Who holds the key to your mailbox?

Who can read your emails? With most providers: the provider itself. Encrypted mailboxes promise something different. Here is what they deliver and where the limits are, using Proton as an example.

With a regular mailbox, the provider holds the key

Even with a regular mailbox, emails are usually stored encrypted on the server. But the provider manages the key. It can technically read and search your emails, for search, spam filters or extra features.

When an authority arrives with a valid order, it can hand them over.

With an encrypted mailbox, the key stays with you

Encrypted mailboxes turn this around. The key is protected by your password, and only you know the password. The server only holds scrambled data. Proton calls this zero-access encryption: even the provider can’t get to the content.

When two Proton users write to each other, the email is also end-to-end encrypted, from the sender’s device to the recipient’s device. Nobody can read it in transit or on the server.

Technically, behind the “key”, Proton uses a private key based on the OpenPGP standard and the password that protects it.

Subject, sender and recipient stay visible

According to Proton, subject lines, sender and recipient addresses are encrypted, but not end-to-end encrypted. Who writes to whom, when and about what is therefore less protected than the content.

Emails to regular addresses, such as Gmail or Outlook, are not end-to-end encrypted either. Unless you protect the email with a password that the recipient receives through another channel.

Swiss law protects, but it is no free pass

Proton is based in Geneva and subject to Swiss law. Foreign authorities cannot force Proton to hand over data directly; Article 271 of the Swiss Criminal Code prohibits passing data directly to foreign authorities. They have to go through Swiss mutual legal assistance.

When a binding order under Swiss law arrives, Proton still has to provide data. In 2021, French police sent their request via Europol to the Swiss authorities. These required Proton to log the IP address of a French activist. Proton had to comply. The content of the emails stayed encrypted.

How often this happens is in Proton’s transparency report: in 2025, there were 9,301 orders for Proton Mail, of which 8,313 were complied with and 988 contested. Proton can hand over things like account details and activity logs, but no encrypted content.

The VÜPF revision is not in force, and Proton has reacted anyway

The Swiss ordinance on the surveillance of postal and telecommunications traffic (VÜPF) defines which providers have to assist with surveillance and how. The federal government wanted to tighten it. The draft failed in the 2025 consultation: the Greens, SP, GLP, FDP and SVP rejected it, as did industry associations and providers such as Threema and Proton.

Proton has already moved parts of its infrastructure abroad. First, in 2025, its AI assistant Lumo moved to servers in Germany; further locations are being set up in Norway.

As of 2 October 2026: the revision is not in force. On 11 February 2026, the Federal Council took note of the consultation results, commissioned a regulatory impact assessment and announced a second consultation once the revised version is ready.

Three questions for your mailbox

1. Who holds the key? You or the provider?
2. What is end-to-end encrypted? Only the content, or also subject and recipients? And does it apply to emails sent outside the service?
3. Which law is the provider subject to? And how does it handle orders, is there a transparency report?

My view

I’ve been using Proton for years, mainly for email, plus other services from the bundle. Not because it’s perfect. Metadata stays visible, and Switzerland can change its rules too.

But because the provider can’t read my content. For me, that is digital sovereignty in everyday life.