Proton CTO on building private software by default

Proton’s privacy pitch is a practical one: build products so they reveal as little as possible, then see whether that promise still holds when governments want access. For ordinary users, the tradeoff is immediate in email, cloud storage and workplace tools, where private design can limit exposure but only if the company’s architecture is built to keep secrets from the start.

How Proton built privacy into the product

Proton was born in Switzerland in 2014, when a team of scientists who met at CERN decided to build a better internet where privacy is the default. That origin matters because it frames the company less as a software vendor than as a project to make privacy a baseline setting across everyday digital life. Proton Mail is encrypted by default, and the company now extends the same idea through Proton VPN, Proton Calendar, Proton Drive, Proton Pass, Proton Docs, Proton Meet and SimpleLogin.

Bart Butler has been Proton’s CTO since 2015, and Proton’s speaker bio says he is one of the company’s first employees. The same bio says he is responsible for Proton’s technical vision and architecture, which puts him at the center of the company’s claim that privacy is designed into the system rather than added later as a feature. In a 2021 Proton video, Butler said, “It doesn’t matter who you are – you don’t want someone sifting through your life,” and he argued that email is less secure than many people think.

What privacy by default is supposed to do

Proton’s public-facing idea is simple: if privacy is the default, then the company should see less of what users send, store and share. That logic runs through products like Proton Mail and Proton Drive, and it is part of why Proton emphasizes end-to-end encryption as a core design principle. The more the service can keep content from being readable in the first place, the less it depends on goodwill alone.

That design philosophy also shapes trust in the company’s other products. Proton VPN says it is “No logs, no ads, open-source and independently audited,” a set of claims that matters because VPNs sit at the intersection of convenience and surveillance resistance. Proton’s privacy policy page, along with its transparency reporting and law-enforcement information pages, shows that the company knows user confidence depends on more than marketing language: it depends on clear rules for what the service can see, what it cannot, and how it responds when outsiders ask for data.

Where law and policy push back

The strongest test for any privacy company comes when law enforcement or policymakers want the data a company says it cannot easily provide. Proton’s public transparency materials and law-enforcement guidance are a sign that it expects those pressure points and wants users to see the process, not just the promise. That matters because privacy claims are easiest to make in theory and hardest to defend under legal compulsion.

Proton has also publicly leaned on Swiss law and encryption in especially sensitive situations. The company published a blog post titled “Swiss laws and encryption protect Proton users from abortion,” making clear that it sees reproductive health data as one of the areas where privacy can have direct consequences. That is not an abstract policy debate: a search, a message or a file can become evidence of someone seeking care, and the risk lands hardest on people whose safety, dignity or access to services depends on keeping information private.

The public health stakes reach beyond one issue. Sensitive health information can expose people to stigma, discrimination or surveillance, especially when the legal environment is unsettled or hostile. That is why privacy tools are increasingly discussed not just as consumer conveniences but as infrastructure for journalism, activism and everyday digital freedom.

Why the product mix matters for trust

Proton’s growing suite changes the privacy question from “Can this company protect my inbox?” to “Can it protect the rest of my digital life too?” Email, calendar, cloud storage, password management, document editing and meetings all carry different kinds of risk, but users now expect the same basic standard across all of them. If one service in that stack leaks more than it should, the trust problem spreads quickly.

That is why the company’s architecture and ownership choices matter as much as its product names. Proton says its products are built around privacy by default and end-to-end encryption, and Butler’s role as technical lead ties those promises to product design rather than to after-the-fact policy fixes. In a market where email, cloud storage and workplace communications often trade on convenience first and privacy second, Proton is trying to make the opposite case: that the safest systems are the ones that expose the least data in the first place.

The broader lesson is straightforward. Privacy companies can only keep their promises if the software, the legal posture and the public documentation all line up when pressure arrives. Proton has built its identity around that test, and the next challenge is whether the design holds when the questions come from courts, regulators and the people whose most sensitive information is on the line.