Proton Drive

Is Proton Drive safe?

Yes. Proton Drive is the cloud storage app to pick if you want the provider kept out of your files. Contents, file and folder names and photo thumbnails are end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default, the apps are open source, and Apple's privacy label lists nothing but diagnostics that are not linked to you. We score it 88/100, the highest of the storage apps we have rated and well ahead of iCloud (75) and Google Drive (70).

The caveats are smaller but real. The last published audits of Drive date from early 2023. Proton is a Swiss company that must obey Swiss court orders about account data. And if you lose your password and your recovery method, nobody can get your files back.

What Proton can and cannot see

Proton's Drive privacy policy is unusually specific. File contents, file and folder names and thumbnail previews are encrypted on your device. Proton stores only the size of the encrypted file, which hides the real size. To run the service it does see when files were created and changed, folder permissions, and which user uploaded each file, because that is needed to check signatures. For shared links it sees when the link was made and last opened and how many times it was used.

That is far less than rivals see. Dropbox and Google Drive hold the keys to your files. iCloud keeps file names readable to Apple even with Advanced Data Protection turned on. MEGA also encrypts files end to end, but its iPhone app declares ad tracking, while Proton Drive has no ads at all.

How strong is the encryption?

Proton Drive uses the OpenPGP standard with elliptic-curve keys. Each file is split into blocks of up to 4 MB, each block is encrypted with the file's own key, and the chain of block hashes is signed with the uploader's key. Proton's engineering blog says this stops someone who breaks into its servers from reading or renaming files, adding files in your name, or changing your folder tree unnoticed.

That signing step is the difference from MEGA, whose 2022 problems came from keys stored without integrity protection. Proton's code is public on GitHub, its encryption library was reviewed separately, and the bounty pays up to USD 100,000 for serious bugs.

The weak spot is the audit record. The latest Drive audits Proton has published are Securitum's reviews of the iOS and Android apps, released in March 2023 when those apps went open source; Securitum found no outstanding vulnerabilities. Drive's desktop apps and the document editors added since then have no public audit of their own that we could find. Proton Pass, by contrast, was audited again in 2026.

When Swiss law reaches your account

Encryption limits what Proton can hand over, but not to nothing. Proton received 9,301 Swiss legal orders for Proton Mail in 2025 and complied with 8,313, according to its transparency report. It has not published a separate count for Drive. Under such an order Proton could disclose account data such as a recovery email address, payment details or, if a court orders it, IP addresses it would otherwise not log. Files and names stay out of reach.

A proposed change to Swiss surveillance rules could widen those duties. Proton has said it is moving most of its servers to Germany and Norway in response, as we explain on the Proton Mail page. The company is still registered in Geneva.

How to use Proton Drive safely

1. Set up a recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary or recovery file when you create the account, and store it offline.
2. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, ideally with a security key.
3. Add a password and an expiry date to shared links that hold anything sensitive, and send the password another way.
4. Leave out a recovery email if your concern is identification by authorities; it is account data that a court order can reach.
5. Treat files that strangers share with you through Proton links like any other download, since Proton cannot check them for malware.

How we scored it

Regulatory record (95) and privacy (90) are Proton Drive's strongest factors: no fines found, no tracking, and names and thumbnails encrypted along with the files. Scams and harmful content (82) is the lowest, because encrypted share links cannot be scanned and Proton relies on reports. Security (87) would be higher with a more recent public audit.