Proton is a Swiss privacy suite operated by Proton AG in Geneva, founded in 2014 by CERN researchers. Includes Proton Mail (encrypted email), Proton VPN (audited no-logs), Proton Drive (end-to-end encrypted storage), Proton Pass (password manager with email aliases), Proton Calendar, and Proton Wallet for self-custodial Bitcoin. The free tier covers each product with hard limits. Proton Unlimited consolidates them under one account for around ten euros per month.
What it means in practice
The buying argument for Proton is jurisdictional consolidation, not feature parity. Spreading Mail at Gmail, VPN at Mullvad, storage at Dropbox, and passwords at 1Password creates four separate legal surfaces for an adversary to attack with subpoenas, MLATs, or compelled production orders. Proton puts all four under Swiss law, which has stronger user protections and zero direct CLOUD Act exposure (Switzerland is not a CLOUD Act country and the bilateral fast-lane agreement signed by the UK does not apply). Proton Mail content is end-to-end encrypted between Proton users, and zero-access encrypted at rest for messages received from external senders, meaning Proton itself cannot read message bodies even under court order.
Who uses it, and against whom
Heavy adoption among journalists in NGO-funded outlets, lawyers handling sanctioned-country clients, expats with cross-border tax exposure, and privacy-conscious individuals migrating off Google. Adversaries range from advertising attribution networks (Proton blocks the entire category by design) to state-level requests routed through MLAT to Switzerland (Proton publishes a transparency report and has prevailed in several high-profile fights, lost a few including the 2021 climate activist case). The single weak point in the Proton stack is the recovery email and recovery phone: if those are set to a Gmail and a US carrier, the jurisdictional consolidation collapses on the first password reset.
What you can change today
Three steps for migration that take an evening. First, create a Proton account using a fresh recovery email also at Proton, never at Gmail. Second, set up Proton Pass and import existing credentials, then walk through the Watchtower-equivalent breach audit and rotate everything that comes up red. Third, configure Proton Mail bridge or web client and set a short-term forwarder from the old address, with a calendar reminder six months out to disable the forwarder and announce the new address to the contact list manually. Migration is the work; consolidation is the payoff.