The Proton Blog

EU fines Google $1 billion over its search and Play Store

Edward Komenda — Thu, 23 Jul 2026 17:20:29 GMT

European Union regulators fined Google €890 million on Thursday, saying the company broke the bloc’s digital competition law by steering users toward its own services in search results and restricting what app developers are allowed to tell their customers.

The penalty, worth about $1 billion, closes two investigations the European Commission opened in March 2024 and makes Google the third company sanctioned under the Digital Markets Act. Alphabet, Google’s parent company, takes in roughly that much revenue in a day.

What regulators found

The European Commission split the fine in two. It attributed €460 million to self-preferencing in search, finding that Google gave its own shopping, hotel, transport and sports results better placement than it gave competitors.

The remaining €430 million covers the Play Store, where regulators said Google barred developers from telling users about cheaper offers available elsewhere and charged steering fees beyond what the law permits.

Teresa Ribera, the Commission’s executive vice president for competition, said the best products should succeed on merit rather than on who owns the search engine. Google has 60 days to comply or face daily penalties of up to 5% of Alphabet’s worldwide turnover.

Kent Walker, Google’s president of global affairs, called the decision “product degradation driven by a small group of self-serving complainants.” The company said it is weighing an appeal. Politico reported that the Commission reached its decision internally in March and announced it a day before temporary US tariffs on trading partners are due to expire.

A day of revenue

Alphabet reported $403 billion in revenue in 2025, roughly $1.1 billion a day, meaning Thursday’s penalty is worth less than 24 hours of business.

Proton tracks what Big Tech pays in fines each year. In 2025, regulators worldwide levied about $7.8 billion against Alphabet, Apple, Meta and Amazon, the largest annual total we have recorded.

Measured against free cash flow, those four companies could have cleared the entire year of penalties in 28 days. Alphabet drew about $4.24 billion of it, more than any of them, and could have covered its share in about three weeks.

The pattern holds going back further. EU regulators have fined Google more than €10 billion since 2017, and Europe’s highest court upheld the largest of those, a €4.1 billion Android penalty, on July 2.

None of it changed how the company operates, however, because none of it cost more than operating that way earns.

What the fine does not reach

Self-preferencing is a competition finding, but what it protects is an advertising business. Results that keep users on Google surfaces keep them measurable. Privacy-first services rarely lose on quality. They lose on placement.

For the first time in a long while, governments are taking their duty to citizens seriously and fighting the monopolies that corrupted the internet’s early promise. But make no mistake: the fines are still too small to make Big Tech sit up. Unwinding Big Tech’s structural advantages, rather than the checks it writes, is what holds real promise for restoring freedom and fairness online. A fairer internet would let services that protect personal data instead of exploiting it succeed on merit.

Building that better internet will take years. Until then, the burden falls on you, and the choice carries much further than it may seem: Keeping your data out of Big Tech’s hands protects your information and cuts into the ad revenue that pays for the conduct regulators keep fining.

The simplest defense is end-to-end encryption. Proton is funded by the people who use it rather than by advertisers, so it has no reason to collect your data. Sign up free and take control of your email, calendar, photos and files, browsing, and passwords and online identity.

Why your business needs document version control

Alanna Alexander — Thu, 23 Jul 2026 14:18:17 GMT

An email from a client pops up on your laptop: “This contract is rife with errors.”

You pull up the file and realize — you sent them a version from 36 hours ago, before legal had reviewed it, before that key clause was approved. Nobody can tell you with certainty which version left your hands, or why.

That’s a version control failure. And in a moment of exposure — an audit, a near-miss, a client complaint, an internal dispute — it can mean more than a lost deal. It can mean a compliance violation you can’t defend, a dispute you can’t prove, or a client relationship that doesn’t recover.

Document version control helps you answer who changed what, when, and which version left your hands. If you’re responsible for how documents move through your organization — contracts, compliance records, internal policies — this is what you need to understand about it.

What is document version control?

Document version control is also known as revision control or file version control. It’s the system that tracks every change to an ongoing file or project. It doesn’t overwrite what was there before. It preserves every change as a new entry in the document’s history, so you can see every decision that different collaborators made and return to a previous version if you need to.

Version control can be done manually — saving and renaming files as “v1,” “v2,” “FINAL” — but that depends on everyone following the same convention consistently, which is how records get gaps.

The more reliable approach is using business cloud storage software that does it automatically, logging every change in the background without anyone having to remember. You won’t have to manually save and name files with version numbers, it does it automatically, giving you a complete record of changes without anyone having to maintain it.

You’ll find more tips on finding the right software further down this blog.

Find out more about the best practices of document management.

Why does version control matter for compliance?

In regulated industries like healthcare, law, or finance, process failures like document problems have a serious consequence: They leave gaps in your record that you may one day have to explain.

What changed?

When something goes wrong with a document — a clause that shouldn’t have been there, a figure that doesn’t match what was agreed, terms that contradict an earlier version — the first question anyone asks is: what changed, and when?

In a regulated environment, that question isn’t just internal. A financial regulator may want to know exactly what was amended in a client agreement and when. A court may want to see whether a clause was present in the original draft or added later. A compliance officer may need to demonstrate that a policy document wasn’t altered after it was approved.

Without a complete version history, none of those questions have a reliable answer.

Who had access?

Knowing what changed is only part of the record. Regulators and auditors will also want to know who had access to a document, and at what stage.

A contractor whose access wasn’t revoked after a project ended. A team member who opened a file outside their authorization. An external party who saw a draft before it was finalized. None of these events alter the document — but all of them are exposure events, and in a compliance context, exposure events need to be logged.

A SaaS company handling customer PII data will face this question directly every time an enterprise client asks: “who has seen our data, and can you prove it?” SOC 2 auditors will ask the same thing. If you can’t produce that access history, you don’t pass.

Which version is final?

In a contract dispute, a regulatory submission, or an internal investigation, there can only be one answer to this question.

If multiple versions of a document exist across shared drives, email threads, and downloaded copies, nobody can say with certainty which one is authoritative. Ambiguity is a liability.

A proper version control system designates a single, timestamped record as final — and keeps the full history of everything that came before it, so the answer to this question is never in doubt.

7 ways to maintain version control for your business

Always work in shared files — if anyone is working on a local copy, the compliance record has a gap
Be logged in when you edit — anonymous edits aren’t attributable, and attribution is what auditors require
Never edit outside the system — changes made in a downloaded copy or an email attachment are invisible to the version history. If it didn’t happen in the shared document, it didn’t happen on the record
Only share access with people who need it — every unnecessary collaborator is an unlogged exposure risk
Revoke access when it is no longer necessary — access that outlives its purpose is a liability, not just an oversight
Designate and protect the final version — once a document is approved, it should be clearly identifiable as final and protected from further edits. A version history full of post-approval changes is not a clean compliance record
Never delete a document to start over — deleting a file destroys its compliance record permanently

What to look for in a document tool

For business uses, here is what matters:

Automatic versioning: Version history should not need manual work. If team members need to keep track of versions, they will most likely get confused and create friction. They will need a real-time collaborative document that actually saves the edits automatically.
Long retention: A 30-day edit log will not be enough for audits or disputes. Business document version control should keep the records for months — or even years — and make sure you keep all compliance checks in place.
Safe restore options: Restoring a previous version should not overwrite or delete what came after it. Look for tools that let you make a copy of a past version or roll back fully while keeping the complete history intact. This is crucial to safeguarding client data and keeping teams aligned.
Attribution and controls: Timestamps are not enough. You need to tie each change to a person. That is what makes file revision control useful for accountability. Also, permissions or link-expiration features should not be managed through separate tools. Version control and secure file sharing for teams should be part of the same workflow.
End-to-end encryption: Version history can contain sensitive information. If the service provider can access all draft versions, then your information is also accessible to them. Look for tools that provide full end-to-end encryption for increased security.

Protect your documents from the get-go

At Proton, we built Proton Docs and Proton Sheets, online software for collaborative documents and secure spreadsheets, to give remote teams full control over their documents, with automatic versioning and end-to-end encryption across every file and every revision. So your document history stays secure by default.

Version control is only as reliable as the tools behind it. Proton Drive automatically saves your version history, with no need for manual checkpoints. It retains document history for up to 10 years — long enough to meet most data retention requirements — and allows you to safely roll back to any version you need.

Start with a free Proton account or explore our business cloud storage, Drive for Business.

What to look for in a secure cloud workspace (before you commit)

Alanna Alexander — Thu, 23 Jul 2026 13:23:37 GMT

Choosing a cloud workspace is probably the most consequential infrastructure decision you can make.

Many teams default to Google Workspace or Microsoft 365 because they seem like the obvious choice: familiar, feature-rich, deeply integrated cloud collaboration platforms that are easy to adopt and already embedded in many modern workflows.

But that’s precisely why they’re worth scrutinizing before you commit. Here are four key things you need to consider when evaluating a cloud workspace, plus a checklist of questions to help guide you.

1. Integrations can free you up now — but lock you in later

Integrations are a major selling point for most cloud workspaces. Many companies (especially fast-moving start-ups) want a platform with lots of integrations that slots seamlessly into existing workflows with minimal disruption.

However, over the long term using integrations can mean embedding your workflows inside a single ecosystem. And once you’ve tied yourself into a cloud workspace ecosystem, switching providers becomes a data admin’s worst six months at the office — we’re talking siloed data, identity and access disruption, denied permissions, inaccessible files, and a dip in productivity your CEO will definitely notice.

This certainly applies to go-to platforms like Google Workspace and Microsoft 365, which are strategically designed to hook businesses on a wider ecosystem of co-dependent tools — Meet, Teams, Drive, and SharePoint — that become progressively harder to detach from.

The question you need to ask before picking a cloud workspace isn’t “how easy is this to adopt?” It’s “how hard will this be to get out of?”

2. ‘Security’ means different things to different providers

Most enterprise workspace providers market their platforms as boasting ‘enterprise-grade security’, with certifications, perimeter protections, and encryption of data in transit and at rest.

What many providers are less keen to advertise is that they retain server-side access to your data. This enables their most useful features: indexing, analytics, cloud-side processing and AI assistance provided by tools like Google’s Gemini and Microsoft Copilot, both of which rely on visibility into your business emails, documents, calendars, and collaboration data to function.

For many businesses shopping for a cloud workspace, that’s an entirely acceptable tradeoff: Strict cloud data security sacrificed for the sake of convenience and functionality. But if your business handles sensitive information, such as confidential client data, business continuity documents, or financial records, you might want to think twice about it.

If you’re an SMB, you might want to think more than twice. According to Proton’s SMB Cybersecurity Report 2026, nearly one in four SMBs fell victim to a data breach in 2025. Hackers view SMBs as vulnerable targets. The wrong cloud workspace could expose you even more.

The right cloud workspace will offer end-to-end encryption and zero-knowledge cloud storage. This means your provider can’t access your data, even if compelled.

3. Data sovereignty is important (but not all providers respect it)

Where data is collected, processed, and stored determines which laws and jurisdictions apply to it, and therefore its potential exposure.

Many cloud providers operate across jurisdictions, including countries where governments may compel access under local legal frameworks, either now or in the future. Your provider’s terms of service may not protect you from that.

To stop jurisdictional authorities from exposing your data, privacy-first providers like Proton promote data sovereignty: the concept that the laws that govern data should be the laws of where it was generated and collected — no matter where it’s stored.

For companies operating in regulated industries and handling sensitive customer information and/or managing intellectual property, data sovereignty should be a significant strategic consideration.

Overlooking data sovereignty can be costly. In 2023, Meta was fined €1.2 billion (the largest GDPR fine ever issued) not for a hack or a breach, but for storing European user data in the US. The data was secure. The jurisdiction wasn’t.

If you’re concerned about your data security and sovereignty, seek out providers that host data in privacy-first jurisdictions, such as Iceland or Switzerland.

4. Remember: your governance burden grows with your business

A common cybersecurity mistake made by scaling SMBs when choosing a cloud workspace is underestimating how quickly data governance and access control becomes complicated by growth.

A workspace that enables you to manage permissions for a workforce of 10 might not be suited to doing the same for a workforce of 60, particularly when that expanded workforce includes contractors, external collaborators, and people spanning multiple departments with different access requirements.

As you scale, your data governance will evolve from a simple setup task to a full-time job, involving a host of challenges, including permission sprawl, higher risk offboarding, unreliable manual tracking, and decreasing visibility into who has access to what.

Some cloud ecosystems compound this challenge by distributing permissions and workflows across multiple integrated systems, which makes centralized oversight difficult.

Others, however, provide a single admin layer where admins can monitor, manage, and adjust access as the organization grows and evolves.

Pick the right type now, and you’ll avoid the headaches of the future that come with retrofitting access controls into a workspace you’ve already scaled into.

9 questions to ask yourself before you commit to a cloud workspace

Before committing to a provider, ask:

Who controls the encryption keys?
Can your provider’s employees access your data?
What metadata remains visible to the provider?
Is your data processed by the platform’s AI systems?
Where is data stored and processed, and which jurisdictions apply?
Can admins enforce multi-factor authentication and permissions centrally?
How difficult would it be to migrate to a different workspace down the line?
Can data be exported cleanly and completely?
Will your governance tooling scale with your headcount?

A cloud workspace for the next five years, not the next 12 months

The right cloud workspace isn’t the easiest to adopt today. It’s the one you’ll still be using, and trusting, in five years. A platform that gives you long term security, control, and flexibility, and without locking you into an ecosystem forever.

Sounds like Proton Workspace to us. A secure cloud workspace, built on end-to-end encryption, zero-knowledge business cloud storage, and Swiss privacy law — with centralized admin controls designed to scale with your organization.

Start free trial of Proton Workspace

How to set up secure document collaboration for your team — without leaking your IP

Alanna Alexander — Thu, 23 Jul 2026 12:14:51 GMT

Right now, there’s a file in your shared drive named something like v3_final_FINAL_FINAL.docx. You don’t know who edited it last. You don’t know if it’s the version your CTO signed off on. You’re not entirely sure who has access to it.

This is ‘version chaos’: an all too common problem for teams scaling remotely. Feels bad, doesn’t it? Possibly not bad enough. Because it isn’t just a messy irritant: it’s a serious security liability.

Uncontrolled access means ex-employees and contractors retain permissions that were never revoked. Untracked versions mean sensitive information ends up in the wrong places at the wrong times. And the document collaboration tools you’re using are quietly and constantly processing the contents of your documents to power their AI features and search indexing.

But it doesn’t have to be this way. Here’s a step-by-step guide to using document collaboration tools without opening yourself up to an IP leak.

How most teams get document collaboration wrong

Online document collaboration is an essential part of doing business. It’s fast, efficient, and it doesn’t matter where your workforce is (as long as they’ve got WiFi).

The problem is, many early-stage teams tend to reach for whatever’s fastest to implement — Google Docs, Notion, Dropbox — and immediately start using them without stopping to build a system around them. No folder architecture, access conventions, or version control protocol.

For a startup team moving fast, this can feel fine. But it really isn’t fine, especially for a team whose documents contain IP worth protecting. In fact, cybersecurity for startups should start a lot earlier than you think.

The resulting issues tend to cluster around three things:

Version chaos: With no system in place, documents multiply and there’s no single source of truth to hang onto. People work from outdated files. Changes get lost in the mix. There are five slightly different versions of the same roadmap on your drive without any way to confirm which one’s current.
Access sprawl: Managing permissions is time-consuming, so files get broadly shared instead of specifically managed. Contractors, ex-employees, and external collaborators accumulate access. You soon lose track of who can see what.
Unnoticed data exposure: Consumer-grade collaboration tools commonly scan documents to power their search indexing, AI suggestions, and personalized advertising. Nothing just sits securely in your cloud folder — it’s being read by a robot.

What good document collaboration looks like

Before you’ve even looked at document collaboration tools, be clear about what you’re trying to achieve first.

A good document collaboration setup gives you five things:

Real-time co-editing: Instead of having to play email tennis with documents, multiple people can edit the same document at the same time, with changes visible as they happen
Version history: A reliable, timestamped record of who changed what and when that prevents you having to rely on your sticky notes or less sticky memory
Granular access controls: You can set permissions at folder, document, and user level (the opposite of an “anyone with the link” policy)
Secure external sharing: You can share documents outside your organization without opening the floodgates to everything else in your drive
True data privacy: You’re confident that your document-based data isn’t being scanned, mined, or processed by a third party (and that includes your business cloud storage provider)

With most popular collaboration tools (those tools teams reach for without a second thought) you might get two of these. The right platform can give you all five.

But whatever you use, you’ll still need a system to make them work.

How to set up document collaboration for your team: a step-by-step framework

Step 1: Audit what you have

You can’t build a clean, secure system for document collaboration on top of a messy, insecure one. So start with an honest audit of what you’ve already got.

List every tool where your documents currently live (Google Drive, Notion, Dropbox, email attachments, Slack). Then find out who has access to these tools, who controls access to them, and what happens to a document once it’s left your system.

Scour your drives for ‘problem files’ that will need special attention: documents that exist in multiple versions with no clear owner, folders shared with people who no longer need access, and commercially sensitive files (e.g. roadmaps, financial models, technical specs) sitting in tools with weak or non-existent access controls.

Step 2: Design a folder architecture that makes sense (and isn’t too complex)

Whatever you do next, don’t migrate first and organize later. That’s just compounding chaos: moving the same mess to a new and less familiar location.

Instead, take a breath… then design your folder structure. To guide you, here’s a simple, scalable folder architecture that will suit most start-ups:

Company: board meeting minutes, shareholder agreements, fundraising materials, legal contracts
Product: roadmaps, feature specs, design files, research
Engineering: technical documentation, architecture decisions, internal tooling guides, technical specs
Operations: HR policies, finance, supplier contracts
Clients: one subfolder per client, containing everything related to that relationship.

Remember: keep things simple and shallow. Complex file structures tend to get ignored — people dump files at the top level and chaos ensues. As a general rule: three levels of nesting, and no more. If you find yourself creating a fourth, the structure needs simplifying.

Step 3: Match your access levels to data sensitivity

Not everybody needs access to everything. Business data protection starts with setting three tiers of access before you invite your team in.

Company-wide: non-sensitive operational documents such as team handbooks, general meeting notes, process guides
Team-level access: departmental work that’s accessible to the relevant team only
Restricted access: anything commercially sensitive, legally protected, or covered by client confidentiality. This is the most important tier to secure: if (say) fundraising documents, roadmaps, technical specs, customer data, or client contracts are seen or shared by the wrong person, it spells competitive or legal liability

Our Workspace app handles all of this from a single admin dashboard. You can control members, permissions, and app access in one place, however big the team gets.

Step 4: Establish the four golden rules of version control

Now your folder architecture is in place, you need to establish four simple conventions to ensure that you never see a file in one of those folders named v3_final_FINAL_FINAL2_FINAL3.docx again. And won’t that be nicer for everyone?

These four rules apply to everyone on your team (make sure they know it):

All live documents exist in one place: No local copies, no email attachments
No version numbers in file names: Your tool should provide a proper version history and track every change. Share documents via link rather than attachment to avoid confusion. If you need to share a static export, put the date in the covering note, not the file name.
Version history is the single source of truth: If you want to know who changed what, when, just look in the version history.
Don’t delete — archive: Move superseded documents to a clearly labeled archive folder. You don’t want to delete a document that you (or a regulator) needs later.

Step 5: Define your protocol around external sharing

External sharing is where access control most commonly breaks down. A contractor gets linked to an entire project folder rather than just what’s relevant (with no expiration date on that access). A potential investor retains access to your fundraising data room long after deciding not to invest. It’s a dangerous world outside your perimeter.

To minimize that danger, set a protocol before you share anything externally. Three rules:

Grant minimum access for specific documents or folders only (not entire workspaces or drives)
Set expiration dates on all links
Revoke access at project end as a standard offboarding step

The right productivity and collaboration tools automatically enforce rules like this for you. Proton Drive sets expiration dates on shared links by default — so access expires without anyone having to remember to revoke it.

Step 6: Choose a platform that can enforce your security requirements

Most teams evaluate collaboration platforms on usability alone. Usability matters, of course. But security cannot be an afterthought.

Intellectual property is now the most expensive data type to lose in a data breach (at $178 per compromised record, according to IBM). If your documents contain IP worth protecting, your collaboration platform needs to be secure by default, not configuration.

When selecting a collaboration tool, you need to know:

Can the provider access your document content?
Where is your data stored and which jurisdictions apply? Is your data sovereign?
Is encryption end-to-end or only in transit?
Are admin controls centralized and granular enough to enforce access policy?

Here’s how four online document collaboration tools compare:

	Google Docs	Notion	Microsoft 365	Proton Docs
Real-time co-editing	✓	✓	✓	✓
Version history	✓	Limited	✓	✓
End-to-end encryption	✗	✗	✗	✓
Zero-knowledge storage	✗	✗	✗	✓
Centralized admin controls	Partial	Limited	✓	✓
No data processing for AI/ads	✗	✗	✗	✓
Privacy-first jurisdiction*	✗	✗	✗	✓

*Google Docs, Notion, and Confluence are headquartered in the US and subject to US jurisdiction, including the CLOUD Act. Proton is headquartered in Switzerland, outside US and EU jurisdiction.

For teams handling sensitive IP, Proton Docs lets your team perform real-time collaborative editing without risking data exposure.

It’s part of Proton Workspace, a secure collaboration suite which adds encrypted business cloud storage, secure video conferencing, and centralized admin controls to document collaboration. All built on end-to-end encryption and protected by Switzerland’s stringent privacy laws.

Meet your efficient and secure collaboration stack

To have true control over your documents — and peace of mind about their security — you need to have the right system in place and the right platform.

We’ve shown you how to build the right system. The platform to enforce it is Proton Workspace.

Over 100,000 organizations (including government agencies, healthcare providers, and law firms) trust Proton to secure their most sensitive data. Your documents deserve the same standard of protection.

Start free trial of Proton Workspace

The best office suites in 2026 (free and paid)

Alanna Alexander — Thu, 23 Jul 2026 11:42:48 GMT

For the better part of 20 years, there have been a big two dominating the office suite space, and only one choice for many businesses: the desktop power of Microsoft 365, or the online collaboration ease of Google Workspace.

Now prices are rising, and not everyone (least of all SMBs) can afford them. Microsoft is hiking its prices again in July 2026. There are also questions, increasingly hard to ignore, over what these providers are doing with your data, and what that means from a privacy and security perspective.

Historically, the alternative for those not using one of the big two has been a self-assembled stack sourced from multiple providers. This approach, however, can leave you with something more expensive, fragmented, and vulnerable than a single integrated platform.

The market has changed, and in 2026 your choices are less restricted.

Here’s a comparison of the main office suites in 2026: what each costs, what each includes, and what each does with your data.

How the main office suites compare

Four suites cover most of the office suite market in 2026: the two established leaders, a budget option, and a suite built on a fundamentally different architecture to any other.

That suite is Proton Workspace. Built on open source, independently audited zero-knowledge architecture which encrypts your data before it reaches Proton’s servers, Proton Workspace makes it impossible for Proton to access your data.

Whether you need a full online office suite or a desktop replacement, here’s how the four best options stack up.

N.B. Prices shown are for Business Standard tiers (annual billing) unless otherwise noted. Prices are accurate as of time of writing.

	Microsoft 365	Google Workspace	Zoho Workplace	Proton Workspace
Core apps	Word, Excel, PowerPoint, Teams, Outlook, OneDrive	Docs, Sheets, Slides, Meet, Gmail, Drive	Writer, Sheet, Show, Cliq, Mail, WorkDrive	Docs, Sheets, Meet, Mail, Drive, Calendar
Desktop apps	Business Standard+	Web only	Web only	Web only
AI assistant	Copilot (basic included; full Copilot adds $30/user/month)	Gemini (included)	Limited	Lumo (Premium only)
Data is protected from being used by AI for functionality and training	No	No	Yes (limited AI features)	Yes
Encryption	Server-side, Microsoft holds encryption keys	Server-side, Google holds encryption keys	Server-side, Zoho holds encryption keys	Zero-knowledge architecture, Proton holds no keys
VPN included	No	No	No	Yes
Password manager included	No	No	No	Yes
ISO 27001 and SOC 2 Type II certified	Yes	Yes	Yes	Yes
Jurisdiction	US (CLOUD Act applies)	US (CLOUD Act applies)	India/US (CLOUD Act applies)	Switzerland (not subject to CLOUD Act)
Base price/user/month	$14 (from July 2026)	$14 (Standard)	$6 (Professional)	~$14.25 (€12.99)
True cost/user/month	$44 with full Copilot add-on	$14+ with security add-ons	$6	~$14.25 all-inclusive
Best for	Microsoft ecosystem, desktop apps	Collaboration, UX	Budget-conscious SMBs	Privacy-first SMBs

The real cost of each office suite

This comparison table includes a ‘real cost’ row because headline prices can be misleading.

Microsoft 365 Business Standard and Google Workspace Standard both list at $14/user/month. Proton Workspace Standard costs €12.99/user/month. The differences only appear when you look at what each platform charges extra for.

Microsoft is promoting Copilot as a reason to stay on its platform. But for the full Copilot experience, you’ll need to pay an additional $30/user/month on top of the Business Standard subscription. For a 25 person team that’s $9,000 more per year.

Google won’t charge you extra for its AI. Google Workspace Business Standard includes Gemini. But if you want additional security features beyond the baseline, you’ll need Google Workspace Business Plus ($22/user), or to purchase add-ons separately.

Zoho Workplace Professional really is only $6/user/month. The trade-off is a less polished ecosystem and no zero-knowledge architecture.

Proton’s pricing is similarly transparent, but Proton Workspace Standard includes a lot more than Zoho Workplace. You get all the main office apps for €12.99/user/month, plus apps Microsoft and Google don’t include: business VPN and a password manager — all protected by zero-knowledge encryption and Swiss jurisdiction.

The privacy question most office suite comparisons skip

Who holds the encryption keys?

In other words, does your office suite provider have technical access to your documents, emails, and files?

Google, Microsoft, and Zoho all hold the keys.

Here’s why this matters: if your provider has the keys, they can access your data, whatever their stated privacy policy says — policies change. And if your provider gets breached, your data is exposed, too.

Google and Microsoft’s AI compounds the problem: Copilot and Gemini both depend on having access to your document contents to function. (In fact, Google raised its prices in 2025 to incorporate Gemini in Business and Enterprise packages.)

Data sovereignty is a third concern. Microsoft, Google and Zoho store data in jurisdictions subject to the US CLOUD Act. That means the US government can demand access to your data at any time.

Proton doesn’t hold the keys, and can never access your data, even if compelled by a court order. With Proton Workspace, you get the structural guarantee of zero-knowledge architecture, not a changeable privacy policy. Your data is encrypted on your device before it reaches Proton’s servers, and it’s stored in Switzerland, outside US CLOUD Act jurisdiction.

Proton Workspace Premium users get Lumo AI, a business AI assistant that doesn’t require access to your document contents and never trains on your data. (Zoho Workplace offers only limited AI features.)

Find out more about European businesses’ dependence on US tech and why the stakes are now higher than ever.

Proton Workspace: the only office suite with privacy by design

With Proton Workspace, teams get to use all the major office apps you’ll find in Microsoft 365 and Google Workspace: business email, calendar, enterprise cloud storage, documents, spreadsheets, video conferencing and (for Premium users) an AI assistant.

Proton’s office suite also includes two security features that the big two don’t: a business VPN that keeps your team’s connections private wherever they’re working, and a team password manage r that closes one of the most vulnerable vectors.

Finally, unlike the big two, zero-knowledge encryption applies across every Proton product by default.

For now, Proton Workspace doesn’t have a presentation app equivalent or deep legacy ERP integrations (worth knowing upfront if your business depends on complex third-party connections).

But for businesses that value data sovereignty, Proton is the straightforward choice. That’s why Proton is trusted by 100M+ users and 100,000+ businesses, including UN agencies and Fortune 500 companies.

Which office suite is right for you?

The office suite market has changed. You can now have both privacy and productivity in a single, full-stack platform that covers everything a growing SMB needs — without asking you to accept vendor access and uncertain jurisdiction as part of the deal.

Proton Workspace is the only suite in this comparison built on zero-knowledge architecture, which ensures only you can access your data. It’s about the same price as market leaders, with more essential security capabilities bundled in.

And it’s easy to get started. Migration from Microsoft 365 and Google Workspace can be self-service, or fully supported by Proton if it’s more complex, and the UX is familiar enough for your team to get started without training.

Start free trial of Proton Workspace

Gmail attachment size limit: How to send large files via email

Tom Odlin — Thu, 23 Jul 2026 11:24:25 GMT

Few things are more annoying than getting ready to send an important file only to realize Gmail won’t let it go through. Now you’re stuck troubleshooting when you should be moving on with your day.

Gmail’s size limit isn’t a dead end, though. In this guide, we’ll explain Gmail’s attachment limit, what happens when you go over it, and how to send large files more smoothly.

What is the Gmail attachment size limit?

For most people, the Gmail file size limit caps attachments at 25 MB per email. This limit applies to everything you attach, not just a single file.

If you’re on a Google Workspace account, your limit depends on your plan and what your admin has configured. Most Workspace users have the same 25 MB cap, but Enterprise Plus accounts can send attachments up to 50 MB.

What happens when you exceed the limit?

If your attachment is too big, Gmail automatically uploads the file to Google Drive and inserts the shareable link into your email. This is fine for everyday files, but if you’re sharing something sensitive like contracts or personal documents, you may want more control over where your files end up.

Most of the time, this process works without you having to do anything. However, if you’re on an older version of the Gmail app, using a mobile browser, or your Google storage is full, the upload can fail. Gmail also blocks certain file types entirely, such as .exe files, so they won’t make it through regardless of size. Luckily, there are a few other approaches to rely on.

How to send large files via email

Here are some reliable options for sending large files over email.

Compress your files

If you’re sending a batch of documents for review or a folder of images from an event, zipping them into one file keeps things organized and can reduce overall size. ZIP is the most widely supported compressed file format and works across Windows, Mac, and most mobile devices.

To create a ZIP file, select the files or folders, then:

Windows: Right-click → Compress to… → ZIP file

Mac: Control-click → Compress

It’s a simple process that doesn’t require third-party tools, but it has its limits. A 200 MB video isn’t going to shrink to 25 MB, and already-compressed formats like JPEG or MP4 will barely shrink. And if you’re sharing design files or photos, some compression tools or formats can reduce quality.

Strengths:

Works offline and without third-party tools
Multiple files and folders can be packed into a single .zip file
.zip files can be password-protected using third-party tools

Keep in mind:

You could waste time compressing large files, only to still hit the Gmail attachment limit
Compression can potentially degrade quality, which matters in some industries
Unzipping files isn’t easy on mobile
The privacy of your .zip files is limited by the security model of your email provider

Use a file transfer service

File transfer services are fast and commitment-free; you don’t need to create an account, and your files are auto-deleted after a set window. Free tiers can be generous as well, such as SwissTransfer’s 50 GB.

That said, convenience comes with tradeoffs. Free tiers often lack secure sharing features, and you typically can’t revoke access or see who downloaded your file, which are especially important in business settings.

Security also varies by provider. Many services encrypt files, but because they hold the encryption keys, they can technically access your data. Without end-to-end encryption, files may also be exposed in a server breach or corporate hack. WeTransfer, for example, operates this way and isn’t HIPAA-compliant as a result, making it a poor choice for businesses in healthcare.

For casual, non-sensitive sharing, file transfer services are fine. But if you work in a regulated industry or need to keep files private, limited access controls and oversight can create compliance and security risks. A breach of the provider’s systems could expose your sensitive data, potentially leading to fines, legal liability, or reputational damage.

Even for personal files, privacy varies widely between services. Some providers can access the files you upload and may use that data for purposes such as ad targeting or AI training.

Strengths:

No account required for most services
Quick and simple for occasional transfers
Generous size limits, even on free tiers

Keep in mind:

Limited control and oversight after sending, so you can’t track or revoke access
Provider-controlled encryption means your files may still be exposed in a server breach or unauthorized access incident
Features like password protection are often paywalled, leaving free users with fewer safeguards

Use cloud storage

Cloud storage makes sending large files easy — upload your file, generate a link, and paste it into your email.

This method makes the most sense for ongoing access, such as when sharing an assets folder with a client, or a photo album with family. There are no file size restrictions beyond your storage quota, and recipients can preview files without downloading anything.

Google Drive is the default for Gmail users since it’s already integrated, but its 15 GB of space is shared across Gmail, Drive, and Photos, so it fills up faster than you’d expect. However, there are plenty of cloud storage options available — including business cloud storage providers. Depending on your storage needs and privacy requirements, you can easily find a Google Drive alternative that better suits you.

Cloud storage providers handle privacy and security differently. Some major platforms can access the files you upload, while others use zero-knowledge encryption so only you and the people you share files with can access them. Sharing controls and security features, such as password protection, also vary between providers.

For businesses handling regulated data, choosing a provider that doesn’t meet compliance requirements under frameworks such as HIPAA or GDPR can create legal and reputational risks.

Strengths:

End-to-end encryption and advanced sharing controls from some providers
No file size restrictions within your storage quota on some services
Easy to update files and folders — edit the original, and the link stays current

Keep in mind:

Privacy and security vary greatly between providers
Free tiers tend to come with low storage, requiring constant management
Misconfigured sharing permissions can accidentally expose sensitive files to unintended recipients
Using a provider that isn’t compliant with industry regulations, such as HIPAA or GDPR, can expose businesses to legal and reputational risks

Securely send large files via email with Proton Drive

When Gmail blocks your attachment, Proton Drive lets you upload the file, create a secure sharing link, and send it by email without compromise — no size or format restrictions, no compression, and no hoping the recipient can figure out how to unzip a folder on their phone.

If privacy and control matter to you, whether you’re sharing personal photos or sending sensitive business files, most solutions fall short.

Proton Drive is built differently — all your files are protected with end-to-end encryption, meaning only you and the people you share with can access them, not even Proton has access.

You can password-protect links, set expiry dates, track downloads, and revoke access at any time. And because Proton is based in Switzerland, your data is protected by some of the world’s strictest privacy laws.

For businesses, Proton Drive can help support compliance with regulations like HIPAA and GDPR. For everyone else, it’s simply a more private way to share files online. You can get started with 5 GB of storage for free and send large files via email without worrying about limits.

How to open an Excel file online for free

Tom Odlin — Thu, 23 Jul 2026 11:00:57 GMT

Businesses rely on file sharing to exchange budgets, reports, forecasts, and other sensitive information, much of it stored in Excel spreadsheets.

When you need to open one without paying for Excel or installing Microsoft software, several free online options are available. However, as with so many free products, understanding the trade-off — convenience versus data security — is crucial.

We’ll cover common methods to open an Excel file online, their risks, and the best privacy-focused alternative to Excel.

3 ways to open an Excel file online

Option 1: Microsoft 365 (free tier)

Signing up for the free Microsoft 365 tier to open your Excel file seems like an obvious choice, but it comes with limitations.

Limited functionality: The free tier lacks advanced features, doesn’t offer offline editing, and may struggle with complex formulas or macros found in professional spreadsheets.

Data privacy concerns: Microsoft Excel files aren’t end-to-end encrypted. Microsoft controls the default encryption keys, which means it retains the technical ability to access your data and may disclose it when legally required.

Verdict: Suitable for quick, non-sensitive views, but risky for proprietary business data.

Option 2: Free online XLSX viewers

There are plenty of third-party tools available online, most of which will let you view Excel files instantly. However, relying on these “free” viewers for business data introduces serious compliance risks.

Lack of encryption: Most of these tools don’t offer end-to-end encryption, leaving your files vulnerable to interception, data breaches, and unauthorized third-party access.
Data mining: Many free services monetize their platforms by scanning content and potentially analyzing your data to train AI models or serve targeted ads.
Regulatory exposure: If your organization is subject to regulations like GDPR or HIPAA, uploading sensitive client records to an unverified, non-compliant server could create serious compliance risks.

Verdict: A convenient shortcut for public files, but a compliance nightmare for any confidential business information.

Option 3: Proton Sheets

For businesses that need to open Excel files online without compromising security, Proton Sheets offers a privacy-first approach.

Native compatibility: Proton Sheets supports native .xlsx files, ensuring your existing Excel spreadsheets open with their original formatting, formulas, and structure intact—no conversion required.

Zero-access encryption: Unlike standard cloud tools, Proton encrypts your data on your device before it leaves your computer. Even if a hacker breaches the server, the data is encrypted; not even Proton can access your data.
Secure collaboration: Teams can edit spreadsheets in real-time with the assurance that no one is scanning or mining their data.

Verdict: The only option that balances the convenience of opening Excel files online with the rigorous security required for businesses.

The best secure Excel alternative for business

When selecting business tools, the decision often comes down to a choice between convenience and privacy. While the tech giants offer robust collaboration tools, they do so at the cost of your data privacy.

Proton Sheets delivers collaborative tools without the surveillance, making it the best Excel alternative. Your team can co-author documents in real time, knowing that no one — not even Proton — is watching, listening, or learning from your data.

Compliance and data sovereignty

Proton is based in Switzerland and protects spreadsheet data with end-to-end encryption under Swiss privacy law. These safeguards help your organization maintain control over its data and support compliance with GDPR and other international data protection requirements.

How to get started with Proton Sheets

Transitioning to Proton Sheets is simple.

Create an account: Sign up for a free Proton account
Upload your file: Upload your existing .xlsx files to Proton Sheets
Open and edit: Click on the file to open it directly in Proton Sheets
Share securely: Share the file via a secure link or by inviting them via email

Don’t expose your business to unnecessary risks. Try Proton for Business and experience an end-to-end encrypted, collaborative business suite.

How to forward emails in Gmail, Outlook, Yahoo, and Proton Mail

Elena Constantinescu — Thu, 23 Jul 2026 10:57:16 GMT

Whether you’re switching to a new provider, consolidating multiple inboxes, or just want messages sent to an old address to land somewhere you actually check, email forwarding lets you redirect incoming mail without missing anything.This feature, which allows you to continually and seamlessly send email from one inbox to another, makes it easier to communicate with colleagues and clients from one central email address.

Below are the exact steps for Gmail, Outlook, Yahoo Mail, and Proton Mail along with what forwarding does and doesn’t do, and what’s worth considering before you decide where to forward your email to.

How to forward emails in Gmail
How to auto-forward emails in Outlook
How to forward emails to another email using Yahoo Mail
How to forward emails in Proton Mail
What does forwarding an email do?
A more private place for your emails

How to forward emails in Gmail

Open Gmail on a computer and sign in.
Click Settings ⚙ → See all settings.

Go to Forwarding and POP/IMAP and click Add a forwarding address.

Enter the recipient’s email address and click Next. (If you’re looking specifically for how to forward Gmail to another Gmail account, the same steps apply — just enter your second Gmail address here.)

A new browser tab opens, and you may be asked by Gmail to verify your identity. After doing so, click Proceed.

Return to Gmail settings → Forwarding and POP/IMAP.
Select Forward a copy of incoming mail to and choose the recipient email address from the menu. You can also choose from keeping Gmail’s copy in the Inbox, mark it as read, archive it, or delete it.

Click Save changes at the bottom.

This forwards future incoming Gmail messages, not all existing emails already in your inbox. If you later change your mind, return to Gmail’s Forwarding and POP/IMAP settings, select Disable forwarding, and click Save Changes.

Alternatively, you can set up Gmail forwarding for certain messages only by creating a filter. Go to Settings → See all settings → Filters and Blocked Addresses → Create a new filter, choose your criteria, and select Forward it to. Before creating the filter, you must add and verify the forwarding address.

When moving from Gmail to Proton Mail, you can use Easy Switch to migrate your messages, contacts, and calendars. You can also continue receiving and sending emails from your Gmail address directly within Proton Mail, making it easier to transition gradually to a private Gmail alternative until you are ready to make the full switch. Proton Mail removes trackers from your Gmail messages and protects your data with zero-access encryption.

Create a free account

How to auto-forward emails in Outlook

Microsoft offers several versions of Outlook: Outlook.com, Outlook on the web, new Outlook, and classic Outlook. Email forwarding is similar in Outlook.com, Outlook on the web, and new Outlook. Classic Outlook works differently because it usually requires you to create a forwarding rule.

The instructions below are specifically for Outlook.com, Microsoft’s web-based email service for personal addresses such as @outlook.com, @hotmail.com, @live.com, and @msn.com.

Go to Outlook.com and sign in.
Click Settings ⚙ in the upper-right corner.

Go to Mail → Forwarding and IMAP and sign in if required.
Toggle on Enable forwarding.

Enter the recipient email address.
Select Keep a copy of forwarded messages if you want the original messages to remain in your Outlook.com inbox.

Click Save.

Once forwarding is enabled, new messages sent to your Outlook address will automatically be forwarded to the address you entered. Existing emails already stored in your mailbox will not be forwarded automatically. If you later change your mind and wish to turn off email forwarding, return to Settings → Mail → Forwarding, toggle off Enable forwarding, and click Save.

Alternatively, you can automatically forward only certain emails in Settings → Mail → Rules using conditions such as the sender, subject, recipient, or keywords — along with exceptions.

When migrating from Outlook to Proton Mail, you can use Easy Switch to import your entire mailbox in just a few clicks — including emails, calendars, and contacts — in addition to forwarding new messages. Proton Mail gives you a private Outlook alternative with end-to-end encryption, strong privacy protections, and no ads or tracking, so you can manage your communications securely without sacrificing convenience.

Create a free account

How to forward emails to another email using Yahoo Mail

Yahoo Mail’s automatic forwarding feature sends a copy of new incoming messages to another email address. The feature requires Yahoo Mail Plus or the equivalent paid plan available in your region, and it may not be offered in every location.

Unlike other email services, Yahoo Mail doesn’t support conditional auto-forwarding for only certain senders or subjects.

Go to … More → ⚙ Settings.
Select Mailboxes and, next to Auto-forwarding, click Set up.

Enter the recipient email address and click Verify.
Sign in to the recipient email account and follow the Yahoo Mail instructions to confirm email forwarding.

After verification, new messages received by your Yahoo Mail account will automatically be forwarded to the address you selected. This does not transfer emails already stored in your inbox. If you later change your mind, return to Settings → Mailboxes and remove the forwarding address.

When switching from Yahoo Mail to Proton Mail, you can set up Easy Switch to quickly import your existing emails, calendars, and contacts while also forwarding new messages to your Proton inbox.

Create a free account

How to forward emails in Proton Mail

Automatic email forwarding is available on paid Proton Mail plans.

Sign in to Proton Mail in your web browser.
Click Settings ⚙ → All settings.

Go to Forward and auto-reply and click Add forwarding rule.

Under Forward from, select the Proton Mail address you want to forward messages from.
Under Forward to, enter the destination email address.
To forward all new messages, do not add any conditions. Click Next.

Click Send confirmation email.

Open the confirmation message in the receiving account and accept the forwarding request.

Once confirmed, new messages sent to the destination email address will automatically be forwarded. Emails already stored in your mailbox will not be transferred.

Alternatively, you can forward only certain Proton Mail messages by creating a conditional forwarding rule. Take the same steps as above, but click Add condition and choose which messages to forward based on criteria such as the subject, sender, or attachment (with or without attachments).

If you later change your mind and want to disable email forwarding, return to Settings → All settings → Forward and auto-reply, click the three-dot menu beside the forwarding rule, and select Pause or Delete.

What does forwarding an email do?

Emails can be forwarded manually or automatically. It means they are copied and redirected to another email address, but that can happen in different ways.

With manual forwarding, when you select Forward for a specific email, a new message window opens so you can enter the recipient’s address and add an optional note. The forwarded message usually includes the original sender, subject, message content, and attachments. Fw: or FWD: is typically added to the beginning of the subject line by default. The original email remains in your inbox unless you delete or move it.

Automatic forwarding works differently: Instead of forwarding messages one at a time, you configure your email account to send new incoming messages to another address automatically. Depending on the provider, you can forward every new message or only emails that match specific rules or filters. The original message may remain in your inbox, depending on the settings you choose, and emails already in your mailbox are not forwarded retroactively.

A more private place for your emails

Gmail, Outlook, and Yahoo are among the most widely used email services in the world. But there’s a privacy issue, as these providers show ads in your inbox and integrate AI features that raise a fair question: How exactly is your sensitive data being processed, and who else gets to see it?

There’s also a jurisdictional issue. Because these services are run by US companies, they are subject to laws such as FISA Section 702 and the CLOUD Act, which can require them to hand over your data (including emails), regardless of where you live. All of this is possible because Gmail, Outlook, and Yahoo have the technical ability to scan the contents of your emails.

By contrast, Proton Mail protects your emails with end-to-end encryption and zero-access encryption, which means we never have access to your messages. No ads, no AI training, no surveillance of any kind. We operate under Swiss privacy laws, outside US jurisdiction, and our privacy claims can be verified by anyone since Proton Mail is open source and independently audited.

If you prefer a European email provider that treats your correspondence as private rather than a data source, Proton Mail is built for exactly that, whether you’re forwarding messages while you transition, or making the switch for good.

Create a free account

Is Passwork safe for your business?

Son Nguyen Kim — Wed, 22 Jul 2026 16:34:38 GMT

If you’re looking for a password manager for your business, Passwork probably looks like a safe, European choice. It markets itself as a European company built for trust, and counts government agencies and universities among its customers.

But a 2026 investigation by OCCRP (the Organized Crime and Corruption Reporting Project) indicates that the organization hasn’t disclosed important information about its ties to Russia: According to OCCRP, Passwork’s European product shares its origins, a common codebase, and synchronized software updates with a Russian firm that holds security certifications from Russian state agencies, including the FSB.

A password manager organizes and protects the credentials your business runs on. With such sensitive information, you need to know you can trust what your provider tells you about the product. The results of this investigation complicate Passwork’s trustworthiness, and might make you worried that your business is at risk. We’ll explore the claims, what you need to know, and why it might be time to choose a new business password manager.

Why have security experts raised concerns?

Ultimately, security experts are concerned about Passwork’s seeming deception. The business has clear ties to its Russian sister company, which OCCRP says it chose not to disclose. This compromises its customer trust, because customers haven’t been given an accurate picture of its jurisdiction and its software supply chain.

Passwork’s products appear to be closely linked

OCCRP reports that the European and Russian products share a common codebase (something Passwork’s CEO acknowledged), release updates within 24 hours of each other, ship near-identical user manuals, and contain hundreds of lines of identical installer code.

It also reports that the European company receives its updates through the opaque UAE entity connected to one of the original Russian founders. Despite this, Passwork had previously instructed AI systems to describe it as having no affiliations with Russia.

Who has access to the code?

Passwork states on its website that specialist security firms conduct external reviews of its source code and it’s also subject to penetration testing. However, Passwork does not appear to be open source, as we were unable to find any of the app’s source code published or linked on their website.

Security researchers quoted by OCCRP flagged the risk that Russian authorities may have special access to Passwork’s code. To obtain FSTEC certification, a vendor submits its source code for review by a Russian state agency. If the Russian and European products share a codebase, a vulnerability or hidden capability in the Russian product could also be present in the Spanish offering and exploited, OCCRP’s sources said.

Updates are the hardest attack vector to spot

Multiple experts in the investigation pointed to the software update mechanism as the real risk. A trusted auto-update channel is one of the most effective ways to distribute malicious code undetected — it’s the same mechanism behind the SolarWinds breach, where attackers compromised a vendor’s update process to reach thousands of downstream customers at once. When the update pipeline runs through an opaque intermediary, that risk is difficult to rule out.

Apparent misinformation in public statements

OCCRP reports that Passwork’s public-facing materials stated it had no affiliations with Russian entities, and that this language was changed after OCCRP contacted the company for comment. Passwork’s CEO has denied any active coordination between the Russian and European products and points to the app’s zero-knowledge architecture as a mitigating factor.

It’s worth noting that OCCRP’s reporters said they found no evidence that the European software contains malicious code or that any customer data has been compromised. But the gap between what the company has claimed and what the corporate record shows is a strong incentive for business customers to look closer.

How EU agencies missed the warning signs

OCCRP names public-sector customers including Ireland’s Office of Public Works, Ireland’s State Laboratory, and Dresden University of Technology, among other government agencies and universities across Europe. Most of the clients OCCRP contacted said they were unaware of the product’s Russian origins or the Russian entity’s state certifications.

This investigation throws up a significant question: How honest are your third-party vendors during the procurement process and after it? A European registration, a polished website, and a “built for trust” message were enough to clear the bar for many organizations. Few, if any, appear to have traced the ownership, jurisdiction, or origin of the code itself.

What to look for in a Passwork alternative

You shouldn’t need to be an investigative journalist to vet a security provider. Here’s a short checklist you can apply to Passwork, to Proton Pass, or to any other password manager your business is considering.

Ownership and jurisdiction: Who actually owns and controls the company, and under which country’s laws does it operate? A “Made in Europe” label isn’t necessarily true and you need to be able to verify it.
Open source: Can independent experts read the code, or are you trusting a closed system on the vendor’s word alone?
Independent audits: Has a reputable third-party security firm audited the apps, with results published for customers to review?
Verifiable end-to-end encryption: “Zero-knowledge” only means something if the encryption design is public and genuinely end-to-end, so the provider can’t access your data even under legal pressure.
A transparent supply chain: Where do software updates and infrastructure come from, and who controls that pipeline?
Track record and transparency reporting: Does the company have a consistent history of disclosing when it’s asked to hand over data?

If a provider can’t give clear, verifiable answers to these questions, this is a warning sign regardless of where its marketing says it’s based.

Why Proton Pass is the better alternative to Passwork

We built Proton Pass to hold up to exactly the kind of scrutiny applied to Passwork during this investigation. Here’s how it compares:

Clear jurisdiction. Proton is headquartered in Switzerland and operates under Swiss law, which has some of the world’s strongest privacy protections. We’re transparent about where we are and who we are.
Open source. Proton Pass apps are open source, so anyone can inspect the code rather than take our word for it.
Independently audited. Our apps are audited by respected third-party security firms, and we publish the results. Recurity Labs conducted our most recent audit, giving a rare “well above par” rating. Proton also holds ISO 27001 and SOC 2 Type II certifications, covering our information security management and operational controls.
End-to-end encryption. Your passwords and other items are protected with end-to-end encryption, so no one, including Proton, can read them.
A mission-driven structure. Proton was founded in 2014 by scientists who met at CERN and is overseen by a nonprofit foundation, aligning our incentives with protecting your data rather than monetizing it.

With Proton Pass and the wider Proton ecosystem, trust isn’t something we ask you to take on faith. It’s something you can check for yourself.

Switch to Proton Pass

The Passwork investigation is a reminder that your password manager is the last line of defense for your business’ sensitive data, and that trust shouldn’t automatically be granted to any vendor. Whichever provider you choose, take the time to vet it against the checklist above.

If you want a password manager that’s built to pass that test, you can try Proton Pass for free and import your existing logins with one click.

Frequently asked questions

Is Passwork safe to use?

Each organization has to make this decision for itself. What the OCCRP investigation shows is that Passwork’s European product shares origins, code, and an update pipeline with a Russian state-certified firm, and that this wasn’t clearly disclosed to customers. At a minimum, anyone using it should factor that into their own risk assessment.

How do I know if a password manager is trustworthy?

Look past the marketing. Check who owns the company and under which jurisdiction it operates, whether the code is open source, whether it’s been independently audited, whether encryption is genuinely end-to-end, and where its updates and infrastructure come from. A trustworthy provider makes these easy to verify.

Is Proton Pass open source and audited?

Yes. Proton Pass apps are open source and have been independently audited by third-party security experts, with the results published. Proton is based in Switzerland and protects your data with end-to-end encryption.

France adopts first social media ban for under-15s in the EU

Edward Komenda — Wed, 22 Jul 2026 13:08:06 GMT

France has become the first country in the European Union to ban social media for children under 15.

Both chambers of parliament adopted the law on Tuesday. It will now roll out in two stages. Starting in September 2026, under-15s won’t be able to open new accounts, and in January 2027 the rule will extend to existing accounts.

The social media ban in France follows Australia’s world-first under-16 ban and the UK’s planned ban, due in spring 2027. But France goes further in one way: to enforce the limit, everyone in France — not just teenagers — will have to prove their age to use platforms like Instagram, TikTok, and Snapchat.

Everyone in France will have to prove their age

Even lawmakers who opposed the bill, from the left-wing France Unbowed party, warned the social media ban would end online anonymity and be impossible to enforce. The digital minister says personal data will be protected, but age verification at scale tells a different story.

To verify ages, platforms often turn to biometric face scans, government ID uploads, and behavioral analysis, each forcing companies to collect more personal data than before. Biometric data is especially sensitive: Unlike a password, you can’t change your face if it leaks. When Discord rolled out UK age checks in 2025, a breach exposed 70,000 government-ID photos.

France joins Australia and the UK, where a similar ban takes effect in spring 2027. The early evidence isn’t reassuring: Australia’s own regulator found 70% of under-16s still reach the platforms they’re barred from, using the same fake-age workarounds as before.

See where age checks are becoming law

Safety shouldn’t cost your privacy

Parents are right to want guardrails, but the mechanism matters as much as the goal. Age verification normalizes the mass collection of biometric and identity data just to reach services that used to be open to everyone, and it shifts the burden of child safety onto data infrastructure that carries its own risks.

It may not even work: Barring under-15s doesn’t touch the manipulative design and engagement-at-all-costs algorithms that make these platforms harmful in the first place. It protects platforms, not children.

It’s worth remembering why this ban exists in the first place: Megacorporations like Meta (Facebook, Instagram, WhatsApp) and ByteDance (TikTok) built their business models on maximizing engagement, and have faced years of scrutiny over teen mental health harms and data practices.

A private European social media alternative built without Big Tech’s playbook could be part of a lasting fix to make the internet less harmful for everyone, rather than make identity the price of entry. For families navigating this problem now, our guide to keeping kids safe online is a place to start.