPN servers in Switzerland and Germany, and that all VPN servers use full-disk encryption.

A separate no-logs page makes the claim in more detail. It says Proton does not store, collect or track information about connection logs, IP addresses, session lengths or location, and that DNS queries are sent through the encrypted tunnel and resolved on Proton’s own servers. These are statements by the seller.

Two timestamps

One detail changes from page to page. A Proton blog post from 7 September 2018 says that the only information the company has on a user’s activity is the timestamp of their most recent login. Business Insider, in a review published on 30 April 2026, writes that limited operational data is collected, and names a different item: a timestamp of when an account was created, not linked to any other activity. The Proton pages from 2025 and 2026 that we read, the privacy policy, the no-logs page and the audit page, do not repeat the sentence about the last login, and the pages we read do not explain the difference between the two timestamps. We report both and do not choose between them.

The 2018 post also carries a statement about Swiss law. It says a Swiss surveillance ordinance requires telecommunication companies to store data for up to six months, that Proton says this is generally applied to major telecommunication companies, and that Proton says it is registered under an exemption. This is Proton’s account in an eight-year-old post, and we did not look at the ordinance. The same post says “we have not received any court order”; the transparency report discussed below lists its first order in 2019.

What the yearly audit checked

Proton’s blog post on the audit was published on 22 April 2022 and last updated on 16 June 2026, when it was changed to report the fifth annual audit. The auditor is Securitum. Proton says that each year Securitum’s experts spend several days on site, reviewing VPN configuration files and server configurations, assessing operating procedures and interviewing staff. The post lists ten questions the audits cover; the figure below groups them.

Proton also says why it asks. A VPN, it writes, becomes your internet provider in effect and is technically able to track what you do, and it says an incorrect server configuration or a flawed system architecture could cause logs to be stored by accident. That is the risk the checklist is built around: the questions are about whether settings that would enable logging are on, whether anyone is alerted when they change, and whether changes need two people.

What the 2026 conclusion covers, and what it does not

Proton quotes the conclusion of the 2026 report on its blog. In Proton’s transcription, the technical evidence reviewed did not indicate that the “examined” Proton VPN server infrastructure logs users’ browsing activity, DNS queries, destination services, network traffic contents or user-identifiable connection metadata, and Securitum did not identify persistent records that would let Proton tie a specific user to activity through a “reviewed VPN server”. Those two words set the boundary of what is claimed. The pages we read do not say how many servers were examined, and we did not open the PDF reports: the quotation is Proton’s, on Proton’s page.

Three other things belong beside it. First, Proton asked for the audit and publishes the result, so it is a report the company commissioned and chose to publish; Proton describes Securitum as independent, and Business Insider writes that Proton requests an audit every year and that the audits are publicly available. Second, Proton claims that many competitors keep their audit results from the public or ask readers to sign a non-disclosure agreement; that is Proton’s statement about others and we did not check it. Third, a separate security audit of the apps, also by Securitum, is described by Proton as having found no significant security issues, and Proton and Business Insider both say the apps are open source, with a bug bounty program for outside researchers.

The same blog post says the policy has been “tested in over 400 legal cases”, while the transparency report gives a count of 458. Both numbers are Proton’s, on two different pages. The second is the more exact and was updated more recently, on 14 July 2026.

What happens when someone asks

Proton’s transparency report, published on 14 July 2026 and originally on 18 June 2017, says that since the VPN launched in 2017 Proton has received 458 legally binding orders approved by the Swiss authorities. In every case, it says, the authorities wanted help identifying who was connected to a specific Proton VPN server at a specific time, and Proton could not provide it because it does not keep the logs that would make that possible, so every request was denied. The report says it is updated whenever there is a notable new legal request. The per-year counts are in the figure below; they add up to 458.

The report also says Proton will comply only with requests approved by the Swiss courts, that it is not legally bound to honor foreign requests without such approval, and that Section 271 of the Swiss Criminal Code prohibits it from doing so. It gives its reason for not offering a warrant canary: in Switzerland the target of a surveillance or data request has to be notified eventually, so Proton says a canary would not be meaningful. On where the company sits, Proton’s trust page says Proton AG is primarily owned by the Proton Foundation, a Swiss nonprofit, and the footer of its pages gives an address in Plan-les-Ouates, Geneva. Business Insider writes that Switzerland is not part of intelligence-sharing alliances such as Five Eyes or Nine Eyes, and security.org says the same of the 5, 9 and 14 Eyes.

The 2021 case, and the line between email and VPN

The Proton pages we read do not mention it, but a 2021 case bears on the question. The Record reported on 6 September 2021 that Proton Mail, the email service, had received a legally binding order from the Swiss Federal Department of Justice, passed on after French police asked through Europol, and that it was made to log the IP address of a French climate activist who had used a Proton Mail address. The Record quotes Andy Yen, Proton Mail’s chief executive in that account, as saying there was no legal possibility to resist this particular request. The case concerned email. It did not involve the VPN.

The line between the two comes from Proton itself. The Record reports that Yen said email and VPN services are treated differently in Switzerland, and that the authorities cannot use the same order to make the company log details of its VPN product. SecurityWeek, on 10 September 2021, quotes Proton’s own blog saying that under current Swiss law email and VPN are treated differently and that ProtonVPN cannot be compelled to log user data. In both articles this is Proton’s statement, reported as such. The pages we read do not mention an independent check of it, whether by the two outlets or by anyone else, and the Proton pages, Business Insider and security.org that we read do not mention the 2021 case at all.

The apps, and what the two reviewers tested

On the technical side, Proton’s trust page lists WireGuard and its own Stealth protocol with AES-256 and ChaCha20 encryption, a kill switch that blocks all traffic if the VPN disconnects, DNS resolved on Proton’s own servers, and IPv6 leak prevention. Proton’s no-logs page says the kill switch is available on every plan. Business Insider lists AES-256 and the OpenVPN, WireGuard and Stealth protocols, and describes Stealth as masking VPN traffic as regular traffic. Our page on what a VPN kill switch blocks covers how such a feature works and how to test one.

The tests are the reviewers’. Business Insider says it tested both tiers, looked for IP leaks and checked that the kill switch cut the connection during dropouts, and that “the free model performed just as well”. It also writes that Proton “has not reported any major breaches”. Security.org says it spent about two months with the service, ran IPv6, DNS and WebRTC leak tests with the ipleak.net tool while connected to servers in 60 countries, and never saw a leak. It also tested the “Advanced” kill switch, which it says activates whether the disconnect is accidental or not. Both sets of tests are the reviewers’, from sites that may earn a commission.

The free plan, and the drawbacks the reviewers list

Proton says the free plan is funded by paying subscribers, with no ads or tracking. Both reviewers describe trade-offs of the free plan, though not all the same ones. Business Insider says the free tier has no data cap, a smaller number of servers that can be slower at peak times, one device at a time and no way to choose a location, and that paying users get the NetShield ad and malware blocker and the Secure Core option. Security.org says the free plan is limited to servers in five countries, the United States, the Netherlands, Japan, Poland and Romania, and that it does not work well for streaming or torrenting.

Security.org adds several limits of its own. It writes that Proton says there is only a 50 percent chance its service would work in restrictive countries, that Secure Core connections were usually 35 percent slower than regular ones in its tests, that the 30-day money-back guarantee is prorated, and that live chat is for paid users only. Where the two reviewers and Proton differ on numbers, the pages do not explain it: Proton says its servers cover more than 140 countries, security.org says 129. Prices differ too, and the two reviewers show different promotional prices for the same plans, so check Proton’s own pricing page on the day rather than relying on any figure here.

How to look at it yourself, and what we did not do

Proton’s audit page links the five Securitum reports, from 2022 to 2026, and its transparency report carries the per-year counts and the date of the last update. Those are the two documents where a reader can compare what is claimed with what the auditor says it examined. We read the pages that describe them, not the reports.

We ran no test of any kind: no leak test, no kill switch test, no speed test. We did not open the Securitum PDFs. We did not read community threads, forum posts, user reviews or video reviews of Proton VPN, so what users report is not in this page. We did not verify Proton’s statements about competitors, its description of the Swiss ordinance in 2018 or its claim that a VPN cannot be compelled to log. Our VPN pages say nothing is ranked until we have paid for the accounts and used them ourselves, and this page makes no ranking.