The Proton Blog

Become a Proton Pass managed service provider (MSP) with our new program

Raphael Auphan — Tue, 01 Sep 2026 11:56:18 GMT

Small and medium-sized businesses are under threat from hackers in a way they’ve never been before. They’re the new favorite targets of ransomware attacks. AI-fueled phishing scams and malware-as-a-service make criminal work easier than ever. Our SMB Cybersecurity Report found that hackers breached one in four SMBs last year, costing most of them between $10,000 and $100,000.

The best solution is also the simplest: Use a business password manager.

To make strong cybersecurity even more accessible to SMBs, Proton Pass is launching a pilot program for managed service providers. We’re inviting MSPs in our community and beyond to take part. By joining the program now, you’ll be able to offer and manage Proton Pass Professional subscriptions from a dedicated portal in your own Proton Pass dashboard.

Many organizations use our Proton Pass password manager within their own infrastructure, and some IT firms and MSPs deploy it for other businesses. But until now, a more feature-rich managed services portal hasn’t been available. This program gives you the opportunity to add Proton Pass to the product portfolio offered to your customers while helping to shape the development and features of the Proton Pass MSP product.

What is the Proton Pass MSP pilot?

The pilot program introduces a dedicated portal that allows MSPs to sell and manage Pass Professional subscriptions across multiple client organizations from one interface.

Before we roll out MSP services for broader availability, we’re inviting MSP businesses to take part in this initial pilot program. We’ll work closely with them to understand how they use the portal and what new features they would like to see.

This launch focuses on the core features you need as an MSP, including:

Allowing multi-organization user provisioning and management
Having an overview of all sub-organizations that you manage, showing allotted vs. used licenses per client, with one-click access to each client’s admin dashboard

What to know about the pilot program

If you’re interested in taking part, here’s what to expect:

After you get in touch with our sales team and set up an agreement, you’ll be granted access to the new MSP portal.
You’ll be subscribed to your own Proton Pass plan that allows you to create and manage client sub-organizations from the dedicated MSP portal.
Every seat allocation or disablement is recorded as a timestamped event.
At the end of each month, you can export a detailed report that you can use to bill your own clients.
You’ll also be sent an invoice by Proton in line with the detailed report.

Find out more about the pilot program.

Why partner with Proton Pass as an MSP?

When you provide third-party password management services for businesses, your clients trust you to protect their entire IT perimeter, which includes valuable and sensitive business data. That means choosing reliable tools that meet high security standards, not just ones that offer the right price or make claims you can’t verify.

Security your clients can rely on

Everything we claim about Proton Pass’s security is backed up by regular third-party security audits and our application code is all open-source so anyone can verify it. Our zero-knowledge architecture and end-to-end encryption form a secure foundation for any business.

Read why fintech Elemnta chose Proton Pass

Effective password management for teams

Proton Pass provides secure credential management with customizable policies and granular reporting that make it an ideal choice for managed service providers. You can manage all of your clients’ organizations from one console, ensuring that business password policies are followed and strict security standards are met.

Easy enough for anyone to use

When you’re introducing a new password manager, encouraging adoption can be a challenge. Proton Pass was designed to work for anyone, no matter their familiarity or confidence with tech. Companies that switch to Proton Pass say the intuitive interface led to more widespread adoption.

See how French coworking firm Morning rolled out Proton Pass

An EU-based alternative for digital sovereignty

Many businesses are looking for European alternatives to the American tech they’ve relied on because they’ve realized they don’t truly have control of their own data. When clients ask how you address this problem, Proton Pass can be the simple answer.

You can learn about all the Proton Pass features and see how Pass compares to other password managers. Our sales team is also available to help you if you have any questions about the MSP program or need answers for your clients.

Find out more about the pilot program and how businesses can benefit from adopting a secure European business password manager.

August 27 outage: Incident report

Bart Butler — Fri, 28 Aug 2026 21:12:56 GMT

In the early hours of August 27, 2026, Proton experienced a widespread outage that impacted services for a number of users. The root cause was a total failure of the cooling system in our Frankfurt datacenter. While all systems at Proton are redundant and we have enough capacity to endure a complete data center failure, there are a small number of scenarios where the failover can take longer and lead to user-facing disruptions.

Here’s a timeline of what happened, what choices we made during the incident and why, and how it was resolved.

Timeline

Just after 11 p.m. (Central European time) on Wednesday, August 26, a cooling system failure occurred in the main room of our Frankfurt datacenter. At around 11:15 p.m., the temperature started rising from approximately 21.8°C (nominal temperature) to 51.9°C in less than half an hour, with some measurement probes reporting 60°C air temperature in the room. As the temperatures rose, server and networking equipment within the facility started to die one by one.

The user-facing incident began at around midnight on August 27, when the failures escalated to the point that critical redundancy was lost. This occurred when both the primary and backup network switch on a critical rack failed, and this rack unfortunately contained several primary database copies. While almost all Proton systems are redundant and will failover automatically/immediately, primary database failovers are not done automatically without human supervision.

We retain this control out of a desire to avoid so-called “split brain” situations, where a temporary unavailability of a primary database means that the replica copies miss some updates and become de-synced in ways that can be difficult to reconcile later. Furthermore, when a primary database failover occurs, the standard operating procedure is to failover to a replica in the same datacenter for latency and performance reasons. However, the specific nature of the problem meant that this might be ill-advised, since we potentially could be failing over to something that would also go down.

The decisions

At this point, Proton’s on-call engineers needed to make a couple consequential decisions while operating under extreme pressure.

Do they prioritize bringing the service back online, or prioritize addressing the cooling problem and saving the hardware inside the datacenter?
Should we failover to replicas within the same building Frankfurt (faster and less disruptive, but possibly a temporary fix if the heat could not be brought under control), or failover to Zurich?
Do we failover everything or just what is down at the moment? We have contingencies for complete data center failure where things failover fully and mostly automatically rather quickly, but a situation where random servers are dying one by one is not handled well by our failover logic.

Ultimately the rate at which temperatures were rising forced us to prioritize saving the hardware versus bringing services back online. This is not a choice that typically needs to be made, because cooling systems are typically redundant, and the complete loss of cooling is quite rare, meaning that there is quite a bit of time before temperatures become critical. The problem is exacerbated by large increase in server power density in recent years with higher power CPUs and GPUs for AI. As a result, what used to take 3-4 hours to go critical went critical in 20 minutes.

The on-call team therefore focused their attention on communicating with the on-site datacenter operations team to restore cooling while powering off as many servers as possible to protect them. Due to a server equipment shortage tied to the ongoing AI boom, lots of this equipment — if lost — would not be possible to replace on short timelines. Saving it had to be a priority, even at the cost of potentially extending the downtime.

By 00:45 CEST, we were able to restore cooling and temperatures at the facility began to drop, and the on-call team switched focus to service recovery. At this point, we made the decision to failover the primary databases to Frankfurt if a replica was still alive, and to Zurich in cases where there was no replica alive in Frankfurt, to avoid changing our traffic flows too much and possibly creating new instability. This option was selected because we assumed that, now that we had the cooling under control, it would be relatively easy to bring Frankfurt back online and faster than switching over to Zurich.

Unfortunately, this turned out not to be the case. During the incident, many network cards in the Frankfurt infrastructure reached a temperature of 105C (normal operating temperature is 45C), which triggers a special temperature protection mode and causes the network cards to be disabled until there is a cold system reset. Our security posture limits the ability to access the out-of-band controller for our systems, which required us to wake up additional staff to assist with the recovery.

By 01:30 CEST, we were able to get most services back online for most users. However, some less critical systems, such as push notifications or payment processing, were not recovered until around 02:00 CEST.

As we reported during the initial incident report, no emails were lost, but email delivery in both directions was delayed during the incident.

While user-facing services were fully restored, that was not the end of the night for our engineers, in particular the database team. Our infrastructure was left in a highly abnormal state, with some primary databases in Zurich and others in Frankfurt, and several of them operating with reduced redundancy and/or reduced performance. Our team worked through the night to resolve the most pressing of these issues, and the work continued through the day on August 27 to restore full redundancy.

While we were able to save almost all of the infrastructure, some servers unfortunately suffered heat death, and we don’t know yet if the heating incident will impact the lifespan of the surviving equipment.

Root cause and next steps

A subsequent investigation on August 27 traced the root cause of the cooling failure to an air filter replacement on both of the redundant air compressors powering the cooling system. Unfortunately, the datacenter operator performed this operation in the middle of the night, without prior notice, and also failed to communicate the cooling failure when it happened, which dramatically cut down the time we had to respond. We are working closely with the operator to prevent a repeat of this incident.

However, it is also a known limitation of our current database infrastructure that an outage of this type could lead to a longer than normal recovery process. The series of events that led to this incident are highly improbable — yet they happened.

The database resilience work required to address this failure mode is already underway and remains planned for completion by the end of the year. Additional infrastructure capacity, including new datacenter space, is also currently being commissioned and is expected to become available within the next few weeks, which will further reduce our single site dependency.

Unfortunately, this incident occurred before those improvements were fully in place. We are now reviewing where we can safely accelerate the remaining work while maintaining the level of care required for changes to critical database infrastructure.

We recognize that our users expect a very high level of reliability from Proton, and this incident reinforces the importance of completing this work and continuing to raise our resilience standards. We apologize again, unreservedly, to every user who was impacted.

How to choose remote work tools that don’t create security debt

Alanna Alexander — Fri, 28 Aug 2026 12:32:43 GMT

Remote work tools may not feel like a major infrastructure decision when you’ve just started scaling your business. They can feel like a relatively minor task compared to making payroll, shipping your MVP, or keeping your runway alive… But that’s where the danger lies.

The remote work tools you pick on day one become infrastructure you’re stuck with, and the gaps between those tools quietly accumulate into serious problems you won’t notice until it’s too late. That’s security debt — and it’s more common than you’d think.

One in four SMBs experienced a breach last year, despite actively investing in security tools. The problem wasn’t the password managers or VPN they chose: it was the gaps between them.

Security debt doesn’t hit you immediately, but it does compound in the background until the worst possible moment: When an enterprise customer asks for your audit trail and you don’t have one. Or an investor asks where your data is stored and you tell them it falls under US jurisdiction. Or a security questionnaire asks you to list everyone who has had access to your core systems in the last 24 months, and you realize you never tracked this.

Here’s how to build a secure stack of remote work tools that closes those gaps and is built to last.

11 of the best remote work tools for your team

Every business has different needs, but there are certain categories of remote work tools that just about every business needs to fill. Here are the 11 tools we recommend for each.

1. Slack (Best for team chat)

Launched in 2013, Slack has become the default choice for teams that want chat, voice, and video in one place. It replaced the endless email threads of old with channels organized by team, topic, or project, and its deep integration library (Google Calendar, Jira, and hundreds more) makes it a notification hub for your whole stack. One drawback to consider: on some plans, admins can access message history, a potential privacy concern for some businesses.

To find out what else is out there, read our list of the best internal communication tools.

2. Proton Mail (Best for business mail)

Email providers with economic models built around ad targeting can’t guarantee that your emails won’t be read by anybody else, whatever their privacy policy claims. Proton Mail is end-to-end encrypted by default, and protected under stringent Swiss privacy law, so only you and your recipient can read what’s sent. (Please note: emails to non-Proton recipients aren’t end-to-end encrypted unless you password-protect them first.)

3. Loom (Best for async video)

If you’ve ever been in a meeting that could easily have been a two minute video, Loom could be the solution for you. It lets you create video notes, recording your screen, face, and voice together, to be shared as a link. Popular use cases include recording onboarding walkthroughs, bug reports, and async updates across time-zones. (Note that Loom recordings are stored on Loom’s own servers rather than your team’s infrastructure, worth knowing if you prefer to keep company data under your own control.)

4. Proton Meet (Best for video conferencing)

Unlike Zoom, Proton Meet is end-to-end encrypted by default, which means not even Proton can access what’s said or shared on a call. Guests join with just a link, no account required, and the free plan covers one-hour calls with up to 50 participants. One caveat: Proton Meet works well for internal team calls, but if your workflow leans on integrating video directly into a CRM or support tool, you should check compatibility before switching.

5. Jira (Best for project management)

Jira is built for software teams running agile workflows: think sprints, backlogs, and issue tracking that ties directly to your codebase through Bitbucket or GitHub integrations. As such, Jira is the default choice for many engineering teams already inside the Atlassian ecosystem. On the downside, it is more configuration-heavy than general-purpose tools like Asana, and outside of a dev team it can feel like overkill.

6. Trello (Best for tracking tasks)

Simplicity is Trello’s strength, stripping task management down to cards moving across boards labeled to do, doing, and done. There’s almost no learning curve, making Trello a natural starting point for a small team. Once your team grows, however, that simplicity can become a limitation: you won’t find it so easy to perform cross-project reporting on it.

7. Miro (Best for visual collaboration)

When gathering around a physical whiteboard is impossible, a Miro board gives teams a remote — and much more flexible — option: an infinite digital canvas for planning, collaboration, and brainstorming. You can drag and drop files onto boards, set up repeat workshops with templates for retrospectives and planning sessions. While Miro is great for teams who can work in live, synchronous sessions, it’s less useful for teams working async across time zones.

8. Proton Drive (Best for cloud storage)

Proton Drive is the privacy-first alternative to Dropbox and Google Drive. Though it has fewer direct integrations than those apps, Proton Drive does a better job of protecting your data, encrypting files on your device before they ever reach Proton’s servers so that Proton can never decrypt them, even under a court order. Version history, access logs, and granular permissions come built in, and shared links expire by default rather than staying open indefinitely.

9. Proton Pass (Best for password/credential management)

The risk of credentials leaking increases sharply outside of a controlled office environment. Unlike most password managers, Proton Pass encrypts every field of every saved item by default: not just passwords, but usernames and notes too. It also includes email alias generation to keep your team’s real email addresses out of signup forms. (Note that advanced admin controls — SSO and SCIM directory sync — are reserved for the Pass Professional tier, not the base plan.)

10. Notion (Best for building a knowledge base)

With Notion, you can organize and centralize your business’s internal knowledge and documentation in pages, databases, and wikis, building a single source of truth for your teams and eliminating doubt over which document versions are current. But be warned: Notion’s flexibility can become a risk, enabling the building of an unstructured wiki that sprawls unless someone keeps an eye on it.

11. Lumo

Even small teams benefit from AI assistance that lets them draft, edit, summarize, and research faster without having to add to head count. Lumo is Proton’s AI assistant, built to offer all the power of AI without compromising your IP and sensitive data. Gemini and Copilot need access to your document data to function, but Lumo never trains on your inputs. (Lumo is available on Premium Proton plans only.)

Why even the best remote work tools can put you in security debt without you knowing it

Even genuinely good remote collaboration tools add up to a shaky stack when each one operates under its own security model. A stack with no unified access control, no audit trail, no data sovereignty, and security debt accumulating from day one.

Security debt comes in four types:

Access debt: Your stack forces you to manually provide and revoke access across five or six different platforms. It’s on you to remember (and memory is far from 100% reliable). Result: the contractor who left you six months ago can still open your files.
Audit trail debt: The access that you’re controlling isn’t recorded anywhere. You know someone accessed that folder, but you can’t prove it. And when a future investor, customer, or regulator asks you who had access to what, when, you haven’t got a good answer.
Jurisdiction debt: Your files are sitting on servers that fall under the CLOUD Act. You didn’t mean for that to happen: you just chose Dropbox.
Human error debt: Fragmentation means more manual steps, which means more human error, which means…? Let’s just say that 39% of breaches last year were caused by human error.

None of this is inevitable. Every risk we’ve listed is easier to cleanly avoid if you choose a more unified stack of remote collaboration tools from Day One.

What a secure remote work stack actually looks like

Most SMBs (66%) say demonstrating cloud data security (especially as far as client data is concerned) is very or critically important when winning new business. A unified platform gives you that — by closing the gaps where security debt accumulates:

Unified access control: One admin layer. Instead of having to work through a six-platform checklist, you need to be able to perform one action to add and remove a team member from your infrastructure.
Encryption by default: Your data is encrypted in transit and at rest. End-to-end encryption means your provider can’t read your files and can’t be compelled to hand them over.
Data sovereignty: Your data is governed by laws you understand, in a jurisdiction you trust. (Not one that falls under the CLOUD Act.)
Automatic audit trails: So you never need to tell an investor (much less a regulator) that you don’t have one.
Built to scale securely: Your permissions, access tiers, and admin controls work whether your company is ten people or 100. No need to rebuild, no need to slow down.

Cybersecurity for startups starts earlier than you think — the earlier you build it in, the less you’ll have to bolt on (or clean up) later.

Your remote work toolkit, built on Proton Workspace

We’ve already introduced you to Proton Mail, Meet, Drive, Pass, and Lumo in this article. But selecting the best tool for each job doesn’t automatically close the gaps between those tools. To do that, you need a unified stack like Proton Workspace.

With Workspace, the security-critical layer of your stack is in safe hands: yours. Your data is under your control, encrypted from end to end (not even Proton can see it) and protected under one of the world’s strongest privacy jurisdictions.

Compliance isn’t a concern: Proton is ISO 27001 certified, GDPR and HIPAA compliant.

You’ll need to add tools on top for management and team messaging. But you’ll do so on a foundation that’s already secure.

Access debt: resolved. One admin dashboard. One action to provision a new team member across every Proton service, one to remove them when they leave
Audit trail debt: resolved. Version history, access logs, and granular permissions are built into Proton Drive and Proton Docs by default
Jurisdiction debt: resolved. Headquartered in Switzerland, outside US and EU jurisdiction
Human error debt: resolved. Expiration dates are set on links by default. Files are automatically encrypted in storage. Security is enforced automatically, not manually

The tools you pick on day one create the security debt you’ll pay off later. Build on the right foundation, and you can stop worrying about security debt — and start using your security posture as a selling point.

Try Proton Workspace

Team collaboration software: 7 tools that won’t waste your money

Alanna Alexander — Thu, 27 Aug 2026 18:35:04 GMT

Most businesses build their team collaboration software stack the same way: one tool at a time, filling needs as they come up. When you’re just starting out, this seems like a reasonable approach.

But there’s a catch. Approaching the challenge of enabling team collaboration this way is how you end up with a Frankenstein’s monster of a stack, made entirely of parts that are stitched together inorganically.

Even if the parts are good, the disconnection between them causes problems. You’re paying more subscription fees than you can track. You’re not sure who has access to what. And you’re drowning in admin work.

This is a guide to taking the alternative route: building a team collaboration stack that has the essential tools in one place and is as consolidated as possible to save you money and time.

7 team collaboration tools your stack needs

Every team collaboration stack needs to cover the same ground: chat, email, video, documents, storage, and project management. It’s also worth adding visual collaboration and a knowledge base to that list.

Here are the seven tools you need to cover everything you need while protecting the confidentiality of your data.

1. For team chat: Slack

Slack is the go-to choice for team chat. It turns conversations into organized, searchable channels — set up by project, team, or topic — instead of long, scattered email threads. Voice and video huddles let anyone start a quick call without leaving the app, and file sharing keeps context attached to the conversation. Providing all the structure a small team needs, Slack scales with your headcount, fitting seamlessly into your growing stack via an integration library connecting hundreds of other tools.

2. For business email and calendar: Proton Mail

Proton Mail gives you all the same essential business email functionality as Gmail or Outlook, with the added bonus of end-to-end encryption. Google and Microsoft process messaging content to power search and AI features; Proton Mail’s encrypted architecture ensures your business communications are for your eyes only. Proton Calendar is bundled in, so your event details — including meeting titles and guest lists — also stay private, and scheduling doesn’t require a separate app or another login.

3. For project and task management: Trello

Trello simplifies task tracking to its bare essentials without sacrificing utility: managing boards and task cards that move from to do to done, with almost no learning curve for new team members. When we talk about consolidated platforms later, bear in mind that this is a tool most platforms don’t replace — so it’s worth budgeting for as its own line item in your stack.

4. For video conferencing: Proton Meet

Zoom might be the go-to for video conferencing for many businesses, but it’s far from the most private option. Its AI Companion feature processes call content — including anything commercially sensitive — to generate summaries and transcripts. Proton Meet’s default end-to-end encryption ensures that what’s said on a call stays between the people on that call. Guests join with a link and no account, and the free tier covers one-hour calls with up to 50 participants.

5. For visual collaboration: Miro

Miro is essentially a digital whiteboard, but its infinite canvas gives distributed teams a shared space for planning, brainstorming, and workshops that no whiteboard — or even chat thread or document — can replicate. Miro packs in enough features that mastering all of it takes time, but getting started takes just minutes: templates for retrospectives and roadmapping sessions mean new teams aren’t starting from a blank canvas.

6. For cloud storage and document collaboration: Proton Drive

Proton Drive offers business cloud storage that matches Google Drive and Dropbox on granular per-file permissions and version history. Where it pulls ahead is what happens if a breach occurs. Google and Dropbox need access to your file content to index it for search and power AI features; that means they hold the keys to your contracts, financial records, and product roadmaps, and a breach on their end could expose that content directly. Proton Drive is end-to-end encrypted by default with zero-access architecture: Proton can’t decrypt your files, so neither can anyone who breaches its servers.

Proton Drive also covers document collaboration, since Proton Docs and Proton Sheets are included with every Proton Drive plan. Docs and Sheets cover the same core functionality as Google and Microsoft’s document tools (real-time co-editing, comments, and version history), while adding end-to-end encryption, ensuring your contracts, drafts, and financial models get the same protection as everything else in your stack.

7. For a knowledge base: Notion

Many businesses — particularly those scaling fast — struggle with the chaos that comes with disorganized internal documentation. Notion centralizes internal documentation, wikis, and reference material in one searchable space, cutting down on the scattered, outdated copies competing for attention. Plus, it’s flexible enough to double as light project tracking if your team doesn’t need a dedicated tool like Trello.

But if your team stores confidential client files, strategy documents, product plans, or company IP in the cloud, we recommend using a more secure Notion alternative such as Proton Drive.

The hidden cost of a disconnected collaboration stack

Let’s say you’re starting from scratch and decide to go with the seven tools we recommend. Here’s how your collaboration stack will look (notice that there are’s only seven rows, as Drive includes both Docs and Sheets) — and it looks pretty solid.

Platform	Best for	Pricing	Key feature
Slack	Team chat	Free; Pro from $7.25/user/month (annual)	Channels, huddles, deep integration library
Proton Mail	Business email	Mail Essentials (includes Proton Calendar) $6.99/user/month(annual)	Shared domain, encrypted calendar and contacts built in
Proton Meet	Video conferencing	Meet Professional $7.99/user/month(annual)	Link-based guest access, no download required
Proton Drive	Cloud storage & document collaboration	Drive Professional (also includes Proton Sheets) $7.99/user per month (annual)	Granular per-file permissions, realtime co-editing, version history
Trello	Project & task management	Free; Standard from $5/user/mo (annual)	Boards, cards, automation rules
Miro	Visual collaboration	Free; Starter from $8/user/mo (annual)	Infinite canvas, templates for recurring sessions
Notion	Knowledge base	Free; Plus from $10/user/mo (annual)	Pages, databases, wikis

However, if these tools are all running individually, not consolidated under one platform, you’re opening yourself up to three big problems.

1. The hidden subscription bill

Individually, the tools in our seven-tool stack don’t seem to cost that much. Add those subscriptions up, however, and (at the time of writing) a team of 25 is running up a bill of approximately $15,900 a year. And your team probably isn’t even using every seat.

It’s easy to lose track of what you’re spending on a set of disconnected team collaboration tools. You know they’re automatically renewing, but you’re reluctant to cancel the one you suspect nobody’s using because that means finding the login details. Or you’re worried that someone on your team must need it. (Why else would you have it?)

2. The cost of insecurity

Disconnected tools multiply your attack surface, with each surface a potential misconfiguration waiting to happen. In the long run, that could cost you dearly. Proton research shows that 25% of SMBs experienced a data breach last year, and 57% of breached SMBs lost between $10,000–$100,000.

3. The burden of admin

Time is money, and multiple tools demand that you spend a lot of both. Think of all that time spent adding and revoking permissions across seven tools (assuming you remember to), or reconciling seven separate invoices, or trying to figure out if anybody’s actually using that Miro seat you’ve been paying for since March. All these costs might not show up on one invoice. But they’re there.

What a consolidated collaboration stack gives you

The answer to reducing the cost and waste of a disconnected stack isn’t better tools, and it certainly isn’t more tools. The answer is a team collaboration platform that covers as many of the functions your disconnected tools are currently fulfilling as possible, while also giving you a secure and easily administered foundation for whatever other tools you need.

Pick your platform wisely, and replacing multiple tools with one platform will simplify and secure your team collaboration in a single stroke. When you have one platform handling team communication, file storage, document collaboration, and admin, you’re only dealing with:

One bill, one renewal date, with one owner. Zero autopilot charges for unused tools
One admin dashboard to control onboarding, offboarding, and access permissions. (No contractors hanging around in your Dropbox months after project completion)
One security model, with one permissions system to administer, no gaps between tools, and no seven-tool misconfiguration risk
One audit trail so you can see who accessed what, when, all in one place (and provide proof when investors or regulators come calling)

A consolidated, encrypted stack won’t just save you in subscriptions and security incidents. It sends a signal to your customers that you’re serious about handling their data seriously. It lets investors know that your operations are under control.

The platform to consolidate your stack: Proton Workspace

With our digital workspace platform for businesses Proton Workspace, you get all the Proton products and features we’ve mentioned on one platform: Mail (including Calendar), Meet, and Drive (including Docs and Sheets).

Instead of running those products as separate subscriptions, each with its own admin panel and its own bill, you get all of them under one account and one security model.

The subscription saving: purchasing Mail, Meet, and Drive as separate subscriptions costs more than getting them together, since each one carries its own base fee on top of your per-seat pricing. Proton Workspace consolidates all of them into a single line item instead. Proton Workspace doesn’t replace Slack, Trello, or Miro (you’ll still need separate tools for chat, project management, and visual collaboration) but on the tools it does replace, the saving is real.
The admin relief: Instead of three dashboards, you have one. Instead of three invoices on three different renewal dates, one. You can see exactly who’s using what, so no more paying for seats nobody’s touched since March. And when someone joins or leaves, onboarding and offboarding means one action for each user, not three. (And no more contractors retaining access to folders that are no longer their business.)
The security foundation: You’ve established a secure foundation for collaboration. Proton Workspace is ISO 27001 certified, and GDPR and HIPAA compliant. All its services keep your data protected with end-to-end encryption and Swiss jurisdiction. Not even Proton can access your files.

On top of this, you get extra products bundled in: Workspace Standard subscribers get a business VPN and team password manager bundled in; Premium subscribers get these, plus Lumo, our business AI assistant.

Migrating your email and calendar to Proton is straightforward: Proton’s Easy Switch tool imports your existing emails, contacts, and calendars automatically (including from Gmail).

Few SMBs get their collaboration stack right the first time around. The right team collaboration platform is the one your team uses, your admin controls, and your finance team can see on one invoice.

Try Proton Workspace

AI is making phishing attacks more sophisticated: What can businesses do about it?

Ben Wolford — Thu, 27 Aug 2026 17:46:23 GMT

AI phishing attacks are changing one of the oldest rules in security awareness: bad grammar is no longer a reliable red flag.

For years, employees were taught to look for awkward wording, strange formatting, spelling errors, and generic greetings. These clues are still important, but they can’t detect AI-powered phishing attacks.

Generative AI can help attackers write personalized messages in seconds. It can imitate a company’s tone, summarize public information about an employee, turn a short prompt into a convincing invoice request, or localize a scam to sound native in any target language.

However, this isn’t a completely new threat. It’s leveled up phishing with better writing, faster preparation, and more convincing impersonation. Phishing still aims to make someone click, share credentials, approve a payment, open a file, or move a conversation to a channel the attacker controls. AI simply makes that manipulation more convincing and easier to scale.

Within businesses, teams need to build new habits. We’ll explain what to look for and how to build better phishing and data breach protections within your business network.

How are AI phishing attacks different?

AI-generated phishing emails look like real work

New forms of AI social engineering

Why SMBs are increasingly exposed

How to adapt your phishing training to AI-enabled attacks

What businesses need to do differently

How Proton Pass for Business helps reduce credential risk

How are AI phishing attacks different?

Before generative AI, phishing required more manual effort. Attackers had to research a target, write believable copy, adjust the tone, and sometimes translate messages for different markets. Generative AI lowers these barriers to entry significantly.

The UK National Cyber Security Centre’s report on the impact of AI on cyber threats from now to 2027 notes that AI will almost certainly make parts of cyber intrusion more effective and efficient, increasing the frequency and intensity of cyber threats. It also notes that threat actors are already using AI to improve existing tactics, including social engineering.

Attackers can now produce phishing attack messages that look more natural and more specific. A scam email can refer to a real supplier, a recent LinkedIn post, a job title, a regional event, or an internal project name. Even when the attacker has limited information, AI can fill the gaps with language that sounds plausible.

The warning signs of a phishing attack remain the same. Suspicious links, urgent requests, unexpected attachments, and strange sender domains still matter. But the content itself is no longer enough to give the attack away.

Traditional phishing attacks	AI-powered phishing attacks
Often have typos, awkward grammar, or generic greetings	Can use polished, natural writing with the right tone
Usually rely on broad, generic messages	Can include personal details, company context, or vendor references
Mostly appear as suspicious emails	Can combine email, voice cloning, fake invoices, and deepfake video

AI-generated phishing emails look like real work

Phishing attacks have always ranged from crude to highly sophisticated, but generative AI lowers the skill and time needed to produce messages that are fluent, well-structured, and written in professional-sounding language.

The NCSC’s phishing guidance notes that phishing campaigns may try to steal sensitive information like passwords, or trick people into transferring money. It also explains that more targeted campaigns use information about employees or the company to make messages feel more realistic. AI makes that easier to do at scale.

Defense against modern phishing attacks requires layered controls rather than a single filter: multi-factor authentication (MFA) to make stolen credentials less of a threat, verified communication processes for critical requests, and employee training to recognize social engineering before credentials are surrendered.

Secure credential management is also a key aspect of your defenses. A business password manager like Proton Pass for Business makes it easy to generate a strong, unique password for every account. You can also monitor for exposure within your business network, so even if a team member is convinced by a single message, their credentials can’t unlock more than one account.

For employees, phishing awareness needs to evolve in order to detect these new AI-powered threats. It requires asking yourself three questions:

Does this email look fake?
Does this request make sense?
Have I verified it or can I verify it through a trusted channel?

Going beyond the spelling and formatting of the email and looking at the wider context in which it was sent can go a long way. A polished email can still be a phishing attempt if it asks for credentials, changes payment details, creates unusual urgency, or pushes someone outside the normal process.

New forms of AI social engineering

AI phishing isn’t limited to email. Attackers can now use AI to combine text, voice, images, and video into a single convincing story.

AI-generated spear phishing

Spear phishing works because the message is targeted to the person receiving it. AI makes targeting even easier: An attacker no longer needs to spend as much time writing from scratch or adapting the tone for each target. They can use public information, leaked data, or a compromised inbox to create a message that appears legitimate.

That could be a contract update that arrives at the right moment, a candidate file sent to HR, a vendor request that uses familiar language, or a payment instruction that matches the rhythm of normal finance work. The danger is not perfection, but plausibility. A spear phishing message only needs to feel relevant enough for someone to open the file, approve the request, or enter their credentials before they stop to verify.

Voice cloning and vishing

Vishing, or voice phishing, is becoming more convincing as AI-generated audio improves. The FBI’s Internet Crime Complaint Center warned in 2025 about malicious actors using text messages and AI-generated voice messages to impersonate senior US officials. The alert explains that vishing may incorporate AI-generated voices and recommends verifying callers through independently identified contact details.

Proton’s Data Breach Observatory 2026 also highlights the rise of vishing campaigns, including coordinated attacks that led to large-scale breaches and exposed tens of millions of records. The same report found that passwords appeared in 47% of tracked incidents, showing why social engineering and credential protection are closely connected.

Deepfake phishing in video calls

Deepfake phishing can also happen through video. In 2024, a finance worker in Hong Kong was reportedly tricked into transferring about $25 million after fraudsters used deepfake video to impersonate senior colleagues during a video meeting.

Seeing a familiar face on a call is no longer enough to approve a sensitive request. Large payments, credential sharing, access changes, and unusual requests still need a separate verification step through a trusted channel.

AI-generated fake invoices

Invoice fraud is much easier with AI. A fake invoice can use polished language, realistic payment terms, a familiar supplier name, and a plausible explanation for a bank detail change. If the attacker has access to a breached inbox or leaked vendor information, the request may look even more believable.

A polished invoice should not be enough to move money. If the bank details have been changed, the timing feels unusual, or the message asks someone to skip the normal approval flow, the request needs to be checked through a trusted channel before anyone pays it.

Why SMBs are increasingly exposed

AI has changed the economics of phishing by lowering the cost of targeting. In the past, highly personalized attacks were more likely to focus on large companies because they took more time to prepare. AI makes it easier to create targeted messages for smaller businesses. Attackers can generate more variants, test more angles, and adapt messages quickly without spending the same amount of time or effort.

Smaller businesses are attractive because money, access, and decision-making are often concentrated between fewer people. One person may approve invoices, manage vendor relationships, and hold access to several business tools. When processes are informal, one convincing AI-generated request can reach payment workflows, shared accounts, customer data, or admin systems before anyone has a chance to challenge it.

The risk is visible in breach data too. The same Proton Data Breach Observatory report found that SMBs accounted for 63% of breaches tracked since January 2025 and were disproportionately affected by critical incidents involving sensitive data such as authentication data, personal identifiers, or financial details.

AI helps attackers exploit weaknesses small businesses already have: reused passwords, informal credential sharing, weak approval processes, and training that still assumes scams will look obvious.

How to adapt your phishing training to AI-enabled attacks

To properly combat AI phishing attacks, your security awareness requires more consideration than checking for typos. Employees need to learn how to verify the request, not just judge the message.

The baseline your training needs is simple: If a request is unusual, sensitive, or urgent, verify it before acting:

Stop before replying, don’t respond on the same email thread.
Ignore the contact details in the message, never use the phone number, link, or reply address it provides.
Don’t treat a voice or video call as proof, because a familiar voice on a call or a familiar face on screen can both be generated.
Reach the person through a channel you already trust, an internal directory, a saved vendor record, or a previously verified contact method.
Confirm the request itself, not just the sender, ask whether the payment, access change, or file request is real.

Training should also focus on helping team members spot the moments where AI phishing is most likely to succeed:

Payment detail changes
Requests for passwords, recovery codes, or MFA approvals
Urgent file-sharing requests
Unusual login prompts
Vendor portal changes
Executive requests that bypass normal processes
Invitations to move a conversation to a personal messaging app

Proton’s guide to building a small business cybersecurity culture in the workplace is a useful and timely resource for making security behavior part of daily work.

What businesses need to do differently

AI-powered phishing changes the standard for verification. If the message looks real, the process has to catch what’s no longer immediately obvious.

Use out-of-band verification

When a request involves money, credentials, sensitive files, or privileged access, the reply should not stay inside the same thread that created the risk. The team needs a second path to confirm whether the request is real.

That might mean calling a supplier using a number already saved in the vendor record, checking an executive request through an internal channel, or confirming access changes with the project owner. The key is to use contact details the business already trusts, not the phone number, link, or reply path provided in the suspicious message.

Require multi-person approval

High-risk actions should not depend on one person’s judgment. Payment changes, large transfers, new vendor bank details, privileged access grants, and bulk data exports should require a second approval to reduce vulnerability.

One urgent-looking message doesn’t need to derail normal work. A second approval gives the team a pause point before money is transferred, access is granted, or sensitive data leaves the business.

Protect credentials before they are targeted

AI phishing often ends at the same place as traditional phishing: credentials. The attacker wants a password, a session token, an MFA approval, or access to an account that opens the door to other systems.

IBM’s Cost of a Data Breach Report 2025 recommends strengthening identity security and adopting phishing-resistant authentication methods to reduce the risk of credential abuse. It also reports a global average breach cost of $4.4 million, showing why identity and access controls have financial consequences, not just technical ones.

Containment is key for SMBs. AI may make the first message harder to detect, but the business can still control what happens after a mistake. Strong, unique passwords, MFA, secure sharing, limited admin access, and consistent offboarding reduce the chance that one compromised account turns into access across email, finance tools, enterprise cloud storage, or other business systems.

How Proton Pass for Business helps reduce credential risk

Your organization’s password policy should bring credential habits under control before an employee is targeted. Limit password reuse across business accounts, use encrypted password vaults, keep sensitive access out of browsers, spreadsheets, and chat threads, and provide secure sharing options. Those measures give teams a controlled way to grant or remove access without searching through old messages or documents.

A business password manager like Proton Pass for Business limits how much damage a phishing attack can do. When credentials are unique, encrypted, and centrally managed, a single successful message compromises one account instead of opening a path across email, finance tools, and cloud storage. It works alongside awareness training, email filtering, and payment controls rather than replacing them.

Proton Pass for Business also helps teams generate strong passwords, use autofill, and manage credentials through centralized admin controls. Unique passwords, strong authentication, secure credential sharing, and controlled access make it harder for one successful phishing attempt to spread across the business.

Protect your team from AI-powered phishing with a business password manager.

Data exfiltration: how attackers steal business data and how to stop them

Kate Menzies — Thu, 27 Aug 2026 16:36:47 GMT

Most breach prevention advice, including our own guide to preventing data breaches, is focused on keeping attackers out of your business network. Using stronger credentials, phishing resistance, patched systems, vetted suppliers are all key components of this practice. They’re all essential practices, but they can’t be your only data breach protection tactics: they won’t support you if an attacker manages to breach your network.

Gaining access and data theft are different. An attacker who compromises one inbox, one laptop, or one supplier connection has not yet stolen anything. They’ve gained a foothold, and what happens between that foothold and the moment data leaves the building is a phase most SMB security guidance skips entirely, because it isn’t just about securing your network; it’s also about noticing that data is being moved outside of it.

This phase is called exfiltration, and it typically lasts for days or even stretches across months undetected. It’s possible because of tools and channels that look completely ordinary to anyone not specifically watching for them. Breach notifications frequently arrive late not because organizations were careless about the initial compromise, but because the attacker wasn’t detected inside the business network.

The exfiltration phase: what happens between access and theft

What data exfiltration looks like

Why is exfiltration difficult to spot?

What businesses should monitor for

How early detection can change your legal position

What happens to exfiltrated business data?

Contain what an attacker can reach

The exfiltration phase: what happens between access and theft

Once an attacker gains initial access, whether through a phishing email, a stolen credential, or a compromised supplier connection, they rarely move straight to stealing data. Acting immediately risks triggering an alert before they’ve found anything worth taking, so the more common pattern is patience.

The attacker spends time mapping the environment, including:

Where financial records are stored
Assessing which SaaS tools contain customer data
Locating accounts with the broadest access
Detecting whether activity monitoring, if any, is in place.

This reconnaissance stage can be slow. Some attackers move within hours, particularly in opportunistic ransomware cases where speed matters more than stealth. Others, especially in cases built around long-term data theft or espionage, stay embedded for weeks or months, learning normal patterns of activity well enough to blend into them.

Either way, by the time the attacker starts moving data out, they usually already know exactly what they want and which account or system will let them take it without tripping an alarm.

What data exfiltration looks like

Malicious exfiltration is difficult to spot because it looks like everyday activity. IT admins aren’t looking for slightly larger file transfers than usual or folders synced somewhere they shouldn’t be.

Large or unusual data transfers

This is the most direct form of exfiltration. For example, an account may suddenly pull gigabytes from a file server or database it normally touches only occasionally, or bulk export from a CRM or HR platform.

In SaaS-heavy environments, exfiltration often happens through the platform’s own export features: bulk CSV downloads, PDF exports of customer records, or a sequence of screenshots taken of a dashboard that doesn’t have an export button at all.

A typical case might look like this: a compromised HR account is used, over several weeks, to run small, staggered exports of employee records rather than one obvious bulk download. Each individual export looks unremarkable on its own, well within what an HR platform expects someone in that role to do.

It’s only the pattern across weeks, the same account exporting similar data at odd intervals, that would reveal what’s happening, and that pattern only becomes visible to a business that’s looking for it.

Inbox compromise

An attacker who compromises a business email mailbox can set up a rule that silently copies every message, or every message matching certain keywords, to an external address, giving them an ongoing feed of sensitive correspondence long after the original phishing email is forgotten.

Cloud storage compromise

Personal cloud storage is another common route. An employee’s compromised laptop, or a compromised account with access to company files, can be used to copy documents into a personal Dropbox, Google Drive, or similar service, a transfer that often looks identical to a legitimate file backup unless someone is checking where the data ended up.

Why is exfiltration difficult to spot?

The uncomfortable truth about exfiltration is that it usually doesn’t require any malware at all. An attacker using a compromised account to export a report, forward some emails, or upload files to a cloud drive is using the same tools and permissions a legitimate employee uses every day.

There’s no suspicious executable for antivirus software to flag, or any unusual processes for endpoint detection to catch, because nothing about the activity is technically abnormal. It only looks wrong in context, and context is exactly what most SMB security tooling isn’t built to evaluate.

This is why perimeter-focused defenses, however well implemented, aren’t enough on their own. A business can do everything right at the point of entry, enforce strong credentials, train employees against phishing, patch every system, and still have no way of knowing that a compromised account is steadily moving files to an external destination, because that activity was never designed to look suspicious in the first place.

Security researchers sometimes call this “living off the land”: using the target’s own legitimate software, cloud integrations, and administrative tools rather than using any tools that an antivirus product would recognize as illegitimate.

A file sync client, a built-in export feature, or a standard email rule aren’t malicious tools in themselves. This is why an attacker who relies on them can operate for so long without setting off anything designed to catch malware.

What businesses should monitor for

Catching exfiltration early comes down to watching for a small number of specific signals, rather than scanning broadly for suspicious activity.

Traffic and exports

Unusual data transfer volumes or destinations deserve the closest attention. Your organization should be watching for a spike in outbound traffic, a bulk export from a system that doesn’t normally see them, or any transfer heading to a destination you don’t recognize.

The NCSC’s guidance on data security specifically recommends logging access to sensitive data and monitoring for unusual queries or attempted bulk exports, precisely because that pattern is a sign that something has moved beyond normal use.

Email forwarding rules

Email forwarding rules are worth auditing directly, especially for any account that has been involved in a suspected phishing incident. A rule quietly forwarding messages to an unfamiliar address can sit unnoticed for months, and it’s one of the simplest things to check once you know to look.

Unusual logins

Login activity from unexpected locations or times is a signal worth taking seriously. A login at 3 AM from a country the business has no presence in isn’t proof of anything on its own, but when cross-referenced with a data transfer around the same time, it’s a detail that can confirm an incident.

Admin account activity outside business hours deserves particular scrutiny, since admin accounts typically have the broadest reach into a system and are a preferred target precisely because of that reach.

Activity on these accounts late at night, on weekends, or during a period when the actual administrator is known to be out of office is one of the more reliable indicators that an account, not just a device, has been compromised.

How early detection can change your legal position

Under both EU GDPR and UK GDPR, Article 33 gives organizations 72 hours to notify the relevant supervisory authority once they become aware that a breach affecting personal data has occurred; the ICO in the UK or the national data protection authority in each EU member state.

The requirement is materially the same for all jurisdictions: the clock starts for your organization at the moment of awareness, not from the moment the breach actually happened. This is why thorough exfiltration monitoring matters so much for compliance, not just security.

A business that detects exfiltration early, through forwarding-rule audits, transfer monitoring, or unusual login alerts, can notify proactively, on its own timeline, with a reasonably clear picture of what was taken.

A business that only discovers a breach weeks or months later, often because a customer complained or stolen data surfaced on a criminal forum, is notifying reactively, under pressure, often with an incomplete picture of scope and a regulator asking why it took so long to notice.

The difference goes beyond how your reputation is affected. It shapes how the entire incident is assessed, and how much latitude a regulator is inclined to extend.

What happens to exfiltrated business data?

Proton’s Data Breach Observatory tracks what surfaces on the dark web once a breach has occurred, and the pattern is a useful reality check on what exfiltration is really after.

According to the 2026 Data Breach Observatory update, names and email addresses appear in nearly nine out of ten tracked breaches, contact details such as phone numbers and physical addresses show up in roughly three-quarters of them, and passwords are exposed in close to half.

More sensitive categories, government-issued IDs, health records, and other personally identifiable information, appear in just over a third of breaches, while direct financial information shows up in a smaller share, around one in twenty.

SMBs make up the majority of breaches the Observatory tracks, and they are disproportionately represented among the incidents involving the most sensitive data categories.

This combination, frequent targeting and a high rate of sensitive-data exposure, is consistent with the type of exfiltration this article describes: attacks that occur over a long period of time within a smaller organization’s systems tend to pay more dividends, because nobody knew that data was being leaked and attackers could take everything.

Contain what an attacker can reach

Exfiltration monitoring catches data on its way out, but the size of the problem is decided earlier, by what a compromised account can reach in the first place. An attacker who gains access to an account with broad, unrestricted permissions can pull from far more systems than one who compromises an account scoped tightly to what that specific role needs.

Unique credentials on every account, combined with access limited to what a role genuinely requires, directly shrinks the exfiltration surface. If a compromised marketing account can only reach marketing systems, the worst-case scenario is bounded by design, rather than depending on an attacker’s restraint or a monitoring system catching them in time.

This is the same containment logic that limits blast radius in a credential-based breach generally: the account that gets compromised should only ever be able to leak what it was legitimately allowed to touch.

A business password manager like Proton Pass for Business makes this scoping realistic to maintain, since it removes the temptation to reuse a convenient set of broad credentials across tools simply because managing unique ones by hand doesn’t scale.

When every account has its own credential and access is reviewed against what a role actually needs, a single compromised account stops being a route to the entire organization’s data and becomes, at worst, a contained incident.

Proton Pass for Business can support your business with:

Customizable team policies that help you enforce your password policy with password requirements, mandatory two-factor authentication (2FA) and revoked data sharing rules
Usage logs that allow you to see activity within your network, with additional support from our advanced high security program Proton Sentinel
Groups organized by role, project or access level, simplifying access management and ensuring that every team member only has access to what they need.

Stop credential-based data exfiltration with a business password manager.

Does Chrome track you? Of course, but these steps can help

Proton Team — Wed, 26 Aug 2026 20:06:58 GMT

Chrome is the most used browser on the planet, which gives Google access to a considerable amount of information about how people use the internet. Some of that collection happens even when you’re not signed in.

Google says some of Chrome’s data collection helps improve features, security, and search suggestions. But it can also send information back to Google that contributes to a broader picture of your browsing habits.

If you’re not OK with that, your best course is to ditch Chrome once and for all. Here are the best browsers for privacy, and if you’d like to steer clear of American tech entirely, these are the best private European web browsers.

Unfortunately, there’s no way to eliminate Google’s data collection if you’re determined to keep using Chrome. But you can limit the damage.

Why Chrome tracks your activity

A web browser is a little like your front door to the internet. Everything you do online passes through it. If that door also has cameras and sensors recording who comes and goes, it becomes much easier to understand your habits.

Chrome can collect information even when you aren’t signed in. It can also use identifiers associated with your browser and device, while other settings allow it to share information with Google to improve features and services.

Some of these settings are easy to overlook because they are presented as ways to make Chrome better. Enhanced Safe Browsing, for example, can send information about websites you visit to Google as part of its security features.

That doesn’t mean every privacy-related feature is inherently bad. It does mean you should know what you’re agreeing to before leaving everything enabled.

Chrome sends what you type to Google

One of the more direct forms of data sharing happens while you type into Chrome’s address bar. With search suggestions enabled, Chrome can send what you type to Google before you actually submit a search.

That can be useful if you want faster suggestions, but it also means Google may receive queries you never intended to search.

You can limit this by going to:

Settings > You and Google > Sync and Google services

Next turn off Improve search suggestions.

This prevents Chrome from sending your typing to Google simply to generate predictions and suggestions.

It’s a small setting, but it addresses a particularly revealing type of data: things you started typing but never actually searched for.

Chrome builds a profile of your browsing habits

Chrome can also send information about how you use the browser back to Google. Combined with other data, this can help build a picture of your interests, the devices you use, and even your physical location.

To reduce this collection:

Open You and Google > Sync and Google services > toggle off Help improve Chrome’s features and performance and Make searches and browsing better.

You can also disable Background Sync under Privacy and Security, then Site settings and Additional permissions.

This prevents websites from continuing to exchange data after you have closed a tab.

While you’re reviewing those settings, check your site permissions too. Remove access to your location, camera, or microphone from websites that don’t genuinely need it.

How to reduce Chrome’s ad tracking

Chrome also includes advertising features that use browsing activity to group you into advertising interests. These settings are separate from the basic functions you need to browse the web.

Third-party cookies are one such source of persistent tracking. These cookies can be placed by companies that aren’t related to the website you’re visiting, such as advertising networks and social media companies. Because the same companies can appear across many different websites, their cookies can help connect activity from one site to another.

You can block third-party cookies by: Privacy and Security > Third-Party Cookies.

Chrome also offers a Do Not Track request, although websites don’t always honor it.

For an additional layer of privacy, you can set Chrome to clear cookies whenever you close the browser. The trade-off is that you’ll have to sign in to some websites more often.

Chrome gives you several ways to reduce how much information it collects, and changing a few settings can make a meaningful difference. But if you want to stop Google from collecting data through the browser entirely, Chrome may not be the right tool for you.

A different browser can give you more control over how your browsing data is handled. For Chrome users who want to stay put, though, reviewing these settings is a practical place to start.

Meta reaches $18 billion settlement over teen social media addiction claims

Proton Team — Wed, 26 Aug 2026 17:34:34 GMT

Meta has agreed to pay up to $18 billion and overhaul Facebook and Instagram to settle claims from 48 states, D.C. and U.S. territories that it engineered its platforms to hook young users.

The deal ends a federal trial in Oakland in which California, Colorado, Kentucky and New Jersey had sought roughly $200 billion in damages — a trial that was about to send CEO Mark Zuckerberg back to the witness stand.

The agreement, filed Wednesday morning in the U.S. Northern District of California, resolves claims that Meta built features designed to addict children and collected data from users under 13 without parental consent — all violations of federal child-privacy law and state consumer-protection statutes. Judge Yvonne Gonzalez Rogers is expected to approve it.

What the settlement says

The settlement outlines injunctive terms intended to protect teens from mental health harms, including:

A daily time limit of two hours for under-18s, liftable only by a parent, dropping to one hour if other platforms accept similar terms.
A usage block from midnight to 6 a.m. for under-18s, expanding to 10 p.m.–7 a.m. if other platforms follow.
Notifications silenced for under-18s from 10 p.m. to 7 a.m., and from 8 a.m. to 3 p.m. on school days between August 15 and June 15.
A ban on displaying like or reaction counts to under-18s, and a ban on cosmetic image filters.
An optional non-personalized feed that stops using an algorithm to target teens with endless-scroll content.
A requirement to respond to 90% of teen reports of potentially harmful content within six hours.
Robust age-assurance measures to detect under-18s, plus removal of users under 13.

Is $18 billion enough?

Proton’s Big Tech Fines tracker, which has been compiling regulatory penalties since 2022, shows that Alphabet, Apple, Meta and Amazon together racked up roughly $7.8 billion in fines in 2025 alone for privacy and competition violations. Meta’s $18 billion settlement now outstrips the four companies’ entire 2025 penalty bill, and more than doubles Meta’s own prior annual fine totals.

Measured against free cash flow, however, the four firms could have cleared that full $7.8 billion in about 28 days and 48 minutes. The story remains largely the same today. Meta’s stock rose 2.3% following news of the settlement, according to Reuters, adding roughly $33 billion in market value to the company.

Penalties are being treated as a cost of doing business rather than a mechanism that actually changes behavior.

Now the real test begins

On paper this might look like accountability. In practice, however, it is a clear win for Mark Zuckerberg and the $1.5 trillion company he controls. Prosecutors were seeking $200 billion. Meta will pay $18 billion, admit no wrongdoing, and agree to a set of product changes that are largely cosmetic.

The diagnosis in the claims is real, and that matters. It puts on the record that Meta, like Google and TikTok, has put ad revenue and engagement ahead of its users’ best interests, building addictive products, and harvesting data at massive scale.

But a diagnosis is not a treatment, and this settlement does nothing to change a business model that prioritizes revenue over the wellbeing and privacy of its users. The real test is whether the rules actually change, and whether “cost of doing business” ever stops being an acceptable answer for the damage done to kids.

For families concerned about the impact of social media on their children, our guide to keeping kids safe online is a good place to start.

How to scan a document on iPhone

Tom Odlin — Wed, 26 Aug 2026 12:28:59 GMT

You don’t need a scanner to turn paperwork into a PDF. Chances are, you already have one: Your iPhone has document scanning built into several apps, including Notes and Files. Starting with iOS 26, you can also scan documents with Preview. Whichever app you pick, scanning a document on an iPhone takes just a few taps.

The best way to scan a document largely depends on what you’re scanning and why. Receipts and meeting notes might not contain much sensitive information, but passports, contracts, tax records, medical documents, invoices, and business paperwork do. In business settings, a leaked copy doesn’t just expose you; it can breach client confidentiality, violate a contract’s data-handling terms, or create liability for your organization.

For sensitive documents, Proton Drive lets you scan and save directly to end-to-end encrypted cloud storage, then share them securely, without handing a copy to Big Tech.

4 ways to scan a document on your iPhone
How to scan a document on iPhone using Notes
How to scan a document to PDF using Files
How to scan a document on iPhone using Preview
How to securely scan a document with Proton Drive
Can you scan multiple pages into one PDF on iPhone?
Tips for getting a clear document scan
Is the iPhone’s built-in document scanner safe to use?
Scan sensitive documents with Proton Drive

4 ways to scan a document on your iPhone

Method	Best for	Setup	Encryption
Notes	Quick scans and signatures	Already on your iPhone	Standard iCloud encryption; Apple holds the key by default
Files	Creating a standalone PDF	Already on your iPhone	Standard iCloud encryption; Apple holds the key by default
Preview	Scanning and working with PDFs	Already on your iPhone, starting with iOS 26	Standard iCloud encryption where Apple holds the key by default, unless saved elsewhere
Proton Drive	Secure scanning, storing, and sharing documents	Free app download	End-to-end encrypted by design, only you hold the keys

How to scan a document on iPhone using Notes

Apple Notes has a built-in document scanner, starting with iOS 26. To scan a document:

Open Notes and create a new note or select an existing one.
Tap the Attachment button, then Scan Documents.

Let your iPhone capture the page automatically, or switch from Auto to Manual and tap the Shutter button. Adjust the corners if necessary and tap Keep Scan.
Scan any additional pages.
Tap Done. The scanned document is saved as a PDF inside the note.

How to scan a document to PDF using Files

The Files app is a good option if you want to create a PDF and save it directly to a folder rather than keep it inside a note. To scan a document:

Open Files.
Navigate to the location or folder where you want to save the scan.
Tap the More (…) button.
Select Scan Documents.

Let your iPhone capture the page automatically, or switch from Auto to Manual and tap the Shutter button. Adjust the corners if necessary and tap Keep Scan.
Scan any additional pages.
Tap Done, choose where you want to save the PDF, then tap Save.

How to scan a document on iPhone using Preview

If you’re using iOS 26 or newer, Apple’s Preview app creates a PDF that you can then rename, annotate, fill out, sign, or share. To scan a document:

Open Preview.
Tap Scan Documents.

Let your iPhone capture the page automatically, or switch from Auto to Manual and tap the Shutter button.
Scan any additional pages. Tap a page thumbnail if you want to adjust its appearance.
Tap Done.

How to securely scan a document with Proton Drive

Scanning with Proton Drive is quick and straightforward. Pages are detected and captured automatically, and you can crop, rotate, apply filters, or add more pages before saving. The app only receives access to the pages you choose to keep, and nothing else from your camera roll.

To scan a document in Proton Drive:

Get Proton Drive for iOS.
Sign in with your Proton Account. You can start with 5GB free.
Go to Files and open the folder where you want to save your scan.
Tap + in the top-right corner and select Scan document. Allow camera access if prompted.

Position the document in the viewfinder. Proton Drive automatically detects and captures the page, or you can switch to manual capture.
Scan any additional pages. You can retake or delete scans, apply filters, rotate pages, and adjust the document edges.
Tap Save. Your scan is saved as an end-to-end encrypted PDF in Proton Drive.

You can keep the scanned document safely stored to end-to-end encrypted cloud storage, knowing that no one can access it but you — not even us. If you decide to share the scan with someone, you can invite people by email or create a sharing link with password protection and an expiration date. Recipients don’t need a Proton account to view or download your shared links, and they can even upload their own files to your cloud storage.

Can you scan multiple pages into one PDF on iPhone?

Yes. Notes, Files, Preview, and Proton Drive all let you capture multiple pages during the same scanning session. Keep scanning until you have captured every page, review them in the correct order, then save the document. Your pages will be combined into a single PDF.

Tips for getting a clear document scan

Your iPhone can automatically detect, crop, and straighten documents, but a few simple steps can help produce a cleaner scan:

Lay the document flat. Creases or curled edges can make the page harder to detect and can distort the text.

Use bright, even lighting. Shadows can obscure text and interfere with automatic edge detection.

Use a contrasting background. A white sheet of paper is easier to detect against a darker surface than another white surface.

Keep your iPhone parallel to the page. Scanning at an angle can distort the document.

Check the edges. A bad crop can cut off text, signatures, or other important details.

Use a filter when necessary. A black-and-white or high-contrast filter can make faded documents easier to read.

Review every page. Make sure important details such as names, numbers, and signatures are visible.

Check the finished PDF. Confirm every page has been saved, appears in the right order, and is readable.

Is the iPhone’s built-in document scanner safe to use?

For everyday paperwork, Apple’s built-in scanners are convenient. For more sensitive documents, it’s worth considering how the finished file is stored and shared. Scans stored in iCloud Drive or Notes are encrypted, but Apple retains the encryption keys by default, meaning the company can technically access them, including in response to a legal request. Apple’s Advanced Data Protection (ADP) can close this gap, but it’s off by default and not available to all users, such as in the UK.

If the idea that someone else could look through your scans doesn’t sit right with you, a secure-by-default option like Proton Drive is worth switching to instead.

Scan sensitive documents with Proton Drive

Proton Drive protects scanned PDFs with end-to-end encryption, which means no one can access your sensitive data besides you and those you choose to share it with, not even Proton. You can also share documents using password-protected or expiring links and easily revoke access later. If you’re scanning on behalf of your company, our cloud storage for business extends the same protection to team storage and sharing.

Start with 5GB free View plans

Nonprofits say Microsoft locked them out of years of data

Edward Komenda — Tue, 25 Aug 2026 18:59:02 GMT

In 2013, Microsoft began offering its software free to nonprofits: Word, Excel, OneDrive, and the full Office 365 suite, at a time when tech companies, including Microsoft, were promoting their charitable giving.

Over the next decade, nonprofits built themselves up around that offer, storing donor records, grant applications, and years of institutional knowledge within the Microsoft suite.

Then, sometime in the past year, without most of them noticing, access to that data began to disappear.

A recent Slate report alleges that Microsoft’s wind-down of the free nonprofit grant left small organizations locked out of years of data, with little or no warning.

What sources are alleging

Ronald Khosla, who runs the environmental nonprofit Canopy, got an email in May 2025 warning that his organization’s Microsoft grant would be discontinued and his license would expire that October. When he renewed that October, though, Microsoft’s confirmation email said nothing about the phaseout, and told him he would retain access until October 4, 2026. He logged in that June to find years of files gone anyway. A Microsoft representative later told him roughly 171,000 nonprofits had lost their OneDrive data the same way, a figure relayed to Khosla by phone.

One source, who runs a child healthcare nonprofit, said he searched his organization’s email archives, including the spam folder, and found “zero notification” from Microsoft about the license termination. The operator of a disability services nonprofit told Slate it will take him and his mother “hundreds of hours” to recreate the instructional videos and documents they lost. Microsoft told Slate it “began notifying nonprofit customers in Spring 2025.”

The complaints are on Microsoft’s own platform, too

These allegations aren’t confined to one article. Nonprofit admins have posted the same complaint, data suddenly inaccessible after a licensing change, directly on Microsoft’s own Tech Community forums, in multiple threads.

Security researcher Kevin Beaumont, a former senior threat intelligence analyst at Microsoft, has separately flagged that Microsoft’s own notification emails often go unseen because they’re sent to admin accounts that aren’t set up to be monitored, which often land in the spam folder.

A free grant isn’t a backup plan

Whatever the exact numbers, the pattern alleged here is structural: Nonprofits built infrastructure around a single vendor’s free tier, with no easy export path or independent backup.

For nonprofits with budgets under $1 million (the majority of US nonprofits), the value of Microsoft’s free software equated to about 30% of their IT spending, according to Slate.

When that vendor changed course, the data went with it. A free grant is not a guarantee; it’s a product decision, reversible at any time, with an organization’s data as collateral.

The dependency problem isn’t unique to nonprofits either, as over 74% of publicly listed European companies depend on US tech like Microsoft and Google.

A special Proton offer for impacted nonprofits

Nonprofits affected by Microsoft’s rollback can now get Proton Drive free for the first year — for up to 20 users — then move to nonprofit pricing for subsequent years.

Every other Proton product, including the full Workspace suite covering Mail, Drive, Docs, VPN, Pass, and Calendar, is also available at nonprofit discount rates.

Both offers run through Proton’s sales team, and organizations applying will need to show proof of eligibility, that they’re a nonprofit and that they were affected by the Microsoft data loss.