Proton chief technology officer Bart Butler says the company’s privacy business rests on a blunt bargain: users pay Proton directly, and Proton designs its services so it cannot read or monetize as much of their data as possible. That architecture does not make the company immune to governments, courts or bad laws.
In an interview with The Verge’s Decoder, Butler described Proton as a growing bundle of privacy-focused tools, not just the encrypted email service that made it known. The company now offers mail, a VPN, Drive for files and photos, collaborative documents, Calendar, the Proton Pass password manager, Meet video conferencing and an AI assistant called Lumo.
Butler said Proton has about 650 employees, including in-house customer support. Proton AG is a Swiss corporation, while a controlling stake is held by the Proton Foundation, a Swiss foundation seeded with shares from CEO Andy Yen and other early employees. Butler said the foundation is meant to protect the company’s mission if management or ownership pressure ever pushes Proton away from it.
Encryption is the product, but trust is the sale
Butler’s technical claim is straightforward. Proton encrypts all the data it can, which he said means the company cannot turn around and sell that data and cannot hand over information it cannot access. That matters because privacy policies can change, executives can leave and incentives can rot. Cryptography is less sentimental.
He also said the business model is part of the security model. Proton does not sell ads, and Butler said its revenue comes from users. In his account, that aligns the company’s growth with keeping users’ trust rather than extracting more value from their data.
Butler was careful not to present encryption as a magic shield. He said Proton can respond to legal requests for some data, while other data is unavailable to it by design. He also framed privacy as user control, including cases where a user may choose an integration that exposes data to another service. Proton’s goal, he said, is to make that choice informed.
That distinction is not theoretical. Earlier this year, according to 404 Media, Swiss authorities requested payment information from Proton in a case that helped the FBI identify a person linked to the Stop Cop City protest movement in Atlanta. Proton complied with the request. The episode is a useful corrective to the lazy version of the encrypted-app story: content encryption can limit what a company can provide, but billing records and other accessible metadata can still matter.
Surveillance laws could push Proton out
Butler also discussed Proton’s geography as part of its privacy posture. The company and its servers are based in Switzerland, in part because of the country’s geopolitical neutrality. Proton has said it would leave Switzerland if a controversial surveillance law passes.
Butler told Decoder that those warnings are not theater. He said Proton would also consider leaving operations in European countries such as Germany and Norway if surveillance measures in European courts threaten its privacy mission. He said the company is examining what it would mean to leave Europe if the situation becomes more “dystopian.”
Proton is also feeling ordinary software-company gravity. Butler said Mail and VPN remain its largest products, while newer services such as Calendar, Drive and Pass are growing. He said Proton is considering more business customers because growth may require it, though he said the company is not abandoning consumers.
Lumo, Proton’s AI assistant, is part of that push. Butler said Proton built it to give users and businesses an option that keeps AI work inside Proton rather than sending sensitive data to outside model companies. That is still a company claim, and AI privacy promises deserve the same suspicion as every other privacy promise. Proton’s argument is that its technical limits, paid model and foundation ownership make the claim harder to quietly betray.
This story draws on original reporting from The Verge.