An independent technical audit, a 2021 Swiss court ruling, and one common claim about Proton’s servers that doesn’t hold up
Proton VPN’s privacy claim rests on a distinction worth stating plainly at the outset.
The company does not claim to make you anonymous. It claims that what you do after connecting is not retained in a form it could later hand over: while who you are as a paying customer is handled through an entirely ordinary account relationship.
Those are two different promises. Conflating them is where most privacy assessments of any VPN go wrong. This investigation keeps them separate throughout.
Proton’s position is also unusual in one respect worth flagging early: the company is owned by a non-profit foundation rather than commercial shareholders.
According to Proton AG’s Articles of Association and Foundation Charter, the Proton Foundation holds primary ownership, and the structure is designed to prevent commercial acquisition and mandate user-first governance. That is a genuine, documented structural fact, not marketing language.
This investigation has not identified independent confirmation of how that charter would function under financial distress or restructuring, though. That remains a real unknown rather than a settled guarantee.
Five lenses guide the analysis, as with every STACK privacy investigation:
- Privacy Model: what it says it collects
- Trust Architecture: what evidence supports those claims
- Evidence Architecture: how strong that evidence actually is
- Privacy Surface: where personal data touches the business beyond the VPN tunnel
- Criticisms: how the claims have held up under scrutiny
Privacy model
What Proton says it does not collect
Proton VPN’s privacy policy is direct. The company states that when using the service, it does not log users’ traffic or the content of any communications, and does not log session data, IP addresses or connection timestamps.
That’s the core (L)no-logs policy(L) claim, covering both categories that matter most: what you did (activity), and when and where you connected (session metadata).
The legal basis behind the claim, now independently verifiable
Previous assessments of Proton VPN’s privacy position have noted that the specific legal classification of VPN services under Swiss law was not independently documented. That gap is meaningfully closed by evidence available for this investigation.
A 2021 ruling from the Swiss Federal Administrative Court confirmed that VPN service providers are not classified as major telecommunications service providers under Switzerland’s Federal Act on the Surveillance of Postal and Telecommunications Traffic (BÜPF). That exempts them from the mandatory connection-logging obligations that apply to telecoms operators.
It’s an independent judicial record, not a company assertion. It directly supports why Proton’s no-logs architecture is legally viable, in a way a policy statement alone could not.
It’s worth being precise about the ruling’s limits. It confirms Proton VPN is not legally required to retain historical connection logs. It does not address whether Swiss authorities could compel prospective, forward-looking monitoring of a specific account under a future court order, a genuinely open legal question, discussed further below.
Independent technical verification
A 2025 audit by the independent security firm Securitum examined Proton’s production VPN servers in Zurich, testing specifically whether information about the services a user connects to was being monitored or logged.
The audit’s finding was direct: No, a real, dated, scoped technical test, not a repetition of Proton’s own language.
What the transparency reporting shows
Proton AG publishes a transparency report, dated 15 January 2026, covering legal requests received under Swiss jurisdiction. For VPN-related requests specifically, the report documents zero disclosures of activity or connection log data, on the basis that no such data exists to disclose.
One clarification is necessary here. Earlier public commentary on Proton VPN has described a VPN-specific transparency report with a detailed year-by-year request count. The evidence available for this investigation does not support that level of granular detail.
What is documented is a single, unified transparency report covering Proton’s full service portfolio, within which VPN-related outcomes are itemized separately. This investigation reports only what that evidence confirms: consistent, itemized zero-disclosure outcomes for VPN activity and connection data, without a specific historical count that could not be independently verified here.
What remains unknown
The evidence does not establish how a real-time RAM dump would be executed in practice if a specific physical server node were targeted by a Swiss Federal Supreme Court injunction.
The gap here is both technical and legal, and it isn’t resolved.
Trust architecture
Corporate jurisdiction and legal barriers to foreign requests
Proton AG (CHE-354.686.492) is incorporated in Plan-les-Ouates, Canton of Geneva, per the Geneva Commercial Register.
Separately, (L)Swiss jurisdiction and VPN data requests(L) are governed by a statutory framework requiring that international requests (including those made via mutual legal assistance treaties) be validated by the Swiss Federal Office of Justice and approved by a Swiss court before proceeding. That’s a verified, structural legal barrier against foreign requests bypassing Swiss judicial review, not a company claim.
Network infrastructure control
Proton AG operates its own autonomous system (AS62371), confirmed through RIPE NCC’s routing registry. This means the company directly controls its own IP routing, rather than relying entirely on third-party network operators for this layer of infrastructure: independently verifiable technical evidence of infrastructure control.
Hardware: a partial picture
Proton’s “Secure Core” servers are described as owned and operated directly by the company. Standard exit-node servers, however, rely on third-party data center facilities, meaning physical security for a meaningful part of Proton’s server fleet depends on external providers.
No independent lease or property documentation confirming direct ownership of Secure Core hardware specifically was available for this investigation. This detail should be understood as a described architectural distinction rather than an independently audited one.
Independent operational verification
Securitum’s 2025 on-site assessment found that Proton’s VPN infrastructure runs on bare-metal servers. The audit specifically evaluated dual-control change management and automated configuration-drift monitoring: meaning changes to server configuration require more than one person’s authorization, and are automatically checked against expected states.
It’s a real operational control, independently confirmed rather than merely claimed.
What remains unknown
The evidence does not establish what hardware supply-chain verification procedures, if any, are applied to bare-metal servers before operating systems are provisioned at third-party hosting facilities. This remains an open question.
Evidence architecture
What the audit actually tested
Securitum’s 2025 assessment, dated 19 September 2025, involved live, on-site inspection of production infrastructure in Zurich, review of active configuration files, and testing of configuration-drift alerts and dual-control change processes. The audit reports that Proton provided auditors with the access necessary to answer their inquiries with detailed technical explanations.
It amounts to a single, dated, scoped engagement. (See (L)how VPN audits work(L) for what that kind of engagement does and doesn’t establish.) The evidence available does not establish a multi-year audit cadence comparable to some other providers’ assurance programs. Readers should treat this as one meaningful, recent, independent verification, rather than assume a longer unbroken audit history without documentation to support it.
Open-source verification
Proton publishes client application source code for macOS, Windows, iOS, Android and Linux on public GitHub repositories, allowing independent inspection of the software users actually install.
As with any open-source artifact, that’s complementary to the infrastructure-level audit described above, not a substitute for it. One examines whether the client behaves as described; the other examines whether the servers do.
Transparency reporting as an evidentiary artifact
Proton AG’s transparency report is, per the evidence available, a unified document covering both Proton Mail and Proton VPN rather than a VPN-specific publication.
That correction matters for how much weight the report can bear as VPN-specific evidence. The itemized VPN outcomes within it are still real and relevant, but the report’s overall structure spans more than the VPN product alone.
What remains unknown
The evidence does not establish what mechanisms, if any, verify that production client binaries actually match the published open-source repositories without post-compilation modification. That’s a standard limitation of open-source claims generally, and it remains unresolved here specifically.
Privacy surface
The account layer
Proton’s privacy policy defines the account-level data it collects: an email address, payment details, and optional account-recovery information. The same policy explicitly excludes traffic content, DNS queries and IP logs from this collection.
Securitum’s audit scope independently confirmed, at the infrastructure level, zero logging of DNS queries, traffic content, destination IPs or connection timestamps on production VPN server nodes.
Correcting a common technical misconception
Proton’s infrastructure is sometimes described as “RAM-only.” The evidence available does not support that specific claim.
What is documented, in Proton’s own infrastructure specification whitepaper dated 10 May 2025, is full-disk encryption (LUKS) applied across all server nodes: designed to prevent extraction of server configuration or cryptographic keys if hardware is physically removed or loses power.
That’s a real safeguard, though a different technical claim from “diskless” (L)how RAM-only servers work(L), and the two should not be conflated.
The payment surface
Proton supports a range of payment methods. For non-cryptocurrency payments, the company relies on third-party payment processors (including Stripe and PayPal, per the evidence available) which creates an identity-linked payment footprint separate from the unlogged VPN tunnel itself.
As with similar findings in other STACK investigations, no independent vendor-side documentation of how these specific processors handle Proton customer payment data was available for review. It’s a gap in independent verification of the payment surface specifically, not a finding against Proton’s own practices.
What remains unknown
The evidence does not establish the operational exposure of server hardware management interfaces (such as IPMI or iLO) at third-party data center facilities. Providers using externally hosted hardware generally face this concern, and the material reviewed doesn’t specifically address it here.
Strategic incentives
Proton’s ownership and revenue model are documented in a way that provides genuine insight into incentive alignment. They’re worth reading alongside the no-logs claims above, rather than as a separate topic.
Non-profit governance and monetization
Proton AG’s subscription and product policy describes a Free, Plus and Unlimited tier structure, with an explicit prohibition on advertising networks or data monetization as a revenue source.
Separately, the Proton Foundation’s public charter mandates that profits generated by Proton AG be reinvested into product development, privacy research and infrastructure expansion. Both are primary, documented governance and commercial records. Though, as noted above, independent confirmation of how strictly these commitments are enforced in practice is not available in the evidence reviewed.
A modest tension worth naming
Proton’s public identity emphasizes non-profit, community-oriented governance. At the same time, it operates a conventional commercial SaaS structure with paid tiers and active cross-promotion of its wider product suite (Pass, Drive, Mail).
None of this contradicts its privacy claims. But it is a real tension between a “non-profit” framing and an increasingly broad commercial product ecosystem, and readers evaluating Proton’s incentives should hold both facts at once.
Security incentives
Proton operates a public Bugcrowd vulnerability disclosure program, offering financial rewards for identified security flaws. This is a concrete, ongoing incentive aligned with finding and fixing vulnerabilities. The evidence available does not include specific payout metrics or resolution statistics for this program, only confirmation that it exists.
What remains unknown
The evidence does not establish the specific cross-subsidization dynamics between Proton Mail’s commercial revenue and Proton VPN’s operational bandwidth costs, nor an independent financial breakdown confirming the subscription-only revenue model in practice.
Criticisms
The 2021 Proton Mail case and its relevance to Proton VPN
In 2021, a Swiss court order was directed at a Proton Mail account connected to a French climate activism case, requiring the logging of an IP address under BÜPF regulations applicable to email services.
This episode is well documented publicly, and it’s a legitimate basis for scrutiny of Proton’s broader compliance posture.
It’s important to separate what this case does and doesn’t establish for Proton VPN specifically. Proton’s own official statement clarified that the court order applied strictly to the Proton Mail account under email-specific regulations, and separately asserted that Proton VPN cannot be compelled to log under Swiss law.
That company statement is now reinforced by independent legal evidence: the Swiss Federal Administrative Court’s 2021 ruling, discussed above, confirms that VPN services are treated differently from telecommunications and email services under BÜPF specifically, because they are exempt from mandatory connection-logging obligations.
The frequent public conflation of the Mail case with VPN privacy claims is, on the evidence available, a misunderstanding of two services operating under different legal obligations, not evidence that Proton VPN’s no-logs claim has been tested and failed.
Independent technical rebuttal to generic allegations
Securitum’s 2025 audit reported no instances of user activity logging, connection metadata storage, or network traffic inspection during its assessment. This functions as a direct, independent technical answer to generic logging allegations, rather than a company rebuttal alone.
The absence of contradictory court findings
A search of public judicial records did not identify any court records or judicial orders demonstrating that Proton VPN has produced or retained user activity logs, browsing history or traffic metadata.
As with similar findings elsewhere, this should be read as a meaningful negative finding rather than an absolute guarantee. It is, however, consistent with (and adds weight to) the technical and legal evidence above.
What remains unknown
Future statutory revisions to Switzerland’s BÜPF framework could, in principle, seek to reclassify standalone VPN providers as telecommunications intermediaries subject to real-time intercept orders. Nothing in the evidence available suggests this is imminent, but it is a live legal possibility rather than a closed question.
STACK view
Proton VPN’s no-logs claim is supported by an unusually well-rounded evidence base for a single investigation: a direct independent technical audit (Securitum, 2025) that specifically tested for the absence of activity and connection logging; an independent judicial ruling (the Swiss Federal Administrative Court, 2021) establishing the legal basis for that architecture, rather than leaving it as an unverified policy assertion; a documented, non-profit ownership structure designed to separate commercial pressure from product decisions; and a transparency report that, however its structure is described, itemizes a consistent record of being unable to produce VPN activity data because none exists.
Taken together, this holds up unusually well, and stronger, in one specific respect, than some comparable investigations: the legal basis for Proton’s no-logs claim is independently documented here, not left as an unresolved question about which framework applies.
That strength has real boundaries, and being precise about them is part of a rigorous investigation rather than a weakness in the finding.
The Securitum audit is a single, dated, scoped engagement, not an established multi-year cadence, based on the evidence available. The “RAM-only” description sometimes applied to Proton’s servers is not supported; what is documented is full-disk encryption, a different and more limited technical claim.
The transparency report is unified across Proton’s services rather than VPN-specific, which affects how much granular, VPN-only historical detail it can support: this investigation has therefore not repeated a previously circulated year-by-year request count that isn’t confirmed in the evidence reviewed.
And several governance claims (the Foundation charter’s practical enforceability, Secure Core hardware ownership, and third-party payment processor practices) rest on documented but not independently re-verified sources.
None of these limitations contradict Proton’s core privacy claims. They define, precisely, where the independently verifiable evidence currently ends.
Conclusion
Based on the evidence reviewed:
Proton VPN’s no-logs claim is supported by direct independent technical testing (Securitum, 2025) and, notably, by independent legal confirmation (the 2021 Swiss Federal Administrative Court ruling) that VPN services are statutorily exempt from the mandatory logging obligations applied to telecommunications providers: resolving what earlier assessments identified as an unverified legal gap.
Proton operates a conventional, identifiable account relationship (email, payment, optional recovery information) and does not claim otherwise; its non-profit foundation ownership structure is a documented, if not independently stress-tested, governance safeguard.
The 2021 Proton Mail case, frequently cited as a criticism of Proton’s privacy claims, applies to a different service under different legal obligations, and does not constitute evidence against Proton VPN’s no-logs architecture specifically.
No court record identified in this investigation contradicts Proton VPN’s no-logs claim.
Several specific claims: the RAM-only description (not supported; full-disk encryption is what’s documented), a detailed VPN-only historical transparency count (not supported by this evidence base), Secure Core hardware ownership, and third-party payment-processor data handling, remain either corrected, unconfirmed, or company-asserted rather than independently verified, and are identified as such above.
Readers concerned primarily with whether Proton VPN can reconstruct or disclose their browsing activity will find one of the more thoroughly, and now more precisely, evidenced positions reviewed under this methodology: including independent legal grounding that is often missing from comparable investigations.
Readers evaluating trust more broadly (governance enforcement, hardware ownership, and payment-processor practices) should treat those specific items as open questions rather than settled ones.
Related investigations
- Who owns Proton VPN?
- (L)How VPN audits work(L)
- (L)What is a no-logs policy?(L)
- (L)How RAM-only servers work(L)
- Is NordVPN private?
- Is ExpressVPN private?
Methodology
This investigation is based on Proton VPN’s official privacy policy and infrastructure documentation, Proton AG’s corporate governance and foundation charter records, the Geneva Commercial Register, RIPE NCC routing registry data, the Swiss Federal Administrative Court’s 2021 BÜPF ruling, Proton’s 2025 Securitum independent audit, Proton’s official case disclosure regarding the 2021 Proton Mail matter, and public judicial record searches.
Claims sourced solely to Proton’s own documentation are identified as such throughout. A previously circulated year-by-year VPN-specific transparency request count has been omitted, and the “RAM-only” server description has been corrected, because neither is supported by the evidence reviewed for this version of the investigation.