Proton VPN

Is Proton VPN safe?

Yes, and it is one of the strongest VPNs we have scored. Proton VPN has had its no-logs policy audited every year since 2022, publishes the full reports, makes all its apps open source and collects almost nothing through the app. We score it 88/100, ahead of NordVPN (79) and ExpressVPN (79) and just behind Mullvad (91) and IVPN (89).

It comes from Proton AG, the Geneva company behind Proton Mail, and it is one of very few free VPNs we would trust: the free plan shows no ads and falls under the same no-logs policy as paid plans. The main open risk is legal rather than technical. Switzerland has proposed surveillance rules that could require services like Proton's to identify users and keep metadata.

How little does the app collect?

Very little. Apple's privacy label lists only an email address and crash data, both marked as not linked to your identity and used only to run the app. There is no tracking section. Google Play lists your email and a user ID for account management and fraud prevention, purchase history, an optional phone number and optional crash logs, with nothing shared with third parties.

The VPN policy is short. Proton says it does not log your traffic, the content of your communications or VPN session data, and does not throttle your connection. Account data sits on Proton-owned servers in Switzerland, Germany or Norway. Proton physically owns all its Secure Core servers and most of its Swiss and German VPN servers, and every server, wherever it is, uses full-disk encryption.

What did the no-logs audits find?

Securitum has audited the policy five times, from 2022 to 2026, and Proton posts every report publicly. The 2025 report is a good guide to what these checks can and cannot show. Two Securitum consultants spent 18 to 20 August 2025 at Proton's Zürich office, picked production servers at random and looked at running processes, configuration files, storage and memory for anything that could record user activity. They also checked that logging settings cannot be switched on without a four-eyes change process and an automatic alert. They found nothing that logs browsing, DNS queries or which user used which server, and confirmed the policy applies to free and paid users alike.

Securitum was also clear about the limits. The review was guided by Proton's engineers, covered a sample of servers rather than the whole fleet, and excluded the client app code, the build pipeline and Proton's account and billing systems. The 2026 report, published in June, reached the same conclusion.

Real legal demands tell the same story. Proton's transparency report lists 59 Swiss orders for VPN data in 2025, all refused because each asked who was connected to a server at a given time, which Proton cannot know.

How secure is Proton VPN?

All the apps are open source, so anyone can check what they do, and Securitum has audited them as part of a review of all Proton apps. Proton's bug bounty pays up to USD 100,000, with USD 25,000 to 50,000 for critical findings. We found no reported breach of Proton VPN servers or user data.

One design difference from rivals: Proton relies on full-disk encryption on its servers rather than the RAM-only setups ExpressVPN, NordVPN and Surfshark advertise. Securitum's 2025 review included checks of storage and memory for leftover data and found none.

The Swiss question

In 2025 the Swiss government proposed changes to its surveillance ordinance. As reported by heise in August 2025, services with at least 5,000 users would have to identify users, keep metadata such as IP addresses for six months and help decrypt content. Proton called it mass surveillance and began moving much of its physical infrastructure out of Switzerland, starting with its Lumo AI service in Germany and new sites in Norway. The rule was still a proposal when we checked, and Proton has not been fined or ordered to do anything under it. Swiss orders have reached Proton before: in 2021 one forced it to log a Proton Mail user's IP address.

How to use Proton VPN safely

1. Use the free plan if you only need protection on public Wi-Fi; it has no ads and the same no-logs policy.
2. Sign up with an email address that does not reveal your name, and skip the optional phone number.
3. Use Secure Core servers, which run on Proton-owned hardware, for sensitive work.
4. Parents who rely on network filters should know that a free VPN is easy for a child to install.

How we scored it

The regulatory record is the strongest factor (95), with no fines or orders and data requests that came back empty. Privacy (90) reflects a near-empty App Store label and five public no-logs audits. Scams and harmful content is the weakest (80), because any VPN, and especially a free one, can bypass parental and school filters, and because the App Store rates the app 4+ while Proton's terms set a minimum age of 13.