Proton Drive: Cloud Storage Security & Privacy Scorecard

Proton Drive: Cloud Storage

What This Means for You

Your files, photos, and file names are end-to-end encrypted so only you can read them, and you have full control over the optional crash reporting and usage metrics that Proton uses to improve the app.

Recommendation: Very Secure

Proton Drive delivers exceptional security and privacy for cloud storage. Files, photos, and their metadata are encrypted on your device before upload, meaning Proton itself cannot access your content. The app contains no advertising or tracking libraries, and all diagnostic reporting is optional and fully controlled by you.

Best For: Privacy-conscious users seeking secure cloud storage with end-to-end encryption and no third-party advertising or tracking.

Key Findings

Data Security - 1 finding (1 medium)

Network Security - 1 finding (1 medium)

Code Safety - 2 findings (1 low, 1 info)

Privacy - 1 finding (1 info)

Privacy Concerns

What Data is Collected

• Account information: Your email address and account login details are sent to Proton's servers to authenticate your account.
• Your files and photos: Uploaded to Proton's servers with end-to-end encryption applied on your device before upload. File names, sizes, and modification dates are also encrypted before leaving your device. Proton cannot read your content.
• Crash reports (optional, you control this): When enabled, device model, operating system version, app version, and error details are sent to Proton's own servers to help fix bugs.
• Usage metrics (optional, you control this): When enabled, technical statistics such as backup duration and upload counts are sent to Proton's servers. No file names or content are included.

Third-Party Data Sharing

The following third parties may receive your data:

• Google - processes payment and billing information when you purchase a subscription or storage upgrade through the Play Store.

Understanding the Scores

Security: 93/100
Privacy: 100/100

Security Breakdown

• Data Security: 95/100 - Your files, photos, and file names are protected with end-to-end encryption before leaving your device. Sensitive keys are secured through Android hardware-backed storage with biometric binding.
• Network Security: 95/100 - All connections use HTTPS exclusively, with multiple layers of server authentication protection across all network communications.
• Code Safety: 99/100 - Strong development practices throughout, with well-managed dependencies and no significant code safety concerns.

Privacy Breakdown

• Data Collection: 100/100 - No advertising, behavioral profiling, or user tracking data collection identified. File content and metadata remain entirely within your control.
• Data Sharing: 100/100 - No data is shared with advertising or analytics companies. Third-party data contact is limited to payment processing when making purchases.
• User Control: 100/100 - Crash reporting and usage telemetry can each be independently disabled from settings, giving you complete control over what is shared with Proton.

Positive Security Features

• End-to-end encryption for all file content, file names, sizes, and modification dates. Even Proton cannot read your files.
• Files are encrypted on your device before upload using open-source cryptography that is publicly reviewed.
• Biometric and PIN-protected app lock with hardware-backed key security.
• Account information is excluded from device backups, preventing unintended account exposure via backup services.
• Crash reporting uses a random identifier not linked to your Proton account.
• Your private encryption keys are stored with hardware-backed protection.
• No advertising, analytics, attribution, or behavioral tracking libraries found in the app.
• DNS-over-HTTPS support with multiple provider options for enhanced connection privacy.
• Key Transparency module for independently verifying the authenticity of encryption keys.
• Memory safety protections enabled on supported devices.

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Play Store Privacy Declaration
   The Play Store data safety section could more explicitly describe the types of device information included in the optional crash reports so users can make a fully informed choice before enabling them.

Security Enhancements

1. SSO Login Flow
   The single sign-on login process could be hardened so that a malicious app installed on the same device cannot intercept the sign-in callback. This is most relevant to users who log in via an organization SSO provider on devices with unverified apps installed.

2. Login Credential Handling Window
   During the login process, your account password may briefly reside in the app's local storage before being cleared. Tightening this window would reduce any residual exposure during the authentication sequence.

Technical Context

App Type: Cloud storage, sensitive personal files and photos
Classes Analyzed: 22,868
Third-Party Services: 7
Context Tags: sensitivedata, cloudstorage

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Proton AG
Version: 2.39.0 (versionCode 43791)
Analysis Date: 2026-06-13
Package: me.proton.android.drive

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2.39.0 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors