Can I trust Proton Drive: Cloud Storage?
This scan is more than 90 days old.
This app cleared every trust check that applied to it, with no red flags.
- Best for
- Users storing sensitive files in the cloud
- What it means for you
- File content, names, sizes, and metadata are end-to-end encrypted, meaning Proton cannot read stored files. The app includes code to send crash diagnostics to Sentry using a random identifier that cannot be linked to a Proton account. The build includes no code to send data from normal use to advertising, analytics, or attribution companies.
- Main concern
- Plaintext password briefly stored in SQLite during login on rooted/ADB-accessible devices
- The developer's description
- Proton Drive is a secure cloud storage app with end-to-end encryption for all files and metadata. No third-party trackers or ads. Crash reporting and telemetry are user-controlled and don't collect file data.
- Third-party services
- 7
- Findings rated low or higher
- 3
Open on Google PlayOpens the app's listing on Google Play in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
StrongStrong security foundation
Why this result
This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.
No critical or high-severity security issues were found. The app uses strong encryption for all file content and metadata, hardware-backed key storage for login tokens, certificate pinning against a fixed set of server fingerprints, and blocks all unencrypted network traffic. Two moderate issues exist: the SSO login flow accepts callbacks from any app on the device (not just Proton's own), and the account password is briefly stored unencrypted during login before being cleared. Neither issue is remotely exploitable and neither meets the bar for a serious security failure.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
No third-party advertising or behavioral analytics SDKs are present. The only data gathering code found handles crash reports and operational statistics, and the app includes code to send them exclusively to Proton's own servers. Both are controlled by opt-out settings the user can toggle in Privacy settings, and the code enforces those toggles — when crash reporting is disabled, events are dropped before they leave the app.
Manifest Mismatch
StrongEverything visible
Why this result
The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.
The app's behavior matches what a privacy-focused cloud storage service should disclose. Crash reporting and telemetry are both opt-outable and limited to Proton's own servers, consistent with Proton's stated privacy commitments. No third-party SDKs are present that would need to be disclosed but aren't. The clipboard code only writes links for others to open, at the user's explicit request, and is not used for background reading.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
Truly Local
StrongStays on the device
Why this result
This app presents itself as working offline or on the device alone. The check looks for any code written to send personal data to a server, including analytics, crash reporting and advertising code. None was recorded in this build.
The build includes code that encrypts files on the device before they are placed in requests built for Proton's servers, so Proton cannot read your content. File names, sizes, and even photo location metadata are encrypted the same way. The app includes code to send crash reports and performance statistics only to Proton's own infrastructure; the build includes no code to send user data to advertising networks, analytics companies, or data brokers. The only non-Proton destinations named in code are Google for in-app purchases and Google's on-device machine learning service for the document scanner feature.
Strengths
- SPKI certificate pinning with 6 primary and 4 alternative pins
- Certificate Transparency enforcement via appmattus library
- DNS-over-HTTPS with 48 providers for censorship-resistance
- No cleartext traffic — HTTPS enforced at OS level
- End-to-end encryption for file content, names, sizes, and metadata via GopenPGP
- Android Keystore AES/GCM encryption for access and refresh tokens
- Biometric-bound app-lock key with setUserAuthenticationRequired(true)
- OpenPGP private keys stored passphrase-protected with Keystore-encrypted passphrase
- android:allowBackup="false" prevents credential backup
- No third-party analytics, advertising, or attribution SDKs
What the app contains
7 services
Third-party services the scan names in the build:
- Sentry Android
- Sentry Replay
- Google Play Billing
- Google ML Kit Document Scanner
- Google Data Transport (CCT)
- ZXing / journeyapps barcode scanner
- appmattus/certificate-transparency
Libraries
| Library | Version | Advisory |
|---|---|---|
| libandroidx.graphics.path | not recorded | none confirmed |
| libandroidx.graphics.path | not recorded | none confirmed |
| libandroidx.graphics.path | not recorded | none confirmed |
| libcrypto | 3.0.18 | none confirmed |
| libcrypto | 3.0.18 | none confirmed |
| libcrypto | 3.0.18 | none confirmed |
| libdatastore_shared_counter | not recorded | none confirmed |
| libdatastore_shared_counter | not recorded | none confirmed |
| libdatastore_shared_counter | not recorded | none confirmed |
| libe_sqlite3 | not recorded | none confirmed |
Show all 47 librariesShow fewer
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Files decompiled
- 22,868
- Scan date
- 13 June 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.