Password Management
Proton Pass
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Proton AG · proton.me
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Proton Pass at a glance
- Vendor
- Proton AG
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Oct 2026
- Panel verdict
- The AI panel rates Proton Pass 2/5, the mean of 6 judges. Proton Pass is Proton AG's end-to-end encrypted password manager; the company is based in Plan-les-Ouates (Geneva), Switzerland and presents itself as outside US and EU jurisdiction. how scores are made
- As of
- Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Proton Pass is Proton AG's end-to-end encrypted password manager; the company is based in Plan-les-Ouates (Geneva), Switzerland and presents itself as outside US and EU jurisdiction. The highest scores come on security architecture and identity integration, at 5 to 6, with sharing and access control close behind at 4 to 6: the captured pages name 256-bit AES-GCM and OpenPGP on Curve25519, state that usernames, web addresses and notes are all encrypted, document open-source clients and a public bug bounty, and lay out SCIM provisioning for Okta and Microsoft Entra step by step, including Create Users and Deactivate Users actions. Pricing transparency scores a flat 2, the low point: the pricing page publishes four tiers and seat bands such as 3 to 30 users, but no price figure appears in the captured pages, and the business trial is requested by contacting the sales team. Sovereignty draws the widest spread, 1 to 3: judges credit the Swiss positioning and the no-permanent-IP-logs default, but weigh unequally the unconfirmed vault data residency, subprocessors, and data-processing agreement covering metadata and logs.
Speaks for it
- Encryption is specific and named — 256-bit AES-GCM with a 32-byte vault key, OpenPGP on Curve25519 — extended to usernames, web addresses and notes, not just the password field
- Open-source clients and a public bug bounty are documented on the security pages
- SCIM provisioning is documented step by step for Okta and Microsoft Entra, with groups and Create Users and Deactivate Users actions
- Sharing covers single items and whole vaults, with secure links offering expiry and view limits, revocation at any time, and emergency access on paid plans
- Administrators can enforce policies — required 2FA, sharing outside the organization, export, vault creation, password-generator rules — and view organization-wide sign-in events with location, ISP and device
Held against it
- No price figure appears in the captured pricing pages, so an annual invoice cannot be computed from what is published
- We found no public information on independent audits with named firms and dates, published penetration tests, or disclosed incident history
- We found no public information on where vault data and metadata are hosted, on subprocessors and their locations, or on a data-processing agreement
- We found no public information on log export, an event API, SIEM integration, retention periods, or records of who viewed or copied a shared credential
- We found no public information on a self-hosted option, a selectable data region, offline access during a vendor outage, or a status page with incident history
Best for
- You need end-to-end encryption that covers usernames, web addresses and notes, backed by open-source clients and a public bug bounty
- You run Okta or Microsoft Entra and want documented SCIM joiner-leaver automation with Create Users and Deactivate Users actions
- You want admin-enforceable policies — required 2FA, sharing outside the organization, export, vault creation — with organization-wide visibility of sign-in events
- You are migrating between password managers: import guides cover more than a dozen named competitors, including 1Password, Bitwarden and KeePass, and export includes a PGP-encrypted JSON archive
Avoid if
- You must compute an annual cost from published prices before purchase — ask the vendor: the public pages we read do not show it
- You require an EU-jurisdiction vendor — the company presents itself as Swiss and outside US and EU jurisdiction
- Your audits depend on exportable logs, stated retention periods, or records of who viewed a shared credential — the captured pages show organization-wide sign-in events with location, ISP and device, and we found no public information on log export, SIEM integration or retention
The scores
| Criterion | Panel median |
|---|---|
| Encryption model & independent audits | 3 of 5 |
| Sharing, roles & recovery | 3 of 5 |
| SSO, directory sync & provisioning | 3 of 5 |
| Audit logs, policies & reporting | 2.5 of 5 |
| Hosting choice, offline access & export | 2 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 1 of 5 |
Encryption model & independent audits
Show reasoningHide reasoning
How this is scored
What the vendor can prove about its security design: end-to-end encryption with named algorithms and key derivation, which fields are encrypted on the device and which are not, independent audits and penetration tests with published results, a bug bounty, and incident history disclosed.
0 — Security described in adjectives ("bank-grade", "military encryption") with no architecture, no audit and no statement of what the vendor can read.
3 — Encryption algorithms named and "zero knowledge" claimed, but no whitepaper, no statement of which fields stay unencrypted, and audits mentioned without dates, auditors or results.
5 — A published security whitepaper naming algorithms, key derivation and the client-side encryption model, a stated list of what is and is not encrypted (including URLs and metadata), and a named independent audit or certification (ISO 27001, SOC 2) with its date.
8 — Recurring independent penetration tests or code audits with reports or summaries published, a public bug bounty or vulnerability disclosure policy, past security incidents documented with their impact, and open-source clients or cryptography that can be reviewed.
10 — The design is verifiable end to end: full source or cryptographic design public, every field encrypted client-side including metadata, audits by named firms repeated yearly with full reports, a threat model that states what a compromise of the vendor's servers would expose, and incident post-mortems published.
The CISO
The security page does what I ask of a whitepaper: it names 256-bit AES-GCM and OpenPGP with Curve25519, states that all fields including usernames, web addresses and notes are encrypted client-side, and documents a public bug bounty and open-source clients. What I cannot sign my name to is the rest: we found no public information on independent audits by named firms with dates, published penetration-test results, or a written incident history. 5 3 7
The Identity Engineer
The cryptography is stated with unusual specificity — 256-bit AES-GCM with a 32-byte vault key, OpenPGP on Curve25519, and end-to-end encryption extended to usernames, web addresses and notes so metadata stays unreadable to the vendor — plus open-source clients and a public bug bounty. But we found no public information on independent audits or certifications with named auditors and dates, on how the vault key is derived from the master password, or on disclosed security incidents, which stops me going higher. 5 7
The Compliance Auditor
The captured security pages name the cryptography — vaults encrypted with 256-bit AES-GCM, OpenPGP with Curve25519 — and state that every field including usernames, web addresses and notes is encrypted and that the vendor has no technical means to read contents, backed by open-source clients and a public bug bounty. We found no public information on independent audits or penetration tests with named auditors, dates or published results, and none on disclosed past incidents, so for ISO 27001 purposes the design claims stand largely on the vendor's own description. 5 7 3
The SME Owner
The security pages name the ciphers — 256-bit AES-GCM and OpenPGP with Curve25519 — and state plainly that usernames, web addresses and notes are all encrypted, not just the password field, with open-source apps and a public bug bounty on top. What I could not find is any independent audit or certification with a named firm and date, and we found no public information on incident history, so the design is asserted well but not independently verified in these captures. 3 5 7
The DevOps Engineer
The security page names real cryptography — OpenPGP with Curve25519, 256-bit AES-GCM, a 32-byte vault key nobody else can read — and states that all fields including usernames, web addresses and notes are encrypted client-side, with open-source clients and a public bug bounty I can actually review. We found no public information on independent audits, penetration-test reports or disclosed incident history, which is what would move this higher. 3 5 7
The Skeptic
The security page names its cryptography — OpenPGP with Curve25519 and 256-bit AES-GCM — and states plainly that usernames, web addresses and notes are all encrypted, which is more than most "zero knowledge" pages will admit, with open-source clients and a public bug bounty besides. But we found no public information on key derivation, no named independent audit or certification with a date, and no disclosed incident history — for a vendor staked entirely on trust, silence on audits is itself an answer. 3 5 7
Sharing, roles & recovery
Show reasoningHide reasoning
How this is scored
How credentials are shared and governed across a company: shared vaults or collections, role-based permissions, view-only and time-limited access, admin account recovery, emergency access, and what happens to shared items when an employee leaves.
0 — Personal vaults only, or sharing by sending a password to another user with no permissions and no record.
3 — Shared folders with all-or-nothing access, no roles, and no stated process for recovering an account or reclaiming credentials from a departing employee.
5 — Shared vaults or collections with read, edit and manage permissions, groups and admin roles, an admin recovery mechanism documented with its key model, and offboarding that transfers a leaver's shared items.
8 — Granular permissions down to hiding the password while allowing autofill, time-limited and one-time sharing with external parties, emergency access with a waiting period, delegated administration per team or location, and approval workflows for sensitive items.
10 — Access is governed and provable: least-privilege defaults, recovery and emergency access designed so the vendor never holds a key and stated so, periodic access reviews supported in the product, and every grant, change and revocation attributable to a person.
The CISO
Vaults can be shared with selectable permission levels, as single items or whole vaults, with secure links offering expiry and view limits for people outside the organization, revocation at any time, emergency access, and admin policies over sharing and export. We found no public information on the admin account recovery mechanism and its key model, on reclaiming a leaver's shared items beyond directory deactivation, or on permissions that hide the password while still allowing autofill. 7 8 11 1 9
The Identity Engineer
Vault sharing with selectable access levels, single-item or whole-vault sharing, secure links with expiry and view limits for people outside the company, revocation at any time, and emergency access on paid plans cover the everyday cases. We found no public information on an admin recovery mechanism and its key model, on named roles beyond the admin panel, or on what happens to a leaver's shared items — the offboarding story rests only on the SCIM deprovisioning action in the setup guides. 7 8 9 1
The Compliance Auditor
Vault sharing with selectable access levels, single-item or whole-vault sharing, and secure links for outsiders with expiry and view limits are documented, alongside emergency access on paid plans and organisation-wide toggles for individual-item sharing and sharing outside the organisation. The access levels themselves are never enumerated, and we found no public information on an admin recovery mechanism and its key model or on how a leaver's shared items are reclaimed. 7 8 1 11
The SME Owner
Vault sharing by email with selectable access levels, single-item sharing, revocation, and secure links that expire after a set number of views cover how my team would work day to day, and emergency access is listed among the paid features. But I found no public information on an admin recovering a member who forgets their master password — the recovery email is the only mechanism described — nor on transferring a leaver's vaults when someone walks out the door, which are the two things that decide whether I can retire our Excel file. 3 7 8 11 1
The DevOps Engineer
Vault sharing by email with selectable access levels, single-item or whole-vault sharing, secure links with expiry and view limits for outsiders, revocation, and emergency access on paid plans cover the daily needs of a team. The access levels are offered but never named, and we found no public information on an admin recovery mechanism or on what happens to a departing employee's shared items. 7 8 11 1
The Skeptic
Vault and single-item sharing with selectable access levels, secure links with expiry and view limits, revocation at any time, emergency access, and admin toggles for sharing outside the organization are all evidenced. What we found no public information on is the key model behind admin recovery, what happens to a leaver's shared items, and whether permission levels go below coarse read-and-edit — the hide-password-while-autofill kind of granularity the pages never describe. 7 8 11 1
SSO, directory sync & provisioning
Show reasoningHide reasoning
How this is scored
How the vault fits into the company's identity stack: SSO with Entra ID, Okta or Google, and the key model behind an SSO unlock; SCIM or directory sync for joiners and leavers; MFA options including hardware keys; and passkey support for users and the vault itself.
0 — Each user creates an account by email; no SSO, no directory sync and no MFA beyond an app code.
3 — SSO available only to sign in to the admin console or on the top tier with no description of how the vault is then decrypted, and users provisioned by CSV invite.
5 — SSO with named identity providers (Entra ID, Okta, Google) documented with how the vault key is derived or released, SCIM or directory sync for provisioning and deprovisioning, and MFA including FIDO2 or hardware keys.
8 — SSO unlock designed so the vendor cannot derive the vault key and stated so, group sync driving vault permissions, automated suspension on deprovisioning, conditional access or device policies, and passkeys stored and used across platforms.
10 — Identity is integrated without trust shortcuts: the SSO key model published and independently reviewed, deprovisioning that revokes vault access and shared items immediately with a log entry, passwordless vault unlock with passkeys, and support for the customer's own key-management or trusted-device approval.
The CISO
SSO is offered, documented setup guides cover SCIM provisioning with Okta and Microsoft Entra including user deactivation and SCIM groups, passkeys work across devices, and administrators can enforce 2FA for the whole organization. We found no public information on how the vault key is derived or released when a user unlocks through SSO, or on FIDO2 hardware-key authentication. 9 10 1 11 5
The Identity Engineer
SCIM for Microsoft Entra is documented with base URL and token, group support and Create and Deactivate user actions, and passkeys are supported across all devices — close to what my joiner-mover-leaver process needs. But we found no public information on how the vault key is derived or released when a user signs in with SSO, no named hardware security key support for the vault itself, and no conditional access or device policy story, which is exactly the documentation I would need before trusting SSO unlock for two thousand staff. 9 10 11 1 5
The Compliance Auditor
SCIM provisioning is documented step by step for Okta and Microsoft Entra with create and deactivate actions plus groups, passkeys are supported across all devices, and two-factor authentication can be enforced by policy. We found no public information on how the vault key is derived or released under single sign-on, on hardware security keys, or on conditional access and device policies. 9 10 5 11
The SME Owner
Okta and Microsoft Entra are both documented with step-by-step SCIM setup including user creation and deactivation, groups, and passkeys across devices — the joiner-leaver automation I want. The captured pages never explain how the vault key is derived or released when someone signs in through SSO, and we found no public information on hardware security keys as an MFA option. 5 9 10 1
The DevOps Engineer
SCIM is documented end to end for both Okta and Microsoft Entra with a base URL and token, group support, and create-user and deactivate-user lifecycle actions, and passkeys work across devices with enforceable two-factor policies. We found no public information on how the vault key is derived or released at an SSO unlock, on FIDO2 hardware keys as a login method, or on Google as an identity provider. 5 9 10 11 1
The Skeptic
SSO with Okta and Microsoft Entra is documented alongside SCIM provisioning with groups and a Deactivate Users action, passkeys work across devices, and 2FA can be enforced for everyone in the organization. But the pages never say how the vault key is derived or released when a user signs in through SSO — the exact point where zero-knowledge quietly dies — and we found no public information on hardware security keys, conditional access, or what deprovisioning does to shared items. 5 9 10 11 1
Audit logs, policies & reporting
Show reasoningHide reasoning
How this is scored
What an administrator and an auditor can see and enforce: event logs of access and changes, password health and breach reports, enforceable policies (master password, MFA, sharing, export), SIEM integration, and reports an ISO 27001 or NIS2 audit can use.
0 — No audit log and no admin policies; the administrator sees a user list.
3 — A basic activity list and a password-strength score, but no exportable log, no enforceable policies, and no record of who viewed or copied a shared credential.
5 — Event logs covering logins, item access, sharing and admin changes, exportable or available through an API, enforceable policies for master password and MFA, and password health and breach-monitoring reports.
8 — Native SIEM integration with named targets (Splunk, Microsoft Sentinel, Elastic or syslog), policies for sharing, export and browser-extension behaviour, log retention stated, and compliance reports aligned to ISO 27001, NIS2 or BSI IT-Grundschutz.
10 — Auditability is complete: every view, copy, autofill and permission change logged with user and device, logs tamper-evident and retained for a configurable period, alerting on anomalous access, and an auditor role that can read logs without access to secrets.
The CISO
Administrators get real, enforceable policies — 2FA enforcement, export restrictions, sharing controls, vault-creation limits and password-generator rules — plus password health, dark-web monitoring and inactive-2FA reports, and the activity monitor records sign-in events with location, ISP and device for the whole organization. We found no public information on logging of item-level access such as who viewed or copied a credential, on log export or a SIEM integration, or on stated log retention. 11 12 5 1
The Identity Engineer
Enforceable team policies for two-factor authentication, sharing outside the organisation, export and vault creation, plus Sentinel's organisation-wide view of sign-in events with location, ISP and device, and password health with dark web monitoring, give an administrator real levers. We found no public information on exportable logs or an event API, named SIEM targets, log retention, or records of who viewed or copied a shared credential, so the evidence trail an ISO 27001 auditor would ask for stays thin. 11 12 1 5
The Compliance Auditor
Team policies are real and enforceable — two-factor authentication, data export, sharing outside the organisation, vault creation and password-generator rules — and Sentinel gives admins organisation-wide sign-in events with location, ISP and device, plus password health and breach-monitoring reports. We found no public information on logs of item views or copies, on exporting logs to a SIEM, on log retention periods, or on reports an ISO 27001 or NIS2 audit could rely on. 11 12 5 1
The SME Owner
Team policies are genuinely enforceable — required 2FA, sharing restricted to the organization, export toggles, even password-generator rules — and Sentinel surfaces sign-in events with location, ISP and device, plus password health and breach alerts. There is no stated log export or API, no named SIEM targets, no retention period, and I found no public information on reports an ISO 27001 or NIS2 auditor could use. 5 11 12 1
The DevOps Engineer
Enforceable team policies are genuinely there — two-factor enforcement, export restrictions, sharing outside the organization, vault creation control — alongside password health, dark-web breach alerts and sign-in events with location, ISP and device. We found no public information on records of who viewed a shared credential, on exportable or API-accessible logs, on SIEM integration or on a stated log retention period, so an ISO 27001 or NIS2 audit would be thin. 5 11 12 1
The Skeptic
Enforceable policies are the strong suit: 2FA for everyone, password-generator rules, individual item sharing, sharing outside the organization, vault creation and export can each be toggled by an admin, while Sentinel surfaces org-wide sign-in events with location, ISP and device. The logging half is thinner — the pages show authentication and security events, not records of who viewed or copied a shared credential — and we found no public information on log export, an API, SIEM integration, retention periods, or an auditor role. 5 11 12 1
Hosting choice, offline access & export
Show reasoningHide reasoning
How this is scored
Where and how the vault runs and how the data leaves it: cloud region choice, a self-hosted or on-premises option, offline access during a vendor outage, client coverage across operating systems and browsers, and a complete, documented export and import path.
0 — Cloud only in an unstated region, no offline access, and no export or an export that drops attachments and shared items.
3 — Cloud with a region named, apps for common platforms, and an export in CSV only that leaves out attachments, folders, TOTP seeds or custom fields.
5 — An EU region or self-hosted option, offline read access on desktop and mobile, clients for Windows, macOS, Linux, iOS, Android and the major browsers, and an export that covers all item types including attachments.
8 — Both EU cloud and self-hosted or on-premises deployment documented, a status page with incident history, encrypted full-fidelity export and import from named competitors, and vault access continuing during an outage of the vendor's service.
10 — The customer can run and leave the vault on their own terms: self-hosting with documented high availability and backup, an open or documented export format that preserves structure, permissions and history, and a stated procedure for continued access if the vendor ends the service.
The CISO
Clients cover Windows, macOS, Linux, Android, iPhone and iPad, the web and all major browsers; export offers a PGP-encrypted JSON inside a ZIP, an unencrypted ZIP or CSV, and import guides exist for thirteen named competitors. We found no public information on a self-hosted option, a selectable cloud region, offline access during a vendor outage, or whether export preserves attachments; the terms promise a 99.95 percent uptime target with service credits, but we found no public information on a status page with incident history. 14 13 1 1 4
The Identity Engineer
Clients cover Windows, macOS, Linux, Android, iPhone and iPad plus the five major browsers, and export runs to a PGP-encrypted JSON file with documented import paths from around sixteen named competitors. Hosting is described as Switzerland only, and we found no public information on a self-hosted option, offline access during a vendor outage, or a status page with incident history. 13 14 1 5
The Compliance Auditor
Clients cover Windows, macOS, Linux, Android, the major browsers and a web app, and export offers a PGP-encrypted JSON archive with import documented from a dozen named competitors, under an SLA targeting 99.95% monthly uptime with service credits. We found no public information on self-hosting or a selectable data region, on offline access during a vendor outage, or on a status page with incident history, and the captured client lists show no iOS. 1 14 13 4
The SME Owner
Export is the strong part: a PGP-encrypted JSON archive alongside CSV, with import guides for a dozen named competitors including 1Password, Bitwarden and KeePass, and apps across Windows, macOS, Linux, Android and iPhone. I found no public information on offline access during an outage, self-hosting, or a status page with incident history, and beyond the Swiss jurisdiction claim the actual data residency is not confirmed in these captures. 5 8 13 14 1
The DevOps Engineer
Clients cover Windows, macOS, Linux, Android and iPhone plus the major browsers, a command-line tool ships on paid plans for pipelines, import guides exist for more than a dozen competitors, and export offers a PGP-encrypted JSON archive rather than CSV alone. This is cloud-only under Swiss jurisdiction with no self-hosted or on-premises option, and we found no public information on offline access during an outage or on whether the export carries attachments. 1 8 13 14 1
The Skeptic
Client coverage is broad — Windows, macOS, Linux, Android, iPhone and iPad, five browsers, a web app — and the exit path is real: a PGP-encrypted JSON archive that imports straight back in, plus import guides for a dozen named competitors. But the captured pages name Switzerland as the whole hosting story, and we found no public information on region choice, self-hosting, offline access during a vendor outage, a status page with incident history, or whether export preserves attachments and shared structure. 5 8 13 14 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where vault data and metadata are hosted, and who the subprocessors are. Independently sourced by the sovereignty pipeline; end-to-end encryption narrows what a foreign authority could compel, but metadata, logs and the update channel for the client software remain in the vendor's hands, so the chain still counts.
0 — Non-EU vendor and contracting entity, hosting unstated, and subprocessors unnamed.
3 — An EU data region offered while the contracting entity and parent are non-EU without a stated safeguard, or the subprocessor list is absent.
5 — EU hosting as standard or selectable and an EU contracting entity, but the parent company or parts of the chain (support, analytics, email, client distribution) are non-EU.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessor list published with locations, a DPA covering vault metadata and logs, and a self-hosted option that removes the vendor from the data path.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, certifications published (ISO 27001, BSI C5 or equivalent), and source code or builds verifiable so the client update channel is not a blind trust in the vendor.
The CISO
The captured pages place Proton AG in Geneva, Switzerland, outside US and EU jurisdiction, and the Swiss jurisdiction is restated on the product pages — but that is where the chain stops being evidenced. We found no public information on where vault data, metadata and logs are actually hosted, on company ownership, or on a subprocessor list with locations, and no data-processing agreement covering metadata and logs appears in the captured legal pages. 5 3 1
The Identity Engineer
The captured pages state a Swiss company and Swiss jurisdiction and encrypt every field including metadata, with no permanent IP logs by default, but they leave vault data residency unconfirmed. We found no public information on subprocessors and their locations, a data processing agreement covering metadata and logs, or published certifications, so the chain outside the encrypted payload remains unverifiable to me. 3 5 1
The Compliance Auditor
The contracting entity presents itself as Swiss and states it sits outside US and EU jurisdiction. We found no public information on where vault data and metadata are actually hosted, on the ownership chain, or on any subprocessor, so the chain from metadata and logs to the client update channel cannot be assessed from public pages. 5 4 1
The SME Owner
The pages claim a Switzerland-based company outside US and EU jurisdiction, which I can live with, but the contracting entity, ownership, actual hosting residency and every subprocessor are unconfirmed on the vendor's own pages and I found no published subprocessor list. End-to-end encryption narrows what anyone could compel, yet metadata, logs and the client update channel remain in the vendor's hands. 3 5 1
The DevOps Engineer
Proton presents itself as a Swiss company under Swiss jurisdiction and outside US and EU law, keeps no permanent IP logs by default and accepts anonymous cash or Bitcoin payment. The captured pages give no statement of where vault data and metadata are hosted, no subprocessor list with locations and no data-processing agreement, and we found no public information on the ownership structure. 3 4 5 1
The Skeptic
The vendor's own words place the company and its jurisdiction in Switzerland, and the privacy posture — no permanent IP logs by default, anonymous cash or Bitcoin accepted — is consistent with that story. But the captured pages confirm neither the contracting entity nor where vault data and metadata are hosted, and we found no public information on subprocessors, their locations, or a data-processing agreement covering metadata and logs — the chain outside the ciphertext stays unevidenced. 3 5 1
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, which features (SSO, SCIM, SIEM, self-hosting) sit in which tier, minimum seats, add-ons, and the minimum term.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but which business features (SSO, SCIM, audit logs) sit in which tier is unclear — the invoice is unknowable.
5 — Per-user tier prices public with the main features per tier, but at least one commonly needed piece (SSO, SIEM integration, self-hosting, minimum seats) is unpriced or "on request".
8 — Every tier priced publicly with its feature set and seat minimum, add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: annual invoice derivable for a given number of users, with every add-on, self-hosting licence, support level and renewal condition published.
The CISO
The pricing page lays out four business tiers with detailed feature comparisons and seat ranges such as three to thirty users, yet none of the captured pricing text states a per-user price in any currency, so a buyer cannot compute an invoice. We found no public information on add-on prices, minimum term or VAT treatment, and the business trial is obtained by contacting the sales team. 2 1 1
The Identity Engineer
The pricing page publishes tier structures, seat ranges from three users upward and per-plan inclusions — enforceable two-factor authentication and 99.95% uptime in all plans, team policies on the Professional and Workspace tiers, SCIM tied to the business plan — but we found no public information on price figures themselves, so no annual cost can be computed. VAT treatment, minimum term and add-on prices are also absent from what I can see. 2 9 11
The Compliance Auditor
The captured pricing page lays out tier features with seat minimums and the user counts that unlock phone support or a dedicated account manager, but shows no per-user price figures. We found no public information on prices or tier placement for single sign-on, SCIM and audit logging, on add-ons, or on minimum terms, and the business trial itself runs through contacting the sales team. 2 1
The SME Owner
The pricing page gives a real tier comparison — seat minimums from three users, storage, VPN connections, phone support from six users — but not one price figure appears in anything captured, and the business trial runs through contacting the team. I cannot compute what forty users would cost me for a year from public pages, and where SSO and SCIM sit relative to the named tiers is not pinned down either. 2
The DevOps Engineer
The business pricing page maps four tiers clearly against features such as storage, seats, phone support and uptime, so feature placement is visible. We found no public information on per-user prices, seat minimums beyond the tier limits, add-ons, minimum terms or VAT treatment, and the business trial runs through a sales contact — the annual invoice is not computable from what is captured. 2
The Skeptic
The pricing page publishes tier names, seat bands and a detailed feature matrix — storage per user, VPN countries, uptime, support eligibility — but not one price figure appears in the captures, and the business trial runs through a sales contact. A buyer cannot compute an annual invoice from these pages; we found no public information on per-user prices, add-ons, minimum term, or VAT treatment. 2
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Proton Pass
Is Proton Pass European?
Yes, though not from the EU. whats-best.ai classifies Proton Pass as UK / wider Europe.
Where does Proton Pass store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Proton Pass have a free plan?
Yes. Proton Pass has a free plan, per the vendor’s page captured 1 Oct 2026.
What are the best alternatives to Proton Pass?
As of 21 Oct 2026, the panel rates Password Depot (3.5/5), Keeper (3/5) and Passbolt (3/5) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Password Depot (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Proton Pass alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Subprocessors, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage proton.me Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 2 Pricing page proton.me Checked 13 Oct 2026 Details →
- 3 Privacy policy proton.me Checked 13 Oct 2026 Details →
- 4 Terms of service proton.me Checked 13 Oct 2026 Details →
- 5 Encryption model & independent audits — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 6 Encryption model & independent audits — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 7 Sharing, roles & recovery — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 8 Sharing, roles & recovery — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 9 SSO, directory sync & provisioning — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 10 SSO, directory sync & provisioning — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 11 Audit logs, policies & reporting — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 12 Audit logs, policies & reporting — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 13 Hosting choice, offline access & export — found from sitemap proton.me Checked 13 Oct 2026 Details →
- 14 Hosting choice, offline access & export — found from sitemap proton.me Checked 13 Oct 2026 Details →