CITT

    Scan results

    Proton Mail: Encrypted Email

    Android

    Proton Mail's encrypted email app protects your communications with end-to-end encryption. Create a @proton.me or @protonmail.com email address, send encrypted emails with ease, manage multiple accounts, and enjoy security features like password-protected emails and dark mode.

    CITT SCORE
    98
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Anyone wanting private email with minimal data exposure

    What It Means For You

    Emails are end-to-end encrypted, meaning even Proton cannot read them. Push notifications are delivered through Firebase Cloud Messaging, and crash reports go to a self-hosted Sentry instance rather than a third-party service. Purchases go through Google Play Billing, which shares transaction data with Google.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (6)

    Data Security

    2 total
    1 Low
    1 Info

    Code Security

    3 total
    1 Medium
    1 Low
    1 Info

    Privacy

    1 total
    1 Info

    Third-Party Services

    Firebase Cloud Messaging, Sentry (self-hosted), Google Play Billing, Google Play Services, ZXing/JourneyApps, Coil, OkHttp3, Dagger Hilt, Jetpack Compose

    Security Strengths

    • ✓HTTPS-only communication with certificate pinning
    • ✓Android KeyStore with AES-256-GCM encryption
    • ✓Backup disabled (no ADB exposure)
    • ✓No advertising or analytics SDKs
    • ✓Firebase Analytics explicitly disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    email
    encryption
    privacy focused
    sensitive data
    security focused

    Package

    ch.protonmail.android

    Version

    7.7.1 (Build 16244)

    Analysis Date

    Mar 4, 2026

    Classes Analyzed

    16,128

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 2 findings (1 low, 1 info)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 1 finding (1 info)

    Privacy Concerns

    What Data is Collected

    Push notification delivery requires registration with Firebase Cloud Messaging, which processes delivery data on Google's servers. In-app purchases are handled by Google Play Billing, which collects transaction details. Basic device information is shared with Google Play Services to support core app functionality.

    Third-Party Data Sharing

    Purchase history and transaction details are shared with Google through Google Play Billing. Push notification delivery data passes through Google's Firebase infrastructure. No advertising networks or behavioral profiling services receive user data.

    Understanding the Scores

    CategoryScore
    Security97/100
    Privacy100/100
    Data Security96/100
    Network Security100/100
    Code Safety97/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • Email content is encrypted end-to-end before it leaves the device, so no one other than the sender and recipients can read it
    • Crash and error reports are sent to Proton's own self-hosted infrastructure rather than a commercial third-party service
    • No advertising, behavioral profiling, or third-party analytics SDKs are present in the app
    • Third-party integrations are limited to infrastructure essentials, with no data shared for marketing purposes

    Areas for Improvement

    • In-app purchase data, including what is bought and when, flows through Google Play Billing and is subject to Google's data practices
    • Push notification delivery routes through Google's Firebase infrastructure, meaning Google handles the delivery path for incoming message alerts

    About This Analysis

    This scorecard is generated from automated static analysis of the app's compiled code and configuration. It reflects security and privacy practices found in the version analyzed below.

    App Details

    App NameProton Mail: Encrypted Email
    Package IDch.protonmail.android
    Version7.7.1 (Build 16244)
    Scan DateMarch 4, 2026

    Right of Reply

    Developer not yet contacted