# Proton Drive — Cloud Storage & File Sharing

Proton Drive by Proton AG holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: UK / wider Europe; sovereignty: not determined.

- Vendor: Proton AG (https://proton.me/business/drive)
- Category: [Cloud Storage & File Sharing](https://whats-best.ai/software/cloud-storage.md)
- Provenance (editorial classification): UK / wider Europe
- Canonical page: https://whats-best.ai/software/cloud-storage/proton-drive
- Alternatives: https://whats-best.ai/software/cloud-storage/proton-drive/alternatives ([markdown](https://whats-best.ai/software/cloud-storage/proton-drive/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Proton AG
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S6]

## The panel's verdict

Proton Drive is Proton AG's end-to-end encrypted cloud storage, contracted under Swiss law. Encryption and security is the strongest category at 8-9: contents, names and metadata are encrypted on the device, keys never leave it, apps are open source with published Securitum audits, the bug bounty reaches USD 100,000 and paid plans carry ten years of version recovery — the point the lower scores turn on is that the terms state data cannot be recovered if a password is misplaced, with no organisational key recovery documented. Sovereignty sits level at 8 — Swiss entity, self-owned data centres in Switzerland and Germany, a published GDPR data processing agreement — while payment and support subprocessors such as Stripe and Zendesk process in the United States under standard contractual clauses. The flat low is portability and integrations at 4: we found no public information on a REST API, open protocols or a self-hosted edition. Remaining criteria cluster at 5-6; no criterion shows more than a point between the judges' low and high.

**Speaks for it:**
- End-to-end encryption by default covering file contents, names and metadata, with encryption keys held on the device
- Open-source apps with published Securitum audit reports and a public bug bounty capped at USD 100,000
- Windows and macOS on-demand sync with offline pinning, resumable uploads and transfers stated to run without file size limits
- Link and email sharing with passwords, expiry dates and one-click revocation, open to recipients without a Proton account
- Swiss contracting entity with self-owned data centres in Switzerland and Germany and a published GDPR data processing agreement

**Held against it:**
- No organisational key recovery documented, with the terms stating data cannot be recovered if a password is misplaced
- Portability and integrations flat at 4, with no public information on a REST API, open protocols, bulk export or self-hosting
- Payment and support subprocessors such as Stripe and Zendesk process data in the United States, listed with standard contractual clauses as safeguards
- We found no public information on remote wipe, device management, legal hold, external-sharing policies or SIEM streaming
- Extra storage, minimum seat counts and the enterprise tier carry no public price, so a full annual cost cannot be computed from the public pages

**Best for:**
- You need storage whose default is on-device end-to-end encryption of file contents, names and metadata, with keys that stay on your devices
- Your clients and external collaborators must view, edit or upload into shared folders without creating accounts
- You move very large files and need transfers stated to run without file size limits, with uploads that resume after interruptions
- A Swiss contracting entity and storage on self-owned hardware in Switzerland and Germany matter to your compliance review

**Avoid if:**
- You cannot accept that a misplaced password means data the provider states in writing it cannot recover
- Your exit strategy depends on a documented REST API, open protocols such as WebDAV or bulk export with folder structure — portability and integrations sits at 4
- You must compute the full annual cost before committing, since extra storage, seat minimums and the enterprise tier carry no public price
- Your governance needs remote wipe, legal hold or SIEM streaming, on which we found no public information — administration and governance scored 5-6

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The Data Protection Officer | The Architecture Practice Partner | The Tax Adviser | The Agency Producer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sync, clients & file access | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| Sharing & external collaboration | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 |
| Encryption, key custody & recovery | 4.5/5 | 4.5/5 | 4/5 | 4.5/5 | 4/5 | 4.5/5 |
| Administration, audit & governance | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 |
| Export, API & self-hosting | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Pricing transparency | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3/5** | **3.5/5** | **3/5** | **3/5** |

### The judges

- **The IT Lead** (v1.0): Runs IT with one colleague for a 180-person machine builder with three sites and a sales office in Poland. Is retiring the old file server and wants every account provisioned from Entra ID, team folders that stay with the company when someone leaves, an audit log they can hand to the auditor, a lost laptop wiped remotely, and a way back to the last clean state if ransomware ever encrypts a share.
- **The Data Protection Officer** (v1.0): External data protection officer for a hospital group, two care providers and a payroll bureau, where the files are patient letters and salary statements. Reads who holds the keys before the feature page, asks whether end-to-end encryption survives a share link and the office editor, and wants the subprocessor list, the storage location and the contracting entity in writing before a single folder moves.
- **The Architecture Practice Partner** (v1.0): Partner in a 25-person architecture practice in Hamburg whose CAD and BIM models run to several gigabytes each, worked on from the office, from home and on the building site. Needs files on demand so laptops do not fill up, sync that sends only what changed, a drive letter the CAD software accepts, phones that open plans offline in a basement, and structural engineers who can pick up a folder without an account.
- **The Tax Adviser** (v1.0): Runs a tax practice with eleven staff and 400 clients, bound by professional secrecy under §203 StGB. Receives receipts, payslips and annual accounts from clients who will not install anything, and sends back drafts that must not end up in a forwarded email. Needs upload links, shares with expiry and passwords, a record of who downloaded what, and a provider that cannot read the files it stores.
- **The Agency Producer** (v1.0): Producer at a 30-person video and design agency in Cologne that sends cuts, layouts and raw footage to customers every day and collects their feedback. Wants review links that play in the browser, comments on the file, transfers of 100 GB that do not stall, freelancers added for one project and removed after it, connections to Slack and the project tool, and a storage bill that does not jump when one shoot fills a terabyte.
- **The Skeptic** (v1.0): Has seen "end-to-end encrypted" on a service that switches it off for shared folders, "hosted in Germany" on storage whose accounts and support run from the US, and "lifetime" plans from a company two years old. Reads that a product is "GDPR-compliant" and asks who holds the keys, whether ten years of folders, versions and shares can be exported in a form another provider imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit frequency limit: following a Personal Data Breach · instruction by a regulatory authority · 1 [S9]
- Audit nda: yes [S9]
- Audit notice period: written · 60 [S9]
- Audit rights: Company or mandated auditor · yes [S9]
- Breach cost allocation: each party bears costs it causes [S9]
- Breach notification: without delay [S9]
- Bug bounty: yes [S4]
- Bug bounty critical reward: 50000 · 25000 · USD [S15]
- Bug bounty first reporter rule: first valid reporter receives payout after fix is deployed [S15]
- Bug bounty high reward: 25000 · 2500 · USD [S15]
- Bug bounty low reward: low · no [S15]
- Bug bounty max reward: 100000 · USD [S15]
- Bug bounty medium reward: 2500 · 1000 · USD [S15]
- Bug bounty pgp encryption: PGP public key offered for encrypting vulnerability submissions [S15]
- Bug bounty program: Proton operates a public bug bounty program for security researchers [S15]
- Bug bounty safe harbor: A safe harbor policy exists protecting researchers from liability [S15]
- Bug bounty submission email: security@proton.me · plaintext · rich text · HTML · email [S15]
- Certifications: SOC 2 Type II · ISO 27001 [S3]
- Dns caa: yes [S4]
- DPA: yes · yes [S8]
- DPA last modified: 2026-02-10 [S9]
- DPA part of terms: yes [S9]
- Dpiassistance: yes [S9]
- E2e encryption: yes · yes · yes [S2]
- Frameworks supported: GDPR · CCPA · HIPAA [S3]
- GDPR DPA available: yes · GDPR (EU) 2016/679 [S9]
- GDPR representative: yes · yes · Proton Europe sàrl, rue de Grünewald 94, L-1912 Luxembourg [S7]
- Group transfers authorized: yes [S9]
- HIPAA GDPR: yes · yes [S17]
- ISO 27001: yes · yes [S1]
- Open source audited: Open-source apps audited by independent security experts [S3]
- Open source audits: yes · yes [S2]
- Regulation compliance: yes · yes · yes [S1]
- Scc transfer mechanism: Switzerland-approved · EU-approved · UK-approved [S9]
- Securitum audit: Securitum · yes [S4]
- Subprocessor flowdown: yes [S9]
- Subprocessor list: Privacy Policy · yes [S9]

**Data**
- Analytics self hosted: yes · yes · no [S7]
- Copy request deadline: before account deletion [S9]
- Deletion on cessation: yes [S9]
- Inactive deletion delinquent: 12 [S8]
- Ip logging default: yes · no [S7]
- User rights self service: access · edit · delete · export · yes [S7]

**Hosting**
- Cloud act protection: Protection from US CLOUD Act; outside US, EU and UK jurisdiction [S3]
- Data centers: Switzerland · Germany · yes · yes [S4]
- Jurisdiction: Geneva, Switzerland · Switzerland [S3]
- Transfer scope: art. 45 GDPR and art. 16 Swiss FADP · Switzerland · EU · adequacy decision countries [S9]

**Legal**
- Article 271 prohibition: yes [S4]
- Company entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S4]
- Company name: Proton AG · Switzerland [S7]
- Data disclosure swiss only: binding requests from competent Swiss authorities only [S7]
- English version prevails: yes [S9]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · Switzerland [S6]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S2]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S10]
- Entity: Proton AG · Processor · Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland · CHE-354.686.492 [S9]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S13]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S17]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S15]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S12]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S14]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S16]
- Entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S11]
- Governing law: Courts of the Canton of Geneva · Switzerland [S8]
- Liability cap: 100 · amount paid [S8]
- No decryption disclosure: no [S7]
- Notices email: legal@proton.me [S9]
- Operating entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · Proton Foundation [S8]
- Policy change right: yes [S7]
- Proton entity address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S18]
- Swiss jurisdiction: Switzerland · yes [S4]
- Terms last modified: 2026-10-09 [S8]
- Wallet operator: Proton Wallet · Proton Financial AG [S8]

**Pricing**
- Alias deletion limit: yes · 1 [S8]
- Billing cycles: yes · monthly · yearly · bi-yearly [S8]
- Business free trial: yes · business users · yes [S8]
- Downgrade credit: 24 [S8]
- Drive plus billed total: 47.88 · 12 [S2]
- Drive plus billing: 47.88 · 12 [S6]
- Drive plus features: 200 · yes · 10 [S2]
- Drive plus version recovery: 10 years to recover previous file versions [S6]
- Duo: 2 · 14.99 · yes · 19.99 · 12 [S2]
- Duo billed total: 179.88 · 12 [S2]
- Duo billing: 179.88 · 12 [S6]
- Duo features: 2 · 2 · yes · yes [S2]
- Free editor links limit: /story/blogs-and-news/proton-blog/Drive Plus · Proton Unlimited · Proton Duo · Proton Family · Proton Visionary · 3 [S12]
- Free tier: yes · 5 [S6]
- Free tier: yes · 5 [S2]
- Free tier: yes [S13]
- Lifetime accounts transfer: yes [S8]
- Money back guarantee: 30 [S2]
- Money back guarantee days: 30 [S6]
- No transfer subscriptions: no [S8]
- Nonprofit discounts: yes [S17]
- Professional features: Share and collaborate on files · Manage user access · Sync files across devices and users [S6]
- Professional price: EUR · 20 · 1 · 7.99 [S6]
- Refund 30 days: full · 30 [S8]
- Refund limitations: yes · yes · no [S8]
- Renewal price change: yes [S8]
- Unlimited billed total: 119.88 · 12 [S2]
- Unlimited billing: 119.88 · 12 [S6]
- Unlimited features: Proton VPN · Proton Mail · Proton Calendar · Proton Pass · 500 · yes [S2]
- Unlimited included products: Proton VPN · Proton Mail · Proton Calendar · Proton Pass [S6]
- VAT treatment: no · yes [S8]
- Vpn business cancellation notice: Proton VPN Essentials · Proton VPN Business · Proton VPN Enterprise · 30 [S8]

**Product**
- Account transfer: yes [S17]
- Account without personal info: no · yes [S7]
- Activity monitor: read, export · read, export [S16]
- Admin role types: 3 [S16]
- Admin roles plans: Mail Professional · Drive Professional · Pass Professional · VPN Professional · VPN and Pass Professional bundle · Workspace bundles · Proton Enterprise [S16]
- Admin roles requirement: Proton Professional or Workspace plans [S16]
- Alternative routing: off unless censorship detected · yes · yes [S7]
- Always keep action: Always keep on this device · files or folders permanently kept offline [S11]
- Android app: yes · yes [S10]
- Anonymous payments: name + last 4 digits · cash · bitcoin [S7]
- Anti censorship: Alternative routing and Tor access available [S3]
- Attachment encryption: email attachments are encrypted/decrypted on the user's device; viewable in-app without downloading [S14]
- Authentication logging opt in: no · yes [S7]
- Automatic account locking: yes [S4]
- Automatic download: Interacting with a cloud-only file triggers automatic download [S11]
- Billing org admin only: only Organization Admins have read/update on subscription and invoices [S16]
- Business scale: >10000 [S17]
- Business tier: yes [S2]
- Calendar encryption: calendar events and contacts encrypted; invitee identities hidden; invites digitally signed [S14]
- Calendar import: 4 · 5 [S17]
- Catch all: yes [S17]
- Cli: yes · Linux · macOS · Windows [S10]
- Client side encryption metadata: file contents and metadata · yes [S13]
- Cloud file mirroring: Cloud files are mirrored in a local Proton Drive folder in File Explorer as placeholders with metadata and thumbnails [S11]
- Custom domain email: yes [S17]
- Custom signatures: yes [S17]
- Dark web monitor: yes · yes [S7]
- Default encryption: business emails encrypted by default [S17]
- Default user role: Users by default, no administrative privileges [S16]
- Desktop app upload resume: Windows · macOS · yes [S19]
- Desktop apps: 1 · 4 · 0 · 2 [S17]
- Desktop syncing: yes [S2]
- Distribution lists: yes [S17]
- Docs download via menu: Documents are downloaded via the Docs icon top-left, choosing Download and a desired format. [S18]
- Docs edit creates new copy: Editing an existing document in Docs creates a new copy with the same name; saved automatically and visible in My files. [S18]
- Docs edit via open in docs: Open in Docs via ⋮ menu on .docx files in Proton Drive [S18]

**Subprocessors**
- Atlassian: Atlassian Pty Ltd · customer support data storage · European Union · United States · United Kingdom · Adequacy decision · Standard Contractual Clauses · Certifications [S7]
- Chargebee inc: Chargebee, Inc. · payment data · United States · Standard Contractual Clauses · Data Processing Agreement [S7]
- Internal support: ProtonLabs DOOEL Skopje · customer support requests · Macedonia [S7]
- Paypal: PayPal group · payment data · United States · Singapore · Standard Contractual Clauses · Data Processing Agreement [S7]
- Protonlabs taiwan: ProtonLabs Taiwan Co., Ltd · customer support requests · Taiwan (R.O.C) [S7]
- Sales hubspot: Hubspot, Inc. · Sales team request processing [S7]
- Stripe: Stripe, Inc. · payment data · United States · Standard Contractual Clauses · Data Processing Agreement [S7]
- Zendesk: Zendesk, Inc. · customer support data · United States · Standard Contractual Clauses · Binding Corporate Rules · Certifications [S7]

**Support**
- Customer satisfaction: 96 [S17]
- General contact email: legal@proton.me · contact@proton.me · partners@proton.me [S18]
- Live chat zendesk: Zendesk Inc [S7]
- Migration: yes [S17]
- Monitoring 24 7: 24/7/365 [S4]
- No targeted advertising: no · no [S7]
- SLA availability: 99.95 [S8]
- SLA credits: 30% · 10% [S8]
- SLA uptime: yes · 99.95 [S17]
- SLA vpn exception: Dedicated IP feature of Proton VPN Business and Enterprise [S8]

115 more facts on the canonical page: https://whats-best.ai/software/cloud-storage/proton-drive

## Questions

### Is Proton Drive European?

Yes, though not from the EU. whats-best.ai classifies Proton Drive as UK / wider Europe.

### Where does Proton Drive store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Proton Drive have a free plan?

Yes. Proton Drive has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/13320).

### What are the best alternatives to Proton Drive?

As of 1 Nov 2026, the panel rates [Nextcloud Files (Nextcloud Hub) (4/5)](https://whats-best.ai/software/cloud-storage/nextcloud-files), [Tresorit (3.5/5)](https://whats-best.ai/software/cloud-storage/tresorit) and [DRACOON (3/5)](https://whats-best.ai/software/cloud-storage/dracoon) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is [Nextcloud Files (Nextcloud Hub)](https://whats-best.ai/software/cloud-storage/nextcloud-files) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Proton Drive alternatives](https://whats-best.ai/software/cloud-storage/proton-drive/alternatives).

## Head-to-head

- [Proton Drive vs Tresorit](https://whats-best.ai/compare/proton-drive-vs-tresorit.md)

## What this page leaves out

- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 8 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage (Proton Drive for business): https://proton.me/business/drive (checked 2026-11-01)
- [S2] Features page (Proton Drive): https://proton.me/drive (checked 2026-11-01)
- [S3] Security / trust page (business data security): https://proton.me/business/drive/security (checked 2026-11-01)
- [S4] Security / trust page: https://proton.me/drive/security (checked 2026-11-01)
- [S5] Documentation (end-to-end encryption): https://proton.me/security/end-to-end-encryption (checked 2026-11-01)
- [S6] Pricing page: https://proton.me/drive/pricing (checked 2026-11-01)
- [S7] Privacy policy: https://proton.me/legal/privacy (checked 2026-11-01)
- [S8] Terms of service: https://proton.me/legal/terms (checked 2026-11-01)
- [S9] Data processing agreement (dpa): https://proton.me/legal/dpa (checked 2026-11-01)
- [S10] Sync, clients & file access — found from sitemap: https://proton.me/drive/download (checked 2026-11-01)
- [S11] Sync, clients & file access — found from sitemap: https://proton.me/support/proton-drive-windows-on-demand-sync (checked 2026-11-01)
- [S12] Sharing & external collaboration — found from sitemap: https://proton.me/support/drive-shareable-link (checked 2026-11-01)
- [S13] Sharing & external collaboration — found from sitemap: https://proton.me/drive/file-sharing (checked 2026-11-01)
- [S14] Encryption, key custody & recovery — found from sitemap: https://proton.me/security/zero-access-encryption (checked 2026-11-01)
- [S15] Encryption, key custody & recovery — found from sitemap: https://proton.me/security/bug-bounty (checked 2026-11-01)
- [S16] Administration, audit & governance — found from sitemap: https://proton.me/support/admin-roles (checked 2026-11-01)
- [S17] Administration, audit & governance — found from sitemap: https://proton.me/business/features (checked 2026-11-01)
- [S18] Export, API & self-hosting — found from sitemap: https://proton.me/support/drive-import-export-docs (checked 2026-11-01)
- [S19] Export, API & self-hosting — found from sitemap: https://proton.me/support/import-files-dropbox (checked 2026-11-01)
- [S20] Legal notice — found from the homepage: https://proton.me/legal/transparency (checked 2026-11-01)

---

Cite as: whats-best.ai, "Proton Drive — Cloud Storage & File Sharing", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/cloud-storage/proton-drive

Corrections: https://whats-best.ai/correct/1219?target=page