Yes, Proton VPN is safe for most people, with a few caveats worth knowing. The evidence behind that answer is unusually strong for this industry.
The service comes from Proton AG, a Swiss company that also runs Proton Mail. Its no-logs policy has passed five independent audits in a row, every app is open source, and in 2019 a court-approved request for user logs went nowhere because the logs didn't exist.
We went through the audit results, the transparency report, the privacy policy and what Proton publishes on GitHub to see whether those claims hold up. Here's what we found, including the limits.
Is Proton VPN Safe? The Short Answer
Proton VPN is one of the safest VPNs you can use today, and the reason is that outside auditors and courts have checked its claims. Is ProtonVPN safe for everyone in every situation? No VPN is, and we'll be specific about where it falls short.
One caveat applies to every provider, not just Proton: no VPN makes you anonymous on its own. Our full Proton VPN review covers apps, streaming and support.
Is Proton VPN Legit? Who Owns It and Where It Is Based
Proton VPN is a legitimate service with a long public paper trail, and its owner and jurisdiction decide who could ever force it to hand over your data.
Swiss Jurisdiction and What It Means for Your Data
Proton is headquartered in Plan-les-Ouates, Geneva, and Switzerland has long been seen as a privacy-friendly jurisdiction. Under current Swiss law, email and VPN services are treated differently, and Proton VPN cannot be compelled to log user data.
That picture could shift. A proposed revision of Switzerland's surveillance ordinance, known as VUPF or OSCPT, would extend duties to VPN and email providers with 5,000 or more users, including user identification and six-month retention of IP and metadata. It is a draft still being rewritten, so the thresholds and duties may change before anything is adopted.
The first consultation closed on 6 May 2025 with a largely hostile response, and by February 2026 the Swiss justice department had ordered an external risk assessment before a second round. Treat it as a pending proposal, not settled law.
Foreign governments can't ask Proton for data directly. Under Article 271 of the Swiss Criminal Code, Swiss authorities must approve any foreign request first, which adds a Swiss legal check before a request ever reaches Proton.
In August 2025 Proton said it would move most of its physical infrastructure out of Switzerland because of the legal uncertainty, starting with its Lumo AI assistant. Its headquarters and legal entity stay in Geneva, and Proton hasn't said which VPN systems, if any, will relocate.
Company Ownership and Transparency
Proton AG was founded in 2014 by Andy Yen, Jason Stockman and Wei Sun, scientists who met at CERN, and Proton VPN followed in 2017.
In June 2024 Proton moved to a non-profit model, and the nonprofit Proton Foundation became the majority shareholder of Proton AG. The Foundation has no shareholders of its own and must act in the Proton community's interest in perpetuity.
Proton AG is still a for-profit company, but it answers to a nonprofit rather than to investors looking for an exit. That lowers the risk of a sale to a data-hungry owner.
Does Proton VPN Keep Logs?
Jurisdiction only matters if there's something to hand over, and Proton VPN does not keep logs of what you do online. That claim has been checked by auditors and by courts rather than simply asserted.
What Proton VPN Collects and What It Does Not
Proton's privacy policy, last modified on July 30, 2025, draws a clear line. Proton VPN says it does not log the websites you visit, your traffic or communication content, your IP address, session lengths or location data.
What it keeps is what it needs to run your account: your email address, login credentials and payment details for billing. Our roundup of no-logs VPNs for privacy compares it with services built the same way.
Independent No-Logs Audits and Open-Source Apps
Proton VPN has passed 5 consecutive annual no-logs audits, all run by the European security firm Securitum, starting in 2022. The latest independent no-logs audit by Securitum ran from May 20 to 27, 2026, with two senior consultants spending six person-days on selected production servers.
The evidence "did not indicate that the examined Proton VPN server infrastructure logs users' browsing activity, DNS queries, destination services, network traffic contents or user-identifiable connection metadata."
An audit has limits, though. Each one is a point-in-time review of selected servers, so it proves the setup was clean when checked rather than forever.
Open source fills part of that gap. On January 21, 2020, Proton made all its VPN apps open source and published an SEC Consult security audit of its desktop and mobile apps, which found only low and medium risk issues, all fixed before publication. Today the open-source code on GitHub sits under the GPL-3.0 license, so anyone can check what the apps actually send.
Real-World Tests: Legal Requests Proton Could Not Fulfill
Audits show what a server does in a given week, but court orders show what a company can produce under pressure. According to Proton's transparency report, Swiss authorities approved 458 legally binding orders against Proton VPN between its 2017 launch and June 2026.
Every one was denied because there were no logs that could identify a user. Requests peaked at 121 in 2021 and have run between 53 and 80 in each full year since.
The 2019 case is the one people cite most. A foreign request approved by the Swiss courts ordered Proton VPN to hand over logs that would identify a user, and Proton couldn't comply because those logs had never existed.
The 2021 case is often misreported. A binding Swiss order, triggered by French authorities through Europol, made Proton Mail, not Proton VPN, log the IP address of one account used by climate activists. Proton noted that its VPN can't be compelled to log in the same way.
How Secure Is Proton VPN? Encryption and Protocols
How secure is ProtonVPN at the technical level? Once logging is settled, encryption is the layer that protects your data in transit, and Proton uses the same strong ciphers on free and paid plans with only modern protocols on offer.
Encryption Standards
OpenVPN and IKEv2 connections use AES-256, a cipher with a 256-bit key that has no practical attack against it. WireGuard connections use ChaCha20 instead, a modern cipher that offers comparable security and runs especially fast on phones.
OpenVPN on Proton also uses forward secrecy, so each session gets new keys and one exposed key can't unlock past sessions.
VPN Protocols: WireGuard, OpenVPN, IKEv2 and Stealth
A VPN protocol is the set of rules for building the encrypted tunnel. Proton offers WireGuard over UDP and TCP, OpenVPN over UDP and TCP, IKEv2/IPSec, Stealth and a Smart option that picks one for you. The outdated PPTP protocol isn't offered.
WireGuard is the best default for most people because it's lean and fast. OpenVPN is older and heavily scrutinized, and we cover whether OpenVPN is safe in a separate guide.
Stealth is Proton's own obfuscation protocol, launched in 2022. It wraps WireGuard in an obfuscated TLS tunnel so the connection looks like ordinary HTTPS web traffic, which makes it harder for school, office or hotel networks to spot and block.
Proton is also testing a Rust-based system called Proton Protocols, still in beta, which its roadmap ties to future post-quantum encryption.
Proton VPN Security Features That Keep You Safe
Encryption protects the tunnel, while Proton's extra features protect you when it fails or when you need an added layer of privacy.
Kill Switch and DNS/IP Leak Protection
A kill switch blocks your internet access if the VPN connection drops, so your real IP address never slips out. If you're new to the idea, we explain how a VPN kill switch works separately.
Proton's version has two modes. The standard mode blocks traffic when the VPN drops unexpectedly, while the advanced mode blocks all non-VPN traffic even when you disconnect on purpose.
Leak tests on paid servers show no IPv4 or DNS leaks, including during forced disconnections. The kill switch cuts traffic immediately on a sudden network drop, and it holds up across Stealth, WireGuard and OpenVPN.
Proton also runs its own DNS resolvers with built-in leak protection, so your lookups don't go to your internet provider. You can still test your connection for DNS leaks in a couple of minutes.
Turn on the advanced kill switch if you never want traffic to leave your device unprotected. Our guide on how to use Proton VPN walks through the settings.
Secure Core Servers
Secure Core is Proton's multi-hop feature, an extra layer of protection where your traffic passes through a Secure Core server first, then through a second VPN server before it reaches the internet.
Those first-hop servers sit in 3 countries: Switzerland, Iceland and Sweden. Proton owns the hardware and runs it in high-security data centers, so anyone watching the exit server sees traffic coming from another Proton server, not from you. Secure Core is paid-only, and the extra hop adds noticeable latency.
NetShield Ad and Malware Blocker
NetShield is Proton's DNS-level filter for paid plans. You can block malware only, block ads, trackers and malware together (the default), or add adult-content filtering.
It stops known malicious domains from loading before your browser connects. It doesn't filter while you use Tor over VPN, and on Android you must switch off Private DNS or it stops filtering.
Tor over VPN
Tor over VPN lets Plus users reach .onion sites without installing Tor Browser: you connect to a server labeled TOR, and your traffic goes through the Proton VPN tunnel and then into the Tor network. People with serious anonymity needs should still use Tor Browser.
How Secure Are Proton VPN's Servers?
Proton's servers use full-disk encryption rather than RAM-only storage, and Proton explains that choice openly. RAM-only servers wipe on reboot, while full-disk encryption keeps a seized drive unreadable.
Proton uses LUKS full-disk encryption with AES-256 on server drives and keeps the keys off-site. The no-logs audits add a second check that nothing sensitive was being written to those drives in the first place.
Proton lists more than 20,000 servers in over 140 countries, a count that changes constantly.
Not all of those machines are Proton-owned. Proton owns the Secure Core hardware, but most of the wider network runs on leased capacity from providers such as M247 and Datacamp, and Proton doesn't publish an exact split.
Is the Free Proton VPN Safe?
Yes, the free Proton VPN is safe, which is rare among free VPNs. It uses the same no-logs policy and the same encryption as the paid plans, and it doesn't show ads.
What the Free Plan Includes
The free plan gives you unlimited data, the kill switch and Stealth on 1 device at a time. It connects you to the fastest available free server in 10 countries, including the US, Canada, the Netherlands, Japan and Switzerland.
Free servers slow down at busy times because of crowding, landing on a working one can take a few reconnect attempts, and the apps show regular upgrade prompts.
The free plan blocks P2P traffic, as we explain in our guide to torrenting with Proton VPN, and streaming isn't supported. Our list of the best free VPNs shows how it compares with other no-cost options.
Free vs Paid: What Changes for Your Safety
Upgrading doesn't change your core privacy. What Plus adds are extra protection layers and far more locations to connect through.
| Product | Paid-only safety extras | Devices | Server locations | Price | Buy |
|---|---|---|---|---|---|
|
Secure Core, NetShield, Tor over VPN, P2P | 10 | 20,000+ servers, 140+ countries (Proton's figure) | From $2.99/mo | Check price → |
 |
None | 1 | 10 countries, auto-selected | $0 |
Has Proton VPN Ever Been Hacked or Compromised?
Audits and court orders cover logging, but breaches are a separate question. Proton VPN has no known breach or hack of user data, though it has had software flaws, and how Proton handled them is part of the safety story.
In May 2024 researchers disclosed TunnelVision (CVE-2024-3661), a routing attack that affected VPNs across the industry and needs an attacker to control your local network. Proton says its apps resist it on Windows and Android, and on Apple devices with the kill switch on.
The second issue was specific to Proton. CVE-2024-37391 was a local privilege-escalation flaw in the Windows service, rated 7.8 on the CVSS scale and fixed in Windows app 3.2.10 in July 2024. It needed someone already on your computer, but it's a good reason to keep your apps updated.
Does Proton VPN's Security Slow You Down?
All of that protection has a price in speed, though it's very little on a nearby server and a lot more on Secure Core. On nearby paid servers, the speed hit is small enough to go unnoticed in everyday browsing and streaming.
Expect roughly an 8% drop in download speed on a close server, with upload falling around 4%. Speed loss depends heavily on server distance, protocol and your base connection, so any single percentage is a snapshot. Nearby servers keep ping under 100 ms, while distant connections add clear latency.
Secure Core is where you feel it, because traffic makes an extra hop and those connections average about 35% slower than standard servers. For the fastest safe connection, stick with WireGuard and a server close to you, and save Secure Core for when you need it.
Proton VPN Safety Limitations to Know
Proton VPN's weak spots are mostly about what any VPN can't do, plus a few service gaps that don't undo the no-logs record.
Pros
- Full-disk encrypted servers with keys kept off-site
- Stealth obfuscation for restrictive networks
- Open-source apps and a nonprofit majority owner
- Two kill switch modes, including an always-on advanced mode
Cons
- Free plan limited to 1 device, with crowded servers at peak times
- Most of the network runs on leased servers
- Split tunneling covers apps and IPs on Windows and Android, but only apps on Mac
- Trustpilot rates it 2.2/5, but the complaints are about Windows connection drops and slow refunds, not privacy or logging
No VPN makes you anonymous. Proton hides your traffic from your network and your IP from websites, but your Proton account still links to your email, and logging into Google or Facebook identifies you regardless.
Is Proton VPN Safe to Use? Who It Is Best For
For almost everyone, yes: Proton VPN is safe to use, and it's one of the best VPNs for people who want privacy claims they can check.
It suits privacy-minded users, people on public Wi-Fi and anyone who needs a genuinely safe free VPN, while journalists and activists get Secure Core and Tor over VPN. It's a weaker fit if you need consoles or smart TVs covered, since there's no Smart DNS.
Plus costs $9.99 per month on monthly billing, or $2.99 a month on the 2-year promotional plan, and Proton Unlimited at $12.99 a month adds Mail, Pass, Drive and Calendar. Paid plans carry a 30-day money-back guarantee, and our Proton VPN review covers the apps and streaming results.
