Proton Pass - Password Manager Security & Privacy Scorecard

Proton Pass

What This Means for You

Your passwords and account data are protected with strong encryption and stored exclusively on Proton's own infrastructure, with no third-party advertising or analytics companies receiving your data, though screen content could briefly be captured during app errors if session recording is active without full masking enforced.

Recommendation: Acceptable with Awareness

Strong encryption and zero third-party tracking make this a solid password manager choice. The app routes all data through Proton's own servers, and no outside companies receive your information. Two areas warrant awareness: a deprecated key protection setting that weakens security on devices with bypassed OS protections, and session recording code that may not guarantee masking in all error conditions.

Best For: Users who want a password manager with no third-party data sharing and strong encryption backed by Proton's own infrastructure.

Key Findings

Data Security - 3 findings (1 medium, 2 info)

Network Security - 2 findings (2 info)

Code Safety - 2 findings (1 low, 1 info)

Privacy - 6 findings (1 medium, 1 low, 4 info)

Privacy Concerns

What Data is Collected

• Usage events and user tier data (batched locally, sent to Proton's own servers)
• Crash and performance diagnostics (sent to Proton's self-hosted error reporting service)
• Vault item metadata such as usernames, email addresses, and site names (only if you enable Spotlight search - opt-in)

Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

Understanding the Scores

Security: 95/100
Privacy: 93/100

Security Breakdown

• Data Security: 93/100 - Strong file and keychain protection with one deprecated protection setting for vault keys
• Network Security: 100/100 - All connections use HTTPS with no exceptions and active connection security measures in place
• Code Safety: 99/100 - Minimal attack surface; staging configuration files are unnecessarily included in the production app

Privacy Breakdown

• Data Collection: 97/100 - Minimal data collection; usage telemetry goes only to Proton's own infrastructure
• Data Sharing: 100/100 - No data shared with any third-party company
• User Control: 95/100 - Spotlight indexing is opt-in; session recording masking enforcement is unverifiable from static analysis

Positive Security Features

• No third-party analytics, advertising, or tracking SDKs present anywhere in the app
• All connections use HTTPS with no exceptions across all production endpoints
• Hardware-bound biometric keys stored in the device's Secure Enclave (non-exportable)
• Files are fully protected when the device is locked
• Password clipboard copies expire automatically and are blocked from syncing to other devices
• Connection security implemented via TrustKit for all API communications
• Browser-style view restricted exclusively to Proton's human verification page with no exposed scripting interface
• Crash reporting routed to Proton's own self-hosted infrastructure, not an external company
• Apple privacy manifest accurately declares all data access categories with NSPrivacyTracking set to false

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Session Recording Masking Enforcement
   Proton could provide clear public documentation or in-app confirmation that screen recording is disabled or that full masking is enforced before any session data is transmitted, giving users categorical assurance.

2. Spotlight Search Disclosure
   When users enable Spotlight search, the app could explicitly inform them that login and credit card metadata (names, usernames, email addresses, and URLs) will be stored outside the app's encrypted and authenticated storage.

Security Enhancements

1. Key Protection Class Update
   The vault's primary key uses a protection class that is deprecated as of iOS 16. Updating to the recommended replacement would ensure the key remains inaccessible before the device is first unlocked after a reboot, which is particularly relevant for AutoFill scenarios.

2. Remove Staging Configuration from Production Builds
   Internal QA and staging environment configuration files are included in the production app bundle. Removing these from production releases would reduce the information available about internal infrastructure.

Technical Context

App Type: Password manager - high sensitivity
Classes Analyzed: iOS binary analysis (symbol and string extraction)
Third-Party Services: 1 (Sentry error reporting, self-hosted on Proton infrastructure)
Context Tags: passwordmanager, sensitivedata, encryption, autofill, ios_extensions

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Proton
Version: 1.19.0 (Build 14)
Analysis Date: 2026-04-18
Package: me.proton.pass.ios

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on app version 1.19.0 (Build 14) analyzed on 2026-04-18
• May not reflect server-side security controls
• Cannot detect all runtime behaviors