Skip to content
Fair Software logoFair Software logo

Proton Mail

Proton Mail is an end-to-end encrypted email service based in Switzerland. It offers zero-access storage, no ads, and open-source clients. It's subscription-based, but there is also a free tier.

About the assessment

Proton Mail stands out because of its technical design. All client apps are open source under the GPL, and the service has ISO 27001 certification, SOC 2 Type II attestation, and annual third-party audits. In June 2024, Proton AG transferred its shares to a Swiss foundation, which must adhere to its charter and mission under Swiss law. The infrastructure uses only renewable hydroelectric power. However, there are also structural weaknesses: there is no self-hosted backend, the free tier is limited to 1 GB and 150 messages per day, and the global pricing does not account for differences in purchasing power. Proton Mail v7 introduced native offline mode for iOS and Android, so users no longer need Bridge. Accessibility remains an issue, as there is no WCAG statement and screen reader support is still lacking.

Strengths
  • Swiss/EEA data storage; full E2EE by default
  • No data sold, shared, or used for AI training
  • Non-profit foundation since June 2024
  • Renowned ethics board: Berners-Lee, Carissa Véliz
  • All client apps open source (GPL)
  • ISO 27001, SOC 2 Type II, annual audits
  • 13+ years active; strong open-source community
  • 100% renewable hydroelectric energy
Weaknesses
  • No self-hosting; backend is proprietary
  • Flat global pricing, no purchasing power parity
  • Free tier: 1 GB storage, 150 msgs/day
  • Offline sync-only; web app requires connection
  • No WCAG statement; screen reader support rough
Fair Score
80Excellent
We evaluated 1.13.3 (MacOS) on Jul 2026
using Fair Score 1.0 | See disclaimer
By section
Privacy & Data
95.5%
Openness & Transparency
87.5%
Pricing Model
58.8%
Ownership & Portability
55%
Independence & Ethics
93.3%
Longevity & Community
100%
See detailed evaluation ↓
LicenseGPL-3.0
PlatformsWeb, iOS, Android, MacOS, Windows, Linux
Launch2014
DeveloperProton AG(Switzerland)
Proton MailGo to app

Fair Score

Click on the headers to expand/collapse
1
Privacy & Data
Where user data lives, how it is protected, and whether it is used to train AI models.
95.5%
1.1
Where is user data stored?
User's own device by default; data synchronization is optional and controlled by the user
6
EU/EEA, Switzerland, Iceland, Norway
5
Other democratic countries with strong data protection laws
4
USA, China, countries with weak/uncertain data protection, or unknown location
0
//
1.2
Is end-to-end encryption available for user content?
Yes, full end-to-end encryption for user content by default or as an option
6
Encryption at rest and in transit only (no E2EE)
3
No meaningful encryption
0
//
1.3
Does the company sell or share user data with third parties?
No, never (except for strictly necessary processors under data-processing agreements)
6
Only anonymized or aggregated data for analytics or research
3
Yes, personal or behavioral data is shared or sold for advertising, profiling, or similar purposes
0
//
1.4
Does the product train AI models directly on user data (including prompts, files, metadata)?
No, never; or only with explicit, granular opt-in, off by default, and clearly explained
4
Yes, but there is a clear, easy opt-out that does not degrade the core service
2
Yes, by default, with no meaningful opt-out (or only buried/obscure settings)
0
//
Section score: 21/22
2
Openness & Transparency
License, auditability, open governance, and independent security assurance.
87.5%
2.1
What is the source code licence?
OSI-approved open-source license for the core product
10
Open core (core open source, key features proprietary)
8
Source-available (can be inspected, but the license is not truly open)
4
Closed source (no public access to source)
0
//
2.2
Has the software been independently security-audited or certified?
Yes, a recent independent audit or relevant certification (within the last 3 years) with at least a public summary
5
Yes, but the most recent audit or certification is older than 3 years
2
No known independent audits or certifications
0
//
2.3
For open-source projects, is the governance model documented and open to community participation?
Yes, governance is documented (e.g., maintainers and decision process), with contribution guidelines and a code of conduct
1
No, or not applicable (closed-source or no documented governance)
0
//
Section score: 14/16
3
Pricing Model
How users pay for the product, whether pricing relies on exploiting user data, and how fair and transparent prices are across regions.
58.8%
3.1
What is the primary pricing structure?
Free forever: no purchase, subscription, or data monetization of any kind
6
Lifetime license / one-time purchase (no forced ongoing subscription for core use)
5
Annual subscription (fair, predictable)
4
Monthly subscription
2
"Free" but monetizes user data (ads, profiling, data sales)
0
//
3.2
Is there a genuinely functional free tier (without monetising user data)?
Yes, a fully functional free tier that does not monetize user data
4
Yes, but a limited free tier
2
No meaningful free tier
0
//
3.3
Is pricing transparent with no dark patterns?
Fully transparent pricing, clear plans, no manipulation
4
Minor issues or slightly confusing elements, but no clear manipulation
2
Dark patterns present (e.g., tricking users into higher tiers, hidden charges)
0
//
3.4
Does the product use fair regional pricing that reflects local purchasing power without exploiting any region?
Clear, documented regional pricing based on local purchasing power
3
Some regional adjustments, but not clearly documented
2
Flat or opaque pricing with no fair regional adjustments
0
//
Section score: 10/17
4
Ownership & Portability
User control over data and vendor lock-in, including export, self-hosting, offline use, cross-platform availability, and accessibility.
55%
4.1
Can users export ALL their data in an open format?
Yes, full export in open formats (JSON/CSV/XML, standard open formats)
6
Yes, but only in a proprietary format (requires the vendor's tools)
4
Partial export only (not all data, or heavily limited)
2
No meaningful export
0
//
4.2
Is self-hosting available?
Fully local: runs entirely on the user's device, no server or hosting required
6
Yes, a full self-hosting option for the entire product (or a feature-complete edition)
5
Partial self-hosting (some features require the vendor's cloud)
4
No self-hosting option
0
//
4.3
Does the software work offline?
Yes, fully offline for core features
3
Yes, with sync (works offline and syncs when online)
1
Requires an internet connection for core functionality
0
//
4.4
Is the app available on multiple operating systems, including at least one non-proprietary/open platform?
Available on multiple platforms, including at least one open or non-proprietary platform (e.g., Linux, *BSD, F-Droid)
3
Available on more than one platform, but only within closed ecosystems or with significantly reduced functionality outside the main platform
1
Available on a single proprietary platform only, with no public plans or APIs enabling broader access
0
//
4.5
Does the product demonstrate basic accessibility support (screen readers, keyboard navigation, contrast, captions, etc.)?
Clear, documented accessibility support (policy or page) and evidence of basic WCAG-style features
2
Some accessibility features are present but undocumented or clearly incomplete
1
No visible accessibility features and no public commitment
0
//
Section score: 11/20
5
Independence & Ethics
Ownership, independence from Big Tech, stability over time, and whether the company shows responsible behavior in ethics, advertising, and environmental impact.
93.3%
5.1
What is the company / project structure?
Non-profit, cooperative, or bootstrapped indie project (no external investors)
6
Small private company (no Big Tech parent, no large VC control)
4
VC-funded company
2
Owned or controlled by Big Tech (a large tech conglomerate with a surveillance-capitalism model)
0
//
5.2
Has ownership changed significantly in the last 3 years?
No ownership change
4
Minor change (e.g. small investor, internal restructuring)
3
Acquired by private company (non-Big-Tech)
1
Acquired by Big Tech
0
//
5.3
Does the company publish clear, public policies on responsible use, advertising, and AI?
Clear, public ethical policies covering harmful uses, ads, and data/AI
3
Some relevant ethical policies, but partial or limited
1
No clear public ethical policies beyond the legal minimum, or existing policies are contradicted by the company's actual practices
0
//
5.4
Does the company provide public information or commitments regarding the environmental impact of its infrastructure?
No vendor-operated infrastructure at all: zero environmental impact from operations
2
Clear public information or commitments (e.g., green hosting providers, use of renewable energy, sustainability report)
2
Some indications (blog posts, partial mentions), but no coherent or up-to-date policy
1
No public information or commitments regarding environmental impact
0
//
Section score: 14/15
6
Longevity & Community
How long the project has been actively maintained and how healthy and engaged its user and contributor community is.
100%
6.1
How long has the project been actively maintained?
5+ years of continuous maintenance and releases
5
2–5 years of maintenance
3
Less than 2 years
1
//
6.2
How active and engaged is the project's community and contributor base?
Active community (forums/chats/issues), regular releases, visible roadmap
5
Maintained but quiet (few public contributors, infrequent releases)
3
Low activity, long gaps between releases, "abandoned" feel
0
//
Section score: 10/10