The Swiss company Proton has faced criticism since late October over how it is pushing artificial intelligence in software development. It runs Proton Mail, Proton VPN, Proton Pass, Proton Drive and Proton Calendar, among other services. 404 Media first reported on October 26 on planned interviews with employees about their use of AI. Three days later, it published an extensive report on management pressure for faster development and on employees’ security concerns. Some users on Reddit and in other communities say they are canceling their subscriptions or looking for a replacement. In this commentary, I explain why I do not think this is a reason to leave right away, but also not a dispute that would be wise to ignore. The case also shows something more general: with any provider, it is good to know how you would leave. What happened, according to the media ------------------------------------- According to the first 404 Media report, the company sent some employees an email about repeat interviews. In them, employees were to explain how they use AI in their work. According to the email, the results could also affect whether they stay with the company. The October 29 report is based on leaked internal communications, meeting recordings and interviews with employees. According to the report, Chief Technology Officer Bart Butler said at one meeting that about 90 percent of the code written in October was produced by artificial intelligence. This is an internal claim quoted by the media, not an independent measurement. According to the report, CEO Andy Yen rejected a request in internal communications in late August for a few days of security testing of new code before release. The report also states that the company measures on employees’ computers how much code AI writes. Proton denied that AI was being used as a pretext for layoffs. It also denied measuring code on employees’ computers and described this as a misunderstanding of how its device management tool works. Yen canceled the interviews on October 30 and, according to the media, admitted a communication failure. According to the same reports, he also said he would keep pushing AI adoption. The content of the interviews is to move into regular performance reviews. That evening, the company wrote in a public statement that it had not lived up to the high standard users can expect from it, and it apologized. It promised to publish how code review and security testing work and to explain where it uses AI and where it does not. It also plans to release some internal tools as open source. The company also says it has added further layers of security checks over the past year. None of the sources cited here has so far documented a leak of user data or a break of the encryption in connection with this case. Why the dispute goes to the heart of the service ------------------------------------------------ Proton mainly sells trust. In Proton Mail, zero-access encryption protects stored messages so that the provider cannot read them once they are encrypted. This is not the same as end-to-end encryption of all communication. Ordinary messages from other providers are encrypted only after they arrive on Proton’s servers. The protection also works only if the code of the apps that encrypt the data is written correctly. A bug in an app can weaken the protection even when the cryptography itself is sound. In my view, the question is therefore not only whether a company uses artificial intelligence. Many companies and developers now use AI tools in software development. What matters more is how a company reviews the resulting code and how much room it gives to security testing. So this is not just about company culture. For a provider that people trust with their email, passwords and files, the way development is managed directly affects trust in the security of the service. Why this is still no reason to panic ------------------------------------ The information published so far is a reason for closer attention. On its own, however, it does not prove that user accounts are at risk. Proton’s client apps are open source and have passed independent audits in the past. This means that people outside the company can also find possible bugs in them. Neither, however, guarantees that the latest versions are free of bugs. The server side of the service is not open, so it cannot be checked from the outside. After the criticism, Proton canceled the planned interviews and promised more transparency. Whether it keeps that promise remains to be seen. For me, this case alone is not yet a reason to remove Proton from the recommendations in my rankings. The real risk: everything with one company ------------------------------------------ Many people have their email, VPN, passwords, files and calendar with Proton at the same time. This is convenient and often good value. At the same time, it means that an account problem, an outage or a change in terms can affect several services at once. A different kind of dependence has been on display in recent days at Disroot, a community-run service based in the Netherlands. After two disks failed in its storage system, its users have been unable to reach their email archives and files for about a week. As of November 2, the operators say they can read the data in read-only mode and are backing it up before attempting a repair. In their words, recovery will take days rather than hours. With Proton, the issue is trust in security practices; with Disroot, it is the availability of data. Both cases lead to the same conclusion, though: you cannot avoid trusting some provider. What you can do is spread out whom you trust and how much, and have a plan ready in case of trouble. How to prepare a plan B ----------------------- A plan B does not mean leaving. It means being able to leave whenever you need to. With Proton and with other providers, a few steps help. - Use your own domain for email. You can then move the address to another provider, and people who write to you do not have to change anything. - Export your email regularly and check that the export can be opened or imported into another program. Proton offers the Proton Mail Export Tool for this. The export contains decrypted messages, so store it on encrypted storage. - Export your passwords from your password manager in a format that can be imported elsewhere. Store the resulting file encrypted and offline. - Keep important files outside cloud storage as well, for example on an encrypted external drive. - Do not keep your account recovery email with the same provider. With Proton, resetting your password through a recovery email alone does not restore access to data that is already encrypted. Separate data recovery methods exist for that, such as a recovery phrase. Store it, together with your two-factor backup codes, outside that provider’s services. - Consider whether you need all your services from one company. Spreading services across several providers reduces the impact of any single problem. What to watch next ------------------ User criticism has shown how sensitive this issue is for people who trust Proton with their data. What will matter, however, is what Proton actually does. The key questions are whether it publishes the promised description of its code review, security testing and AI rules, whether it really releases the promised tools, and what further independent audits show. Until then, I think the sensible response is to have a plan B ready, not to use it right away. --- Related articles ---------------- - [**TOP 10 Email Services**](https://vsx.global/top-10-email-services/). How I rate privacy-focused email services, including Proton. - [**Trust Cannot Be Eliminated, Only Managed**](https://vsx.global/trust-can-only-be-managed/). Why every technical solution only shifts trust elsewhere. - [**StartMail Now Has Its Own iOS and Android Apps. What They Can Do and What Still Requires the Web**](https://vsx.global/startmail-ios-android-apps/). Another privacy-focused email service and its new apps. Sources ------- - [404 Media](https://www.404media.co/proton-to-re-interview-staff-about-ai-to-see-who-gets-to-keep-their-job/) — Proton To ‘Re-Interview’ Staff About AI To See Who Gets To Keep Their Job (October 26, 2026) - [404 Media](https://www.404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning/) — Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning (October 29, 2026) - [404 Media](https://www.404media.co/protons-ceo-cancels-ai-re-interviews/) — Proton’s CEO Cancels AI ‘Re-Interviews’ (October 30, 2026) - [Proton on X](https://x.com/ProtonPrivacy/status/2116302824577405320) — statement on its use of AI (October 30, 2026) - [IT-Connect](https://www.it-connect.tech/proton-apologizes-and-says-its-internal-ai-tools-will-soon-be-open-source/) — Proton AI Controversy: Apologies, Denials and Open Source Plans (November 2, 2026) - [Goosed](https://goosed.ie/news/protons-ai-controversy-is-a-trust-crisis) — Proton’s AI controversy is a trust crisis, and trust is all Proton sells (November 1, 2026) - [Proton](https://proton.me/mail/security) — How Safe is Proton Mail? Security Features Explained - [Proton](https://proton.me/support/proton-mail-export-tool) — How to export and restore emails using the Proton Mail Export Tool - [Proton](https://proton.me/support/recover-encrypted-messages-files) — Recover lost account data after a password reset - [Disroot](https://status.disroot.org/status/disroot-state) — status page, update of November 2, 2026 *This commentary is based on reporting by 404 Media, Proton’s public statement, the other sources listed and the status page of the Disroot service. I take the information about internal events at the company from journalists’ findings; I have not verified the internal documents myself. It describes the situation as of the date of publication.* This page was machine-translated. The text may contain errors.