Oddbean

Hey there, under no circumstances can our encryption be bypassed, meaning emails, attachments, calendars, files, etc. cannot be compromised by legal orders. We also provide an official onion site for Proton Mail for use with the Tor network. It’s also important to differentiate that VPN is not classified as a communication tool in Switzerland — Proton VPN does not log IPs and there are no existing Swiss laws that can compel us to do so. Check out our latest audit here: https://protonvpn.com/blog/no-logs-audit

Thank you for clarifying! This goes a huge huge way to showing me confidence in the product + brand. I honestly just didn't know what to think, friends email was temporarily suspended and he had done nothing wrong. (honestly) It made it kinda hard to get any 2FA login going when that happened, that's my worry I guess. Did his account get suspended because a Swiss Criminal Law required it? What would suspending an account that's completely encrypted achieve for the Swiss Police? And you guys unsuspended the account a few weeks later too. No reason, no explanation, nothing. Not even a Proton problem really at it's heart but an issue with 2FA passwords being sent over E-Mail as the industry norm. I love Proton, don't get me wrong. I use you guys right now on a paid subscription and in the past I was on the visionary plan. Just that E-Mail that can't be accessed when funds or time is an issue, is kinda horrible. It felt like a twitter-style shadowban tbh with absolutely no recourse on the user's part 😕 Thank you though for replying.. this does put alot of my mind at rest and thanks to @Ava too for being an absolute boss and writing up a thesis supporting you guys and how stuff is actually working!

How can there be a no-logs policy if there is a maximum number of devices that can be logged in simultaneously per account? How does device A know that there are too many? A central server must issue a notification and log which devices are logged in.

Logging relates to what's done on the VPN and IPs that connect in a medium/long/permanent-term basis. IPs needn't be logged. Obviously servers are aware of them to accept connectivity, but they aren't logged, all data is ephemeral and processed in real-time. Regarding number of devices logged, that's fairly easily worked around. The client has to be connected to your account. That session ID can present a device count + 1 status to your account. I'm not sure how Proton specifically does it, but as someone who works in the field, there are multiple ways to have that covered.