Is Proton VPN Ethical?

Proton VPN has a credible ethical case based on its governance structure and published technical scrutiny, particularly for people who need a VPN rather than a general security cure-all. Its no-logs claim concerns VPN activity, not every account record. We would consider it on that basis, while checking payment commitments and recognising what the audits did not examine.

Who owns Proton VPN?

Proton VPN is operated by Proton AG. The Proton Foundation describes itself as the company’s primary shareholder, with a legally defined privacy, freedom and democracy mission and consent rights over changes of control. The foundation is a Swiss nonprofit; the operating company and its paid subscriptions should not simply be described as a charity.

This structure is relevant because it can constrain a takeover that conflicts with the stated mission. It does not by itself prove excellent customer service, fair conditions for every worker or flawless security. We give the governance arrangement credit for what it controls, rather than using the nonprofit label as a substitute for examining the product.

What has an independent no-logs audit actually checked?

We read Securitum’s 2025 report directly. Commissioned by Proton, it examined a sample of production VPN servers during an August 2025 visit and found no activity logging or user-identifiable connection records inconsistent with the policy. It also examined operational controls intended to prevent logging from being introduced.

The report explicitly limits the assurance: it was a guided, point-in-time review, not an unrestricted forensic examination of every server. Account-management systems, a formal software-code review and deployment pipelines were outside scope. These exclusions matter because “audited” is not a guarantee covering everything a company does.

Proton’s June 2026 update reports a fifth successful annual review and links the newer report. We verified the company’s announcement, while our detailed scope assessment here comes from the fully readable 2025 auditor report. Repeated scrutiny is encouraging; the difference between a provider’s summary and an audit we have directly examined remains important.

Does no-logs mean Proton knows nothing about you?

No. The VPN-specific policy states that VPN traffic and session data are not logged. The wider Proton account policy separately covers support messages, payments and optional authentication logs. It also allows certain account-level IP retention for abuse prevention. The policy distinguishes these login records from VPN activity.

A paid account can therefore have billing information without creating a browsing-history log. Conversely, choosing an alternative payment method does not erase every possible connection to your identity. Understanding which category of data is protected is more useful than treating “no logs” as a promise that no records exist anywhere in the organisation.

Is the free version a meaningful option?

The VPN policy extends the no-logs commitment to the free service. It generally promises no speed restriction but reserves the ability to restrict excessive consumption to preserve service quality. This is worth distinguishing from an unconditional promise that a free connection always performs like a paid one.

For a prospective buyer, a free account offers a way to see whether the app works with your devices before committing to a long subscription. That test does not establish the performance of every paid server or specialised feature. Upgrade for a specific capability or capacity you need, rather than assuming payment is necessary to receive the basic privacy policy.

Where does a VPN stop protecting you?

The Electronic Frontier Foundation’s VPN guide explains that a VPN changes whom you trust with network traffic; it does not provide complete anonymity. Cookies, account logins and other tracking methods can still identify you. EFF also cautions against treating a VPN as a replacement for other security measures. That guidance applies to Proton as well as competing services.

Our recommendation is therefore tied to a defined purpose. If your concern is network-level exposure, evaluate that protection. If your concern is an account you willingly sign into or sensitive information you publish, buying a VPN does not make the underlying decision disappear.

Can you cancel and get your money back?

The cancellation instructions require completing the web cancellation flow, including its final reason-and-submit step; the subscription then expires at the billing-cycle end. App-store purchases use the relevant store. Cancelling leaves a free Proton account rather than deleting it.

The current terms require both cancellation and a refund request within 30 days of the initial purchase for the stated refund option. Cash and bank-transfer payments are excluded, and intermediary purchases follow the intermediary’s rules. After the window, refunds are generally discretionary. The distinction matters when comparing a long prepaid plan with a short trial.

We would consider Proton VPN a defensible choice for a clearly identified privacy need, with governance and audit evidence that can be inspected. Test compatibility, record the total commitment and renewal terms, and judge the service by its defined protections. A credible privacy product still needs an ordinary consumer-value test.

Sources and research notes

Sources checked on 2026-09-13. Findings retain their original dates. This guide uses public documents and reporting, not hands-on product testing or factory inspections. How we research guides.

1. Proton Foundation governance — Proton · undated. Primary shareholder, nonprofit foundation and change-of-control consent rights.

2. Proton VPN no-logs assessment 2025 — Securitum · 2025-09-19. Independent commissioned assessment findings, sampling method and explicit exclusions.

3. Proton annual audit update — Proton · 2026-06-16. Company report of a fifth annual review; distinguished from the directly read 2025 audit.

4. Proton account privacy policy — Proton · undated. Account, support, payment and authentication records distinct from VPN traffic.

5. Proton VPN privacy policy — Proton · 2025-07-30. VPN activity policy and free-plan coverage with fair-use speed exception.

6. Proton terms of service — Proton · undated. Initial-purchase refund window, request requirement and excluded payment routes.

7. Cancelling Proton VPN — Proton · undated. Required confirmation flow, store billing and downgrade rather than account deletion.

8. Choosing a VPN — Electronic Frontier Foundation · 2026-07-28. Limits of VPN anonymity and security claims; not an endorsement of Proton.

Send a correction or evidence that changes this assessment.