Lumo by Proton Security & Privacy Scorecard

Android

92
Overall trust score
Very Secure
93
Security
91
Privacy

Crash reports are sent to Proton's own GDPR-governed servers, not to external analytics companies. On-device speech processing via Vosk means audio never leaves the device. Google Play services handle billing and app delivery, with no third-party advertising, analytics, or behavioral tracking SDKs present.

Best for

Proton users who want limited third-party data sharing

Findings

  • 0 critical
  • 0 high
  • 2 medium
  • 1 low
  • 2 info

1 issue identified across security and privacy analysis.

Top security issues

  • WebView Payment JavaScript Bridge Lacks Runtime Origin Guard
  • WebAuthActivity Deep Link Accepts Arbitrary Host with No URI Validation
  • WebView JavaScript Bridge Uses Substring Matching for Origin Validation

Top privacy issues

  • Sentry Session Replay SDK Bundled — Activation State Unclear, Opt-Out Does Not Cover Replay
  • Sentry DSN Hardcoded — Self-Hosted Write-Only Endpoint
  • WebView Payment JavaScript Bridge Lacks Runtime Origin Guard

Full analysis

Lumo by Proton

What This Means for You

Your conversations stay confidential, your voice is processed on your device, and no advertising networks or third-party trackers receive your data.

Recommendation: Very Secure

Delivers strong encryption and privacy with zero third-party tracking. Well-suited for users seeking a secure, confidential AI assistant from Proton's trusted team.

Best For: Privacy-conscious users seeking a Proton-branded AI assistant with no third-party analytics or ad tracking

Key Findings

Data Security - 1 finding (1 info)

Network Security - 2 findings (1 medium, 1 info)

Code Safety - 1 finding (1 low)

Privacy - 1 finding (1 medium)

Privacy Concerns

What Data is Collected

  • Account information: your email address is used for authentication with Proton's servers
  • Device information: device details may be sent to Proton's own crash reporting service to help diagnose errors
  • Voice input: processed entirely on your device and never transmitted to any server
  • Chat conversations: sent to Proton's servers to generate AI responses, encrypted in transit

Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

Understanding the Scores

Security: 93/100
Privacy: 91/100

Security Breakdown

  • Data Security: 100/100 - Exceptional data handling. Account details are protected with hardware-backed encryption that cannot be extracted from your device.
  • Network Security: 93/100 - All connections are encrypted and the app blocks cleartext traffic throughout.
  • Code Safety: 97/100 - Strong protections against unauthorized app modification, with account logic built in a memory-safe language for added reliability.

Privacy Breakdown

  • Data Collection: 92/100 - Minimal data footprint. Voice input stays entirely on your device, and the app carries no advertising or behavioral tracking software.
  • Data Sharing: 100/100 - No user data is shared with advertising networks or third-party analytics services.
  • User Control: 91/100 - Crash reporting can be disabled in settings, and data deletion can be requested from Proton.

Positive Security Features

  • Voice input processed entirely on your device. Audio is never transmitted to any server.
  • Hardware-backed encryption protects your account details, preventing them from being extracted from your device
  • All network traffic is encrypted and the app blocks cleartext connections throughout
  • No advertising networks, behavioral tracking, or third-party analytics receive your data
  • Crash reporting routes to Proton's own GDPR-governed infrastructure, not to third-party services
  • Crash reporting respects your opt-out choice in settings
  • Tamper detection prevents modified versions of the app from being distributed
  • Minimal permissions — no access to contacts, SMS, location, or broad file storage

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Session Replay Opt-Out Coverage
    A screen-recording diagnostic tool is bundled in the crash reporting library. Disabling crash reporting in settings does not currently extend to this tool. Unifying the opt-out for both features would give users more complete control over what diagnostic data may be captured from their screen.

Security Enhancements

  1. In-App Browser URL Filtering Precision
    The in-app browser identifies trusted pages driving the payment flow using a text-search method. Switching to an exact domain comparison would close a theoretical gap where a crafted URL could bypass the check.

  2. Authentication Callback Validation
    The login callback handler accepts incoming responses from any source. Restricting it to known Proton domains would add a layer of defense against a malicious app on the same device attempting to interfere with the login flow.

Technical Context

App Type: Privacy-focused AI assistant, subscription-based, high sensitivity
Classes Analyzed: 2,800
Third-Party Services: 14
Context Tags: aiassistant, privacyfocused, subscription, inapppurchase, webview, speechrecognition, sensitivedata

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Proton AG
Version: 1.5.3-gms (versionCode 59)
Analysis Date: 2026-06-13
Package: me.proton.android.lumo

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on APK version 1.5.3-gms analyzed on 2026-06-13
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#1 (current) 92/100