Business Email & Office Suites
Proton for Business
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Proton AG · proton.me
Compare with Microsoft 365 Business → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Proton for Business at a glance
- Vendor
- Proton AG
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Proton for Business 3.5/5, the mean of 6 judges. Proton for Business is the end-to-end encrypted mail, calendar, documents and storage suite from Proton AG in Geneva. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Proton for Business is the end-to-end encrypted mail, calendar, documents and storage suite from Proton AG in Geneva. It is strongest on security and compliance and on administration and identity, both 7 to 8, crediting encryption the provider states it cannot decrypt, ISO 27001, SOC 2 Type II, three admin roles with a permission matrix, SAML sign-on with Okta and Microsoft Entra ID, and a documented SCIM 2.0 API; pricing transparency is the steadiest at 7 to 7. It is weakest on mail and deliverability at 5 to 6 and migration and portability at 5 to 7: Outlook, Thunderbird and Apple Mail connect only through the Bridge application over IMAP and SMTP, and we found no public information on Exchange ActiveSync or CalDAV and CardDAV. The split is migration, 5 to 7, with Easy Switch import and EML export weighed against the Thunderbird detour MBOX import requires. Sovereignty sits at 6 to 7 — data centres exclusively in Europe, but support and payment run through processors in the United States, North Macedonia and Taiwan. Weighted totals span 6.2 to 7.1.
Speaks for it
- End-to-end and zero-access encryption the provider states it cannot decrypt, backed by independently audited open-source apps, ISO 27001 and SOC 2 Type II
- Three admin roles with a published permission matrix, SAML single sign-on with Okta and Microsoft Entra ID, and a documented SCIM 2.0 provisioning API
- Public per-user prices for both tiers — Workspace Standard €12.99 and Premium €19.99 per user per month on yearly billing, €14.99 and €24.99 monthly, billed at €155.88 and €239.88 every 12 months, taxes may apply — plus a 30-day money-back guarantee and a 14-day free trial
- Mail export documented down to a command-line tool producing EML with JSON metadata on Windows, macOS and Linux, with deletion of data on service cessation stated in the data processing agreement
- A published 99.95% uptime SLA with service credits of 10% and 30%, 24/7 live chat and phone support from six users
Held against it
- Outlook, Thunderbird and Apple Mail are reached only through the locally installed Bridge application over IMAP and SMTP, with no public information on Exchange ActiveSync or native MAPI
- We found no public information on GoBD-compliant archiving, legal hold or eDiscovery, though organization-wide retention rules with per-team configuration are documented
- The documentation states MBOX files cannot be imported directly — a detour through Thunderbird local folders is required, and messages invalid per RFC standards are not imported
- We found no public information on mobile device policies with remote wipe or on partner and reseller accounts
- The captured pages give different scopes for the ISO 27001 certificate — one names Proton Drive as certified, the other Proton as a whole
Best for
- You need encrypted mail, calendar, documents and meetings in one suite with public per-user pricing and a 30-day money-back guarantee, so an annual seat cost can be computed without a sales call
- You manage identity through Okta or Microsoft Entra ID and want SAML single sign-on plus a documented SCIM 2.0 provisioning API
- You are moving mail and contacts from another provider over IMAP or a supported provider and want free guided live migration support, with EML and MBOX export documented for the way out
- You want a Swiss contracting entity with data centres exclusively in Europe and disclosure only to Swiss authorities, and can accept named subprocessors for support and payments
Avoid if
- Your team depends on native Outlook connectivity — the documented path for Outlook, Thunderbird and Apple Mail is the locally installed Bridge application over IMAP and SMTP, with mail downloaded locally to each machine
- You must import MBOX archives without a workaround — the documentation states MBOX files cannot be imported directly and messages invalid per RFC standards will not import
- You require a support and payment chain without US-located processors — Zendesk, Atlassian, Stripe, Chargebee and PayPal appear on the subprocessor list with locations including the United States
- You need your renewal price fixed — the terms state you will be charged the then-current price valid at the time of renewal
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 3 of 5 |
| Calendar, contacts & office apps | 3 of 5 |
| Security, encryption & compliance archiving | 3.5 of 5 |
| Administration, identity & partner management | 3.5 of 5 |
| Migration, open standards & exit | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Custom domains with catch-all, groups, SPF, DKIM with automatic 2048-bit key rotation every six months and DMARC are documented, with DNS set-up guides for a dozen registrars, and Bridge brings the mailbox into Outlook, Thunderbird and Apple Mail over IMAP and SMTP. We found no public information on native Outlook MAPI or ActiveSync, DMARC reporting, MTA-STS or DANE, plus addressing, delegated send-as or an admin-reviewable quarantine, and Bridge downloads all mail to each machine locally — not how I want twelve people on one busy mailbox. Mailbox and send limits beyond the per-user storage figures are also not documented. 2 10 14 15 23
The IT Administrator
Custom domains with SPF, DKIM automatic key rotation and DMARC are well documented, catch-all and email groups are included, and spam filtering, filters and automatic replies are stated. Outlook, Thunderbird and Apple Mail are reached only through the locally installed Bridge application exposing IMAP and SMTP — client software on every PC rather than a native protocol — and we found no public information on shared mailboxes with delegated send-as, an admin-reviewable quarantine, or stated send and attachment limits. 2 10 14 15 23
The Public Sector IT Lead
Mailboxes on custom domains with a documented DNS walk-through for SPF, DKIM (automatic 2048-bit key rotation every six months via CNAME records) and DMARC, plus catch-all, groups, aliases, unlimited filters and automatic forwarding on both plans; Outlook, Thunderbird and Apple Mail connect through the open-source Proton Mail Bridge over IMAP and SMTP, and storage per user is stated per tier. We found no public information on Exchange ActiveSync or native Outlook (MAPI), DMARC reporting, MTA-STS or DANE, an admin-reviewable quarantine, delegated send-as, plus addressing, or send and attachment limits — a protocol gap that would bite an administration whose staff live in Outlook. 14 15 10 2 23
The IT Service Provider
Custom domains are well documented with SPF, DKIM auto-rotation, DMARC and registrar-specific guides, plus catch-all, groups, spam filtering, automated replies and IMAP/SMTP through the open-source Bridge. We found no public information on Exchange ActiveSync or native Outlook MAPI, DMARC reporting, MTA-STS or DANE, an admin-reviewable quarantine, or send and attachment limits. 2 10 14 15 23
The Data Protection Officer
Custom domains come with a documented DNS set-up — SPF, DKIM with a new 2048-bit key every six months, DMARC — plus catch-all, groups, aliases, spam filtering, server-side rules with automated replies, and mail reaches Outlook, Thunderbird and Apple Mail over IMAP and SMTP through the open-source Bridge; storage per user is stated per plan. We found no public information on Exchange ActiveSync or native Outlook connectivity, DMARC reporting, MTA-STS or stated send limits. 2 10 14 15 23
The Skeptic
Custom domains are documented down to the DNS record — an SPF include string, DKIM with a new 2048-bit key every six months, a DMARC TXT — plus catch-all, groups, spam filtering, custom rules and automated replies, with apps on every platform. But Outlook and Thunderbird reach this mail only through the Bridge desktop application speaking IMAP and SMTP; we found no public information on Exchange ActiveSync or native MAPI, on MTA-STS or DANE, on shared mailboxes, or on send and attachment limits, and deliverability is left to the buyer's own Mail Tester run. 2 10 14 15 22 23
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
Shared calendars with an availability view, built-in appointment booking, encrypted Docs and Sheets with real-time co-editing even for people without an account, Drive storage and Meet video meetings for up to 100 participants all sit in the bundle, with apps for web, desktop and mobile. But we found no public information on CalDAV or CardDAV sync, a company-wide shared address book, tasks, room or resource booking, or Outlook calendar and contacts sync — so for an office that lives in Outlook, the shared calendar would depend on Proton's own apps. 2 3 4 10 16
The IT Administrator
Shared calendars with an availability view, appointment scheduling, browser co-editing of documents and spreadsheets with external collaborators, Drive storage with expiring protected links, and Meet video conferencing are all in the bundle with web and mobile apps. We found no public information on room and resource booking, delegated calendar access, CalDAV or CardDAV sync, Outlook calendar and contacts synchronisation, a company-wide address book or tasks. 2 3 4 10 16
The Public Sector IT Lead
The bundle is genuinely broad: shared calendars with a colleague-availability view, 25 calendars per user, invitations handled from the inbox, subscription to external calendars, encrypted Docs and Sheets with real-time co-editing even for outsiders without an account, Drive with password-protected expiring links, Meet with recording at 100 or 250 participants, offline file sync, and apps for web, desktop and mobile. We found no public information on CalDAV or CardDAV sync to phones and desktop clients, Outlook calendar sync, room and resource booking with approval, delegated calendar access, tasks, or a company-wide directory and address book — the calendar interoperability a district office runs on. Loss-free editing of Microsoft file formats is also not described, which matters for a Microsoft exit. 2 16 4 10 1
The IT Service Provider
Shared calendars with availability, invitations from the inbox, browser co-editing of documents and spreadsheets, Drive storage, Meet with 100 to 250 participants and apps across desktop, iOS and Android make a real bundle. We found no public information on CalDAV or CardDAV sync, Outlook calendar sync, room and resource booking, or tasks. 2 4 10 16
The Data Protection Officer
Shared calendars with colleague availability, encrypted invitations handled from the mail inbox, external calendar subscription, browser co-editing of documents and spreadsheets, encrypted storage with password-protected expiring links, video meetings for 100 or 250 participants in the bundle, and apps for web, desktop and mobile. We found no public information on room and resource booking, delegated calendar access, or CalDAV/CardDAV and Outlook calendar synchronisation. 1 2 4 10 16
The Skeptic
The bundle is real: shared calendars with an availability view, appointment scheduling with 25 booking pages, invitations handled from the inbox, external calendar subscriptions, Docs and Sheets co-edited in the browser with collaborators who have no account, Drive storage with password-protected expiring links, and video meetings up to 250 participants with recording. What we found no public information on is CalDAV or CardDAV sync, room and resource booking, delegated calendar access, Outlook calendar and contacts sync, tasks and a company-wide address book — the calendar is documented only inside Proton's own apps. 2 3 4 10 16
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
End-to-end and zero-access encryption, PGP working inside Outlook, Apple Mail and Thunderbird, enforced two-factor, Proton Sentinel, open-source apps independently audited, a bug bounty, ISO 27001 with the auditor's accreditation body named, SOC 2 Type II and a transparency page on authority requests are all documented. We found no public information on GoBD-compliant audit-proof archiving, legal hold, eDiscovery or restore of deleted mail — organization-wide data retention rules exist, but for a German tax practice the audit-archiving question stays open. 2 6 7 8 12 18
The IT Administrator
End-to-end and zero-access encryption the provider states it cannot decrypt, PGP in Outlook, Apple Mail and Thunderbird, admin-enforced two-factor, per-team retention rules, ISO 27001 with the accreditation body named, SOC 2 Type II and independently audited open-source apps are documented. We found no public information on GoBD-compliant archiving, legal hold, eDiscovery, or a stated restore period for deleted mail. 2 4 6 7 12 21
The Public Sector IT Lead
End-to-end encryption with zero access to mail, calendar, files and documents, PGP working inside Outlook, Apple Mail and Thunderbird, enforced two-factor, Proton Sentinel account protection, open-source apps under independent audit, ISO 27001 (auditor type and ANAB accreditation named) and SOC 2 Type II published, and a transparency page stating only binding requests from Swiss authorities are honoured. Organization-wide retention rules with per-team configuration exist and are permission-gated. We found no public information on GoBD-compliant archiving, legal hold, eDiscovery, restore of deleted mail, or BSI C5 — the audit-proof archive a German administration is legally required to run is not documented, which for me is a blocker to check before any signature. 6 7 8 18 21 2
The IT Service Provider
End-to-end and zero-access encryption where the provider states it cannot decrypt content, PGP support, enforced two-factor with Sentinel, retention rules, a Swiss-only disclosure position, ISO 27001 with auditor and accreditation named, SOC 2 Type II and audited open-source apps. We found no public information on GoBD-compliant archiving, legal hold or eDiscovery, which matters to my Austrian clients. 2 6 7 8 10 18
The Data Protection Officer
The provider states it can under no circumstances decrypt end-to-end encrypted content, PGP applies automatically in Outlook, Apple Mail and Thunderbird so referral letters to outside doctors stay encrypted, two-factor is enforceable organisation-wide by a security admin, ISO 27001 names its accreditation body and auditor, the apps are open source with independent audits and a bug bounty, and the transparency report confirms only Swiss requests are binding. Team-level retention rules exist, but we found no public information on GoBD-conform audit-proof archiving, legal hold or eDiscovery — for our practices the tax-office archive would have to be supplied elsewhere. 2 4 5 6 7 8 12 18 21
The Skeptic
End-to-end encryption by default, zero-access storage the provider states it has no means to decrypt, PGP inside Outlook, Apple Mail and Thunderbird, enforced 2FA, open-source apps independently audited, ISO 27001 with a named accreditation body, SOC 2 Type II, and a transparency page stating disclosure only to Swiss authorities. The tax-audit side is thinner: we found no public information on GoBD-compliant archiving, legal hold, eDiscovery, or backup and restore of deleted mail, and the captured pages give different scopes for the ISO 27001 certificate — one says Proton Drive is certified, another says Proton is. 4 5 6 7 8 12 18 21
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
Three admin roles with a full permission matrix, SAML single sign-on with Okta and Microsoft Entra ID, a documented SCIM 2.0 provisioning API covering users and groups, exportable activity logs, and admin-enforced 2FA and password policies are all there, backed by priority support, phone support from six users, 24/7 live chat and a 99.95% uptime SLA with service credits. We found no public information on mobile device policies with remote wipe, reseller or multi-customer partner accounts, or stated support response times. 2 5 6 10 11 20 21
The IT Administrator
Three granular admin roles with a documented permission matrix, SAML single sign-on with Microsoft Entra ID and Okta, a documented SCIM 2.0 provisioning API, exportable activity logs, a 99.95 percent SLA with service credits and phone support from six users cover most of what I run. We found no public information on mobile device policies with remote wipe, reseller or multi-tenant partner accounts, or support response times. 6 10 11 20 21
The Public Sector IT Lead
SAML single sign-on with Okta and Microsoft Entra ID, a documented SCIM 2.0 provisioning API with operations, error codes and Bearer-token setup, three admin roles with a published permission matrix reaching down to SAML, SCIM, gateways, retention and billing, an activity monitor with export, phone support from six users, and a 99.95% uptime SLA with 10% and 30% service credits published. We found no public information on mobile device policies with remote wipe, partner or reseller accounts managing several customers, usage reports, or audit log streaming to a SIEM. For eleven hundred endpoints, absence of documented device management is the gap I would press hardest on. 20 21 6 11 5
The IT Service Provider
Three granular admin roles with a per-area permission matrix, SAML single sign-on with Okta and Entra ID, a documented SCIM 2.0 API, an exportable activity monitor, 24/7 chat with phone from six users, and a 99.95% SLA with service credits. We found no public information on mobile device policies with remote wipe or partner and reseller accounts for managing several customer organisations, which is what my service business runs on. 6 10 11 20 21
The Data Protection Officer
Three admin roles are documented down to a permission matrix, single sign-on runs over SAML with Okta and Microsoft Entra ID, SCIM 2.0 provisioning is documented as an API, the activity monitor can be read and exported, users can be marked private against organisation admins, and there is a published 99.95% uptime SLA with service credits plus phone support from six users. We found no public information on mobile device policies with remote wipe or partner and reseller accounts. 5 6 11 14 20 21
The Skeptic
Three admin roles with a published permission matrix, SAML single sign-on with Okta and Microsoft Entra ID, a documented SCIM 2.0 API covering users and groups down to error codes, security policies including enforced 2FA and Proton Sentinel, an activity monitor admins can export, and an uptime SLA of 99.95% with service credits of 10% and 30%. We found no public information on mobile device policies with remote wipe, reseller or partner accounts managing several customer organisations, or support response times — the SLA covers uptime, and phone support begins at six users. 4 6 10 11 20 21
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
The Easy Switch tool imports mail and contacts from a supported provider or any IMAP connection, calendars arrive encrypted, free guided live support for the move is offered, mail exports to EML and MBOX with a command-line export tool, and deletion of data when the contract ends is stated. But the documentation itself says MBOX files cannot be imported directly — a Thunderbird local-folder workaround is needed — and that messages invalid per RFC standards will not import, and we found no public information on calendar export, whole-organisation export by the admin, or coexistence during the move. Workable, but not a documented guarantee that not a single client thread survives the switch. 1 3 5 13 16 22 23
The IT Administrator
Easy Switch imports mail and contacts from a supported provider or IMAP, calendars are imported too, guided live support is free, and export runs to EML and MBOX down to a command-line tool that restores the same configuration, with deletion of our data at the end of the service committed in the processing agreement. We found no public information on an organisation-wide migration carrying permissions and delegates with free/busy coexistence; MBOX imports need a Thunderbird detour in batches, and no admin-level export of the whole organisation is described. 1 3 13 22 23
The Public Sector IT Lead
The way in is documented — Easy Switch for mail and contacts from a supported provider or IMAP, calendar import, recommended batches of 100 to 500 messages, and free guided live migration support — and so is the way out: EML and MBOX export via the open-source Bridge and Thunderbird, a command-line export tool for all mail as EML with JSON metadata on Windows, macOS and Linux, deletion of company personal data on cessation of service in the data processing agreement, and all apps open source with public repositories. We found no public information on CalDAV or CardDAV access, export of the whole organisation by an admin, coexistence with free/busy during a move, native open document formats, a self-hosted edition, or a stated data-return period after cancellation. MBOX files also cannot be imported directly and must detour through Thunderbird local folders — workable, but a project for a thousand mailboxes needs to plan for it. 22 23 13 6 1 16
The IT Service Provider
Easy Switch imports mail and contacts with free guided support, calendars import, apps are open source, and mail exports to EML and MBOX via the export tool or Bridge with Thunderbird, with deletion on cessation stated in the DPA. MBOX import needs a Thunderbird workaround in batches, and we found no public information on organisation-wide admin export, ICS or vCard export, or coexistence during a move. 1 5 13 22 23
The Data Protection Officer
Easy Switch brings mail and contacts across from a supported provider or IMAP with support-team help, calendars import too, and mail leaves again as EML or MBOX via the open-source Bridge, Thunderbird or a command-line export tool for all messages; the data processing agreement provides for deletion when the service ends with a copy request beforehand. MBOX import needs a detour through Thunderbird local folders, and we found no public information on export of the whole organisation by an admin, coexistence during a move, or CalDAV and CardDAV access. 3 5 13 16 22 23
The Skeptic
Getting in is Easy Switch over IMAP or a supported provider with guided live support at no extra cost, and mail leaves cleanly: a command-line tool for Windows, macOS and Linux exports everything as EML with JSON metadata, and Bridge pulls the full mailbox to a local client, with deletion of personal data on service cessation stated in the data processing agreement. But the open-source apps come without a self-hosted edition, and we found no public information on export of calendars or contacts in standard formats, on whole-organisation export by an admin, or on CalDAV and CardDAV access; MBOX import needs a detour through Thunderbird local folders and messages invalid per RFC are simply not imported. 3 6 11 13 16 22 23
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
Proton AG in Geneva, supervised by the non-profit Proton Foundation, is the contracting party, its data centres are stated to be exclusively in Europe, an EU representative sits in Luxembourg, a data processing agreement is published, and ISO 27001 and SOC 2 Type II are stated. The subprocessor list is unusually open — payments through Stripe, Chargebee and PayPal in the United States, support through Zendesk in the United States and ProtonLabs in Taiwan and North Macedonia, with standard contractual clauses named for some — but the data centres themselves are not named and the contracting entity is Swiss, not EU, so the chain is European rather than EU end to end. 5 6 11 12 13
The IT Administrator
Proton AG in Geneva under the non-profit Proton Foundation is the contracting entity, data centres are exclusively in Europe, an EU representative sits in Luxembourg, a data processing agreement restricting transfers to Switzerland, the EU and adequacy countries is published, and ISO 27001 is stated. Subprocessors are listed with their locations — support and payment partly in the United States with contractual clauses as safeguard — though the data centres themselves are not named. 5 6 11 12 13
The Public Sector IT Lead
Proton AG in Plan-les-Ouates under the non-profit Proton Foundation, Swiss governing law with Geneva courts, data centres exclusively in Europe, an EU representative (Proton Europe sàrl in Luxembourg), a published data processing agreement restricting transfers to Switzerland, the EU and adequacy countries with standard contractual clauses as fallback, ISO 27001 stated, and a named subprocessor list with locations and safeguards. The entity is Swiss rather than EU, the hosting infrastructure itself is not named, and support and payment run through processors in the United States (Zendesk, Atlassian, Stripe, Chargebee, PayPal) and North Macedonia and Taiwan. That no foreign authority request is binding without Swiss backing answers my ownership question better than most EU entities — but the chain is transparent rather than purely European, so it sits between the levels. 11 5 12 13 18 6
The IT Service Provider
Proton AG in Geneva with data centres exclusively in Europe, an EU representative in Luxembourg, a published DPA restricting transfers to Switzerland, the EU and adequacy countries, subprocessors listed with locations, and ISO 27001. Support and payment run through named processors in the United States, Macedonia and Taiwan, and the hosting infrastructure itself is not named, so the chain is documented but not European end to end. 5 6 7 12 13
The Data Protection Officer
The contracting entity is Proton AG in Geneva under the non-profit Proton Foundation, data centres are exclusively in Europe, disclosure goes only to Swiss authorities, an EU representative sits in Luxembourg, and a published data processing agreement restricts transfers to Switzerland, the EU and adequacy countries while the privacy policy lists subprocessors with their locations; ISO 27001 is stated. Support and payment still run through named processors in the United States and elsewhere — Zendesk, Atlassian, Stripe, Chargebee, PayPal, plus support desks in Macedonia and Taiwan — with transfer guarantees stated for only some, and we found no public information naming the individual data centres. 3 5 6 7 11 12 13
The Skeptic
Proton AG in Geneva under the non-profit Proton Foundation, data centers exclusively in Europe, a Luxembourg GDPR representative, a published data processing agreement restricting transfers to Switzerland, the EU and adequacy countries, and a subprocessor list with locations — more of the chain is on the table than with most providers. It stops short of the top: the data centres are not named, the contracting entity is Swiss rather than an EU entity, and support and payment run through Zendesk, Atlassian, Stripe, Chargebee and PayPal in the United States and ProtonLabs in Taiwan and North Macedonia, with safeguards stated for some but not all of them. 5 11 12 13
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
Workspace Standard at €12.99 and Premium at €19.99 per user per month with 1 TB and 3 TB per user, the monthly-billing figures of €14.99 and €24.99 for comparison, exact annual billing amounts of €155.88 and €239.88, VAT treatment including reverse charge for business plans, a 30-day money-back guarantee and a 14-day trial are all public. Still open are the price of add-ons such as the Scribe writing assistant on the lower plan and extra aliases, any minimum number of users, and how long the advertised up-to-20%-off discount lasts — the terms say the then-current price applies at renewal, which is exactly the second-year-price question I need answered before signing. 1 10 11
The IT Administrator
Both workspace tiers are priced per user with monthly and yearly figures side by side (Standard €12.99 against €14.99 monthly, Premium €19.99 against €24.99), storage per user, billing cycles, trial, refund and VAT or reverse-charge treatment stated. The Scribe add-on carries no price on the plans page, a minimum user count is not stated, and enterprise is a custom quote, so the full annual cost still needs one conversation. 1 10 11
The Public Sector IT Lead
Both workspace tiers are public with per-user price, storage, domain count and annual total — Workspace Standard at €12.99 per user per month billed €155.88 every 12 months with 1 TB, Premium at €19.99 billed €239.88 with 3 TB — monthly and yearly prices compared (€14.99 and €24.99 monthly), VAT treatment for business reverse charge and VAT-ID validation explained, a 30-day money-back guarantee and a 14-day trial stated. The Proton Scribe add-on price, minimum users and contract term are not stated, and Enterprise is a custom quote. I can compute an annual seat cost from public pages alone, but not the full cost with add-ons and terms. 1 10 11 4
The IT Service Provider
Workspace Standard at €12.99/user per month with 1 TB and Premium at €19.99/user per month with 3 TB, monthly figures shown alongside, annual amounts of €155.88 and €239.88 every 12 months, VAT treatment with reverse charge on business plans, and a 30-day money-back guarantee. The Scribe add-on and extra aliases carry no public price, minimum users are not stated, and enterprise is a custom quote. 1 4 10 11
The Data Protection Officer
Both workspace tiers are public with per-user prices of €12.99 and €19.99 per month on yearly billing, €14.99 and €24.99 monthly, storage per user stated, twelve-month totals of €155.88 and €239.88, a 30-day money-back guarantee, and VAT treatment including reverse charge for business plans. We found no public price for the Scribe add-on or additional storage, no stated minimum users or term, and Enterprise pricing is a custom quote. 1 10 11
The Skeptic
Both tiers carry public per-user prices with storage — Workspace Standard at €12.99/user per month on yearly billing against €14.99 monthly, Premium at €19.99 against €24.99, "Billed at €155.88 every 12 months. Taxes may apply." — plus monthly, yearly and bi-yearly cycles, VAT treatment including reverse charge for business plans, and a 30-day money-back guarantee with its restrictions spelt out. The soft spot is the extras: we found no public price for the Scribe add-on, extra aliases or extra storage, nonprofit pricing is on request, Enterprise is "Let's talk", and we found no public information on minimum users or contract term. 1 10 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Proton for Business
Is Proton for Business European?
Yes, though not from the EU. whats-best.ai classifies Proton for Business as UK / wider Europe.
Where does Proton for Business store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Proton for Business have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Proton for Business?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Proton for Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 18 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (23)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (business) proton.me Checked 5 Nov 2026 Details →
- 2 Features page (mail) proton.me Checked 5 Nov 2026 Details →
- 3 Features page (calendar) proton.me Checked 5 Nov 2026 Details →
- 4 Features page (drive and documents) proton.me Checked 5 Nov 2026 Details →
- 5 Features page (Microsoft 365 comparison) proton.me Checked 5 Nov 2026 Details →
- 6 Security / trust page proton.me Checked 5 Nov 2026 Details →
- 7 Security / trust page (ISO 27001) proton.me Checked 5 Nov 2026 Details →
- 8 GDPR page proton.me Checked 5 Nov 2026 Details →
- 9 Documentation (business help) proton.me Checked 5 Nov 2026 Details →
- 10 Pricing page proton.me Checked 5 Nov 2026 Details →
- 11 Terms of service (names the operating company) proton.me Checked 5 Nov 2026 Details →
- 12 Privacy policy proton.me Checked 5 Nov 2026 Details →
- 13 Data processing agreement (dpa) proton.me Checked 5 Nov 2026 Details →
- 14 Mail, domains & deliverability — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 15 Mail, domains & deliverability — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 16 Calendar, contacts & office apps — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 17 Calendar, contacts & office apps — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 18 Security, encryption & compliance archiving — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 19 Security, encryption & compliance archiving — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 20 Administration, identity & partner management — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 21 Administration, identity & partner management — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 22 Migration, open standards & exit — found from sitemap proton.me Checked 5 Nov 2026 Details →
- 23 Migration, open standards & exit — found from sitemap proton.me Checked 5 Nov 2026 Details →