The Proton Blog

Email filters explained: These best practices will help you stay organized at work

Edward Komenda — Tue, 21 Jul 2026 18:26:01 GMT

If your inbox is full of emails you’ll never read, then you know how hard it can be to find the one email you’re looking for. As you file through subject lines, straining your eyes, you recognize that feeling of dread. You could simply end the problem by deleting all of your messages, but this would haunt you later. You could spend hours unsubscribing and deleting mindlessly, but this would eat up valuable hours of your workday.

There’s an easier way: Email filters streamline your correspondence, organizing your inbox so that you save time and can focus on what matters (instead of poring over email blasts from Foot Locker). But how exactly do you set up a filter for email and better manage your inbox?

In this article, you’ll learn what email filters are, how they work, and how to use them effectively to improve your email organization for good.

What are email filters?

Email filters are labels that you assign to incoming emails to automatically sort your inbox. They work by scanning, or filtering, an email’s subject line or sender address, and by looking for specific keywords and attachments. Once a filter is set, emails are labeled, sorted, or deleted, based on the criteria you’ve applied.

For those who run a small business, email filters are especially helpful. A well-built filter for email makes inbox organization easy by removing unnecessary clutter and preventing important emails from falling through the cracks. Not only do they make email management easier, but they save you and your employees time by automating repetitive tasks that you would have to do by hand — a habit that also helps you get closer to inbox zero.

Email spam filters also help detect spam messages, reducing your risk of becoming a phishing victim or accidentally downloading malware.

How email filters work

Email filters work by scanning an email for certain criteria that you have set. These criteria can include sender name or email address, subject, specific keywords, and more. Once you’ve set the criteria for your filter, you can select what action Proton takes when a message meets that criteria. For example, you can set your filter action to archive emails that meet the filter’s parameters, mark as read, apply a label, delete, mark as important, and more.

In addition to the filters that you set, Proton Mail’s smart spam filters detect spam and learn how to spot spam emails the more you click “Move to spam” or mark your emails as safe. The more you use Proton, the more our smart filters learn how to create new filters and rules based on your actions. You can also whitelist trusted senders or block unwanted addresses outright so your email spam filters know exactly what to catch and what to let through.

How to organize email with filters

Wondering how to organize email once and for all? Start by building filters around the categories that already exist in your inbox: newsletters, receipts, client threads, internal memos. From there, layer in folders and color-coded labels so every filtered message lands somewhere useful instead of just out of sight. For more ideas, check out these tips to declutter your inbox and keep it that way.

Good email organization is an ongoing system, not a one-time project. Once your filters are in place, revisit them periodically as your inbox habits change, and let Proton’s spam filters keep doing the heavy lifting in the background.

How to create custom email filters with Proton

You can create a filter and easily automate your email labels with Proton in two ways. The first is a quick way to automate labels directly from your email window, and the second is a more in-depth way to create custom filters via your settings, where you can set specific requirements and keywords.

From your email window:

1. Sign in to your inbox at mail.proton.me.

2. Open an email, then move or label it as usual.

3. Check the box that says “Always move sender’s emails/Always label sender’s emails” and select the “Move” or “Label” button to automate your filter preferences.

From your settings:

Select Settings → All settings → Proton Mail → Filters

Under Custon filters, Click “Add filter.”

Name your filter and select “Next.”

Add the criteria you want to activate the filter. You can choose to filter emails when only certain conditions are met, or when all requirements are met.
Click “Insert” to add additional text or keywords to your filter.

Select “Add condition” to create a complex filter. You can include as many conditions as you like.
Select “Next” to set the actions that will apply to your new email filter.

How to use filters to organize your inbox and boost productivity

Email filters can keep unwanted messages out of your inbox, block spam, and organize your inbox into categories for a more efficient workflow. When setting up your filters, you can follow these tips and best practices to create the most streamlined inbox for increased productivity.

Categorize your business emails by project, sender, work department or priority.
Use color-coded labels and folders for better visual awareness.
Create “Follow-up” folders for emails you need to circle back on, or “Reply later” folders so important emails don’t get lost.
Set up a filter that automatically archives old messages.
Update and review your filters regularly to see what works for you.
Don’t accidentally hide important emails by using too many filters.

Keep your inbox organized with Proton

Proton Mail doesn’t only help with email organization; it also keeps your data safe by ensuring that your private messages aren’t accessible to anyone but you. That’s because Proton Mail is end-to-end encrypted, which means you’ll never have to worry about us scanning your emails and selling your sensitive information to third parties.

Filters help manage email overload, save time, and improve communication flow — and using them doesn’t need to be complicated. With Proton Mail, setting up a new filter is easy.

Learning how to use filters is the simplest way to take back control of your inbox, and with additional features like one-click unsubscribe, Newsletters view, Categories view, and Hide-my-email aliases, Proton Mail’s inbox organization goes above and beyond.

If you’re ready to take control of your email workflow — and your privacy — sign up for free email with Proton Mail today.

What does Google know about you? The chilling truth

Edward Komenda — Tue, 21 Jul 2026 17:33:22 GMT

Ask the question “What does Google know about me,” and the answer may shock you.

It knows a lot. It knows where you’ve been on the internet and where you’ve been in real life too. And if it knows that much about one person, it knows that much about everyone.

Take what people look up on the internet. Google’s web browser sends anything typed into the search bar to a Google server in real time, even in incognito mode and before you hit Enter.

When it comes to private Gmail conversations exchanged with friends, family, or anyone else, Google scans every single one. Depending on how you use AI inside Gmail, you may inadvertently add your sensitive messages to Gemini, which can be used for AI training.

As for the routes you take using Google Maps, Google saves and tracks every location, including the date and time you traveled.

Even for those who try to avoid using Google, its services are intertwined in the internet. Over half of all websites use Google Analytics, which captures information from web or app visits — meaning Google can track and gather data on people even if they don’t use Google’s search engine or Chrome browser.

That question alone is reason enough to dig deeper into just how much this Big Tech company knows about you and what your data is worth to Google.

Understanding Google’s reach
How to find out what Google knows about you
Google knows things you never shared
The link between surveillance capitalism and Google
Google’s ad system is designed this way on purpose
Leave Google behind, starting with email

Understanding Google’s reach

This list of things Google knows about you is extensive. The company actively acquires and knows the following:

Calendar, including your schedule, appointments, meetings, who they’re with, and where

Web and app activity, including the websites you visit, the apps you use, and how often you’re on them

Photos, including where they were taken and who else appears in them, such as children

Documents, including the way you write and the topics you write about

Internet search history, including what you type but change your mind about and don’t get to actually run a search

Emails, including unsent ones sitting in drafts

Your voice: Google knows how you sound and the way you talk if you use Google Home, Nest, or any other Google Assistant-branded apps.

Maps history (also known as timeline), including where you go and when

YouTube search and watch history: Your searches (from cooking videos to tutorials on how to change a tire) create a vivid profile of you. Time spent on each video is also tracked.

When this list is taken together, Google can make a ton of assumptions and draw a lot of conclusions about you. The emergence of AI like Gemini only helps the company make connections faster and build a detailed profile about your life and connections, even if the people around are not active online.

How can you find out what Google knows about you?

You can’t type “What does Google know about me?” into Google and expect an accurate answer. But you can take steps to understand the depth of what Google knows about you so you can better control your data and privacy. After all, you can only understand what you know — and Google is betting that the majority of its users won’t take the steps to find out.

Go to your profile and click Manage Your Google Account. On the left side, you’ll see a menu of options on the left — click Data and privacy. Here are a couple of good places to start.

Here you’ll see just about everything — and yes, we mean everything — that you’ve been up to on the internet while connected to your Google account. You can browse your web and app activity, look at where you’ve been on Google Maps, get a complete backlog of every YouTube video you’ve ever watched (down to the day), and more.

Health and voice data

If you use a smart watch, Fitbit (which was acquired by Google in 2021), or any other wearable device to monitor your physical statistics, it’s likely synced with Google Fit or Google Health. While these must be enabled for your health tracker to work, you should always consider whether you want Google to know details about your health, including your weight, menstrual data, heart rate, activity level, sleep cycle, and steps for the day.

Voice Match is Google’s way of recognizing your voice across its Google Home products. Your voice can be as personal as a thumbprint, and allowing Google access to your voice helps it train AI and adds to the plethora of sensitive data Google can use to identify you.

Download your data

Want the answer to “What does Google know about me?” Downloading your data is the best way to see everything that Google has collected about you. Keep in mind, the document will be large and you may have a lot to sift through. Go to the Google Dashboard (under Data & Privacy) and click Download your data to request the information.

Google knows things you never shared

When one Proton employee asked “What does Google know about me?”, she found that Google knew things she never personally told it and that it was learning things about her in real time.

It knew that she was recently single, even though she had never selected this option. It knew her income bracket, where she lived, that she doesn’t have kids, and that she was renting an apartment — all without her touching a single button.

When she looked at her timeline, she could see every destination she’d traveled while using Google Maps.

How to stop targeted ads

To stop targeted ads, head to myadcenter.google.com and turn personalized ads off (top right corner).

Next, go to myactivity.google.com and turn off tracking for Web & App Activity, Timeline, Play History, and YouTube History.

You can also access your Data & privacy settings by clicking your Google Account icon → Manage your Google Account → Data & privacy.

The link between surveillance capitalism and Google

Google isn’t just a tech company with a search engine. It’s an advertising juggernaut. Google explains it this way:

Google’s main source of revenue is from ads on our own sites and apps. Advertisers tell Google the types of audiences they want to reach, and we try to show their ads to people in those groups. Each of Google’s products and services show ads in different ways to help reach new and existing customers.

By amassing thousands of data points on nearly everyone in the world, Google has extended its reach: Essentially, Google has so much data on us that it has become the largest engineer of the ad surveillance industry.

Google gives its users the illusion of choice, and, therefore, the illusion of a better online experience. Take the wording of Google’s “personalized ads” philosophy. Through friendly language, the company encourages you to make “your ads more relevant by letting Google know what you’d like to see more or less of.” This is Google’s way of making targeted ads sound like a free service you’re receiving, rather than a way to use information about you — your location, sexual orientation, hobbies, and income bracket — to influence your decisions.

Google’s ad system is designed this way on purpose

Let’s examine this line: “Advertisers tell Google the types of audiences they want to reach, and we try to show their ads to people in those groups.” It sounds harmless, but it isn’t.

Google uses a system known as “real-time bidding” (RTB) to auction off your data to the highest bidder.

Here’s how it works: First, Google builds an in-depth profile on you using your data. Then, it broadcasts that data to thousands of companies that compete in an auction to buy ad space, which will appear as a targeted ad on your computer screen.

This raises serious risks. Because your data is being exposed to thousands of advertisers in a matter of nanoseconds, it could also fall into the hands of data brokers, cybercriminals, or the US government.

“Each time you see a targeted ad, your personal information is exposed to thousands of advertisers and data brokers,” writes Lena Cohen from the Electronic Frontier Foundation. “This process does more than deliver ads — it fuels government surveillance, poses national security risks, and gives data brokers easy access to your online activity.”

Leave Google behind, starting with email

Every piece of personal data that Google touches, from searches and email to location history and voice, routes back to one place: your Google account. That’s what makes it so valuable to Google and so risky for you. A single login ties your entire digital footprint into one profile, which is exactly why deleting your Google account, deGoggling, and switching to privacy-first alternatives is a great way to become safer online.

The best place to start is email. Your inbox isn’t just where your messages live but the master key to your digital life, linked to your bank, subscriptions, social media, and work accounts. Whoever controls your email can reset your passwords and piece together a detailed picture of who you are.

Proton Mail is a natural first step away from Google. It protects your messages with end-to-end encryption and zero-access encryption, which means we never have access to your data and can’t scan it to build behavioral profiles, show ads, train AI models, or share it with third parties — and we don’t want to.

Create a free account

How to disable OneDrive: A complete guide

Greg Ng — Mon, 20 Jul 2026 20:37:38 GMT

OneDrive comes preinstalled on Windows and, in many cases, starts syncing your files the moment you sign in — quietly uploading documents, photos, and desktop folders to Microsoft’s cloud without much explanation.

If you’re not comfortable with how Microsoft handles your data, there are several ways to rein it in, from pausing sync temporarily to uninstalling OneDrive and blocking it entirely through Group Policy. This guide walks through each method and explains why you might want to disable OneDrive in the first place.

How to uninstall OneDrive on Windows
How to disable OneDrive from Group Policy Editor (and block reactivation)
How to disable OneDrive at startup
How to stop OneDrive from syncing
- Temporarily
- Permanently (unlink account)
How to remove OneDrive from File Explorer
Why you should disable OneDrive
Switch to a private cloud storage

How to uninstall OneDrive on Windows

Uninstalling OneDrive will not delete any files on your computer, and anything uploaded to the cloud can be accessed using the OneDrive web app.

OneDrive has been known to reappear and re-enable itself after major Windows updates. Some users have found success in keeping it from coming back by unlinking their accounts before uninstalling.

Here’s how to uninstall OneDrive on Windows:

Click Start.
Find and open Add or remove programs.
Select Microsoft OneDrive.
Click Uninstall and then Uninstall again to confirm.

How to disable OneDrive from Group Policy Editor (and block reactivation)

A more advanced way to prevent OneDrive from running or syncing is to block it in Group Policy Editor. Unlike unlinking (which you can redo by signing back in) or uninstalling (which removes the app but leaves it reinstallable), the Group Policy setting blocks OneDrive from syncing at all on that computer at the policy level — the app stays installed but can’t be used, and a standard user has no way to re-enable it through the graphical interface. Note that this method is only available on Windows Pro, Enterprise, and Education editions.

Press the Win + R keys on your keyboard to open the Run dialog box.
Type GPedit.msc and press Enter to open the Group Policy Editor.
Navigate to Local Computer Policy → Computer Configuration → Administrative Templates → Windows Components → OneDrive.
Double-click the policy named Prevent the usage of OneDrive for file storage.

Local Group Policy Editor highlights the “Prevent the usage of OneDrive for file storage” setting

Select Enabled, then click OK.
Restart your computer.

How to disable OneDrive at startup

You can prevent OneDrive from launching automatically whenever you start Windows:

Press the Ctrl + Shift + Esc keys to open Task Manager.
Go to Startup apps tab (Startup on Windows 10).
Right-click Microsoft OneDrive and select Disable.

How to stop OneDrive from syncing

If you want to keep OneDrive installed but stop it from syncing your files, you have a few options.

Temporarily pause OneDrive syncing

You can temporarily pause OneDrive syncing for 2, 8, or 24 hours. Syncing resumes automatically after the time you selected elapses — or manually if you unpause it in the meantime.

Click the OneDrive cloud icon in the system tray (bottom-right, near the clock).
Open Help & Settings ⚙ → Pause syncing.
Select 2 hours, 8 hours, or 24 hours.

The OneDrive cloud icon will now display a paused icon. If your computer is in battery saver mode, OneDrive automatically pauses syncing.

Permanently stop OneDrive syncing (unlink account)

Unlinking your PC from your OneDrive account will permanently stop Microsoft’s cloud storage service from syncing. Files that have been uploaded will remain in the cloud and on your computer; they will not be deleted.

Click the OneDrive cloud icon in the system tray (bottom-right, near the clock).
Open Help & Settings ⚙ → Settings ⚙.

Go to Account, click Unlink this PC, and then Unlink account to confirm.

To access your OneDrive files after unlinking your PC, sign in to the OneDrive web app.

How to remove OneDrive from File Explorer

To remove OneDrive from File Explorer without uninstalling it, you can simply hide it. This is useful if you have unlinked your account and do not want OneDrive to be visible anymore.

Open File Explorer.
Right-click OneDrive and select Properties.
In the General tab, find Attributes and check Hidden.
Click OK.

Why you should disable OneDrive

Cloud storage is convenient, but if you’re mindful of your privacy or are handling sensitive files, storing them on OneDrive means accepting some trade-offs that you may not be aware of.

No end-to-end encryption: The files you store on OneDrive are encrypted in transit and in rest, but they are not end-to-end encrypted. It means Microsoft holds the encryption keys, so the company has the technical ability to scan or access your files.

Your files can be exposed: Without end-to-end encryption, they remain vulnerable if the infrastructure storing them is breached. The SharePoint attack showed how attackers can access sensitive documents and encryption keys — and OneDrive for Business relies on SharePoint’s underlying technology.

Your data is shared with third parties: Microsoft’s privacy policy permits sharing your data with third parties and doesn’t explicitly rule out using it for advertising. The company already shares Outlook data with over 800 external advertising partners, and there’s no assurance OneDrive is treated any differently.

AI training terms are ambiguous: Microsoft says that Copilot (its AI assistant) doesn’t train on your documents, but the company’s broad privacy policy acknowledges that your personal data may be used to improve its AI models. Where “documents” end and “personal data” begins is not clearly defined, and that ambiguity traditionally works in Big Tech’s favor.

Word documents upload to OneDrive by default: Microsoft rolled out a change that makes Word (plus Excel and PowerPoint) save new documents to OneDrive by default, instead of to your local desktop. This means docs you consider confidential may end up processed under OneDrive’s privacy policy, which Microsoft can change anytime.

US surveillance risks: Unlike European cloud storage providers, OneDrive is owned by a US company subject to American surveillance laws. Combined with the lack of end-to-end encryption, this means Microsoft can be legally compelled to hand over any information it has about you to government agencies or law enforcement — in some cases, without a warrant, under laws like Section 702 of FISA, no matter where you live.

Switch to private cloud storage

Disabling OneDrive doesn’t mean you have to give up on cloud storage. Proton Drive is secure cloud storage that protects your files, photos, documents, and spreadsheets with end-to-end encryption and Swiss privacy laws, outside of US jurisdiction.

No one can access your files but you and the people you choose to share them with — not even us. We never show ads, use your data for AI training, or share it with anyone. All Proton Drive apps are independently audited and open source, so anyone can check our codebase.

For organizations seeking a private OneDrive alternative that doesn’t look at your team’s data, our business cloud storage solution extends the same end-to-end encryption to your whole team, alongside ISO 27001 certification and SOC 2 Type II attestation, with compliance support for regulations like HIPAA and GDPR built in.

Start with 5 GB free View plans

Moving your files over from OneDrive takes just a few simple steps.

How to turn off Apple Intelligence on iPhone, iPad, and Mac

Greg Ng — Mon, 20 Jul 2026 17:41:29 GMT

Apple Intelligence is Apple’s built-in generative AI system designed to help you write, summarize, create images, use Siri, and complete tasks across Apple devices. It is enabled by default on compatible devices and runs across more of your experience than you might realize — from notifications to calls and messages.

If you prefer to limit these features for privacy, reduce distractions, or have more control over how AI is used on your device, you can turn off Apple Intelligence.

How can you turn off Apple Intelligence?
How to turn off Apple Intelligence via Screen Time
How to turn off Apple Intelligence in Settings
How to disable Apple Intelligence features
Why you should disable Apple Intelligence
Choose AI that keeps you in control
Frequently asked questions

How can you turn off Apple Intelligence?

There are two main ways to disable Apple Intelligence: through a Settings toggle or several Screen Time restrictions:

The Settings toggle switches Apple Intelligence off entirely, in one step, so it is the fastest option if you just want it gone. But it does not remove some AI elements from the interface — they become non-functional but can add clutter to your Apple experience.
Screen Time restrictions let you block specific features (like Image Creation and Writing Tools) individually, and they also strip away the related icons and menu options.

If you want all AI elements powered by Apple Intelligence gone from your interface, Screen Time is the better route.

How to turn off Apple Intelligence via Screen Time

In Screen Time, you can block specific Apple Intelligence features at the system level, including interface elements like the Genmoji picker and Writing Tools. This is the most thorough way to remove Apple Intelligence from your device, including any leftovers.

On iPhone and iPad

Open the Settings app.
Go to Screen Time → Content & Privacy Restrictions.

Toggle on Content & Privacy Restrictions and tap Intelligence & Siri.

Select each feature below and change its setting to Don’t Allow:
- Image Creation — It controls access to Genmoji (creates custom emoji from a description), Image Playground (creates images from descriptions, themes, or people in your photo library), and Image Wand (turns sketches or surrounding content in Notes into generated images).
- Writing Tools — It includes AI composing, proofreading, and rewriting features in most places you can type, including many third-party apps and websites.
- Intelligence Extensions — It allows the use of third-party AI integrations, such as ChatGPT.

On Mac

Click the Apple icon in the menu bar, then select System Settings.
Go to Screen Time → Content & Privacy.

Toggle on Content & Privacy and select Intelligence & Siri.

Toggle off Image Creation, Writing Tools, and Intelligence Extensions and click Done.

These changes may take a while to come into effect, and you may need to restart your device or affected apps.

How to turn off Apple Intelligence in Settings

If you want to disable Apple Intelligence without removing its interface elements, you can do so directly in Settings. This is a quicker method, though it won’t strip features like Genmoji from the interface. Additionally, some features like Call Screening are managed independently of this toggle and will have to be disabled separately.

On iPhone and iPad

Open the Settings app.
Tap Apple Intelligence & Siri.
Toggle off Apple Intelligence.

On Mac

Click the Apple icon in the menu bar, then select System Settings.
Click Apple Intelligence & Siri.
Toggle off Apple Intelligence.

How to disable Apple Intelligence features

You can turn off Apple Intelligence features, one at a time:

Turn off Visual Intelligence

Visual Intelligence analyzes content on your iPhone’s screen and can use your camera to analyze your physical surroundings. With this feature, you can identify plants and animals, translate text in real time, and look up business details. You can launch it using Camera Control on supported iPhones, from a screenshot, or through a shortcut added to the Lock Screen, Control Center, or Action Button.

Unfortunately, there is no way to disable Visual Intelligence alone, so you need to disable Apple Intelligence in Settings. Alternatively, you can reduce the chance of accidental activation by removing Visual Intelligence shortcuts and disabling Camera Control.

Here’s how to disable Camera Control:

Open the Settings app.
Go to Accessibility → Camera Control.

Toggle off Camera Control.

Here’s how to disable automatic Visual Intelligence suggestions on screenshots:

Open the Settings app.
Go to General → Screen Capture.
Toggle off Automatic Visual Look Up. If Apple Intelligence was already turned off, this setting will not appear.

Turn off the ChatGPT extension

When Apple Intelligence and Siri can’t answer a question, it may offer to send your query to ChatGPT. While this expands on what Apple Intelligence can do, queries sent via this extension are processed by OpenAI, meaning your data leaves Apple’s ecosystem and is subject to ChatGPT’s privacy policy instead.

If you prefer to keep your queries within Apple’s infrastructure, here’s how to disable the ChatGPT extension:

Open the Settings app.
Go to Apple Intelligence & Siri → ChatGPT Extension.
Toggle off Use ChatGPT.

Turn off Call Screening and Hold Assist

With Call Screening, Apple Intelligence automatically answers calls on your behalf, prompts the caller to state their name and reason for calling, and displays a live transcript on your screen so you can decide whether to pick up. Hold Assist detects when you’ve been placed on hold and monitors the call in the background, notifying you when an agent is available.

Both features require Apple Intelligence to process phone call audio, which Apple claims happens on-device.

Here’s how to turn off Call Screening and Hold Assist:

Open the Settings app.
Select Apps → Phone.
Toggle off Hold Assist Detection.

Under Screen Unknown Callers, select Never.

Turn off Genmoji

There is no standalone setting to disable Genmoji, but you can do so via either of the following methods:

Disable Image Creation via Screen Time. This removes Genmoji from all interface elements, while allowing you to continue using Writing Tools and Intelligence Extensions. Note that all image creation features, including Image Playground and Image Wand, will also be disabled.
Disable Apple Intelligence via Settings. This turns off all AI features but leaves Genmoji visible in the interface.

Writing Tools

Like Genmoji, there is no standalone setting to disable Writing Tools. You can:

Disable Writing Tools using Screen Time. This removes Writing Tools across your device while keeping other Apple Intelligence features enabled.
Disable Apple Intelligence via Settings, which turns off all AI features but leaves Writing Tools visible in the interface.

Why you should disable Apple Intelligence

Apple Intelligence integrates deeply into how your device works, which can have a range of privacy and experiential concerns. Here are a few reasons you might want to dial it back:

Reclaim storage space: As part of Apple’s privacy-driven approach, AI models are downloaded locally to enable on-device processing. The trade-off is that they require a massive amount of available storage. Currently, Apple Intelligence requires at least 7GB of free storage on each device to run, and it is likely to increase as more features and updates are rolled out.

Limit AI access: Even with on-device processing, Apple Intelligence still touches a significant amount of your personal activity. Visual Intelligence can scan your screen, Call Screening listens to phone calls, and Writing Tools processes your text. Turning off features you don’t want means less of your data is shared with AI.

Prevent third-party data sharing: While most of Apple Intelligence is built within the Apple ecosystem, features like the ChatGPT extension require sending your queries to OpenAI. Third-party sharing means you’re handing data over to yet another company, and you cannot guarantee that they share Apple’s privacy policy. With more AI integrations coming to Apple Intelligence, a simple first step to protecting your data is to disable Intelligence Extensions.

Conserve battery life: This one’s anecdotal but worth mentioning. Some users report noticeable battery drain when Apple Intelligence is active, particularly with background features running. Disabling AI features you don’t need may help extend battery life, though results will vary by device and usage.

Choose AI that keeps you in control

Disabling Apple Intelligence gives you back control over what runs on your device and what accesses your data. But it also leaves a gap — you lose writing assistance, smart suggestions, and other features that can genuinely be useful day to day.

If you want the benefits and conveniences of AI without trade-offs, Proton’s AI assistant, Lumo, is built on the same privacy-first principles that underpin all of Proton’s products. Lumo doesn’t log your data or build a profile on you, doesn’t share your data with third parties, and never ties your conversations to advertising. You can use Lumo on all your devices, including a web app for Mac and a native iOS app, so you can get reliable AI assistance anytime, anywhere.

Chat with Lumo

Frequently asked questions

Which devices support Apple Intelligence?

Apple Intelligence is available on:
• iPhone: iPhone 15 Pro, iPhone 15 Pro Max, all iPhone 16 models, and later
• iPad: iPad mini (A17 Pro) and iPad models with M1 chip or later
• Mac: Any Mac with Apple Silicon (M1 or later)
• Apple Vision Pro
• Apple Watch: Series 6 and later, all Ultra models, and SE 2 and later. Your watch must be paired with an Apple Intelligence-enabled iPhone.

Your device also needs at least 7GB of available storage, and your device language and Siri language must be set to the same supported language. Apple Intelligence availability also varies by region. Most features are available in the EU on supported devices, but some restrictions apply. In China, Apple Intelligence is currently unavailable entirely.

Is Apple Intelligence always on?

Apple Intelligence is enabled by default, but not all features run constantly. Notification summaries and smart suggestions are always active when enabled. Others, like Visual Intelligence, are only active when you trigger them. To stop Apple Intelligence from running in the background, you will need to disable it via Settings or using Screen Time.

Will turning off Apple Intelligence break Siri?

No, Siri can work independently of Apple Intelligence. Disabling Apple Intelligence will revert Siri to its original functionality, so you can use voice activation, make calls, and more as you always have. Features affected by turning off Apple Intelligence include the ability to send your query to ChatGPT, writing help, and other AI-powered features.

Can you turn off Apple Intelligence on Apple Watch?

Yes, but not directly. Since the Apple Watch mirrors the settings of a paired iPhone, disabling Apple Intelligence on your phone will also disable it on your Apple Watch.

Can you turn off Apple Intelligence on Apple Vision Pro?

Yes, you can. Turning off Apple Intelligence on Vision Pro follows essentially the same steps as for iPhone, iPad, and Mac:
1. Open the Settings app.
2. Select Apple Intelligence & Siri.
3. Toggle off Apple Intelligence.

You can also use Screen Time to fully block Apple Intelligence. Just follow the same steps as for iPhone, iPad, and Mac.

Cyber insurance for small businesses: what you need to know before buying

Ben Wolford — Mon, 20 Jul 2026 17:17:03 GMT

Small businesses are constantly asked about cyber insurance by clients, investors, procurement teams, lenders, and partners who want to know what happens if a breach, ransomware incident, or account takeover interrupts the business.

For founders and COOs, cyber insurance is rarely just a yes-or-no purchase. The company must first understand what it is buying, what the insurer expects to see, and how credential security could affect coverage if a claim ever happens.

This guide explains what cyber insurance covers, what it may exclude, which security controls insurers often look for, and how better access and credential management can support insurability. Please note that this is not financial advice.

What is cyber insurance?

What does cyber liability insurance usually cover?

What cyber insurance may not cover

What underwriters should expect before issuing a policy

The negligence risk in credential security

Why good security posture can affect cyber insurance cost

How much does business cyber insurance cost?

Cyber insurance context for small businesses

How to prepare before applying for cyber insurance

How Proton Pass for Business supports insurability

Cyber insurance works best with strong security

What is cyber insurance?

Cyber insurance is a policy that helps businesses manage the financial impact of cyber incidents. It can support recovery after events such as ransomware, unauthorized access, data breaches, business email compromise, malware, privacy incidents, or digital service disruption.

The UK National Cyber Security Centre says cyber insurance can help organizations recover from cyber incidents, but it also stresses that insurance isn’t a substitute for good cybersecurity.

Cyber insurance can help pay for response, recovery, and specialist support after an incident, but it does not prevent the event itself. If an attacker uses a stolen password, takes over an account, or reaches customer digital data, the business still has to contain the damage, prove what controls were in place, and recover operations. Putting stronger security controls in place before purchasing the policy makes it easier to demonstrate that your business took reasonable precautions.

What does cyber liability insurance usually cover?

Cyber insurance policies vary, so coverage depends on the insurer, broker, policy wording, limits, and exclusions. Still, most policies are built around two broad categories: first-party costs and third-party liability.

First-party costs

First-party coverage helps with costs your business faces directly after a cyber incident. The Association of British Insurers describes cyber insurance as protection that can help businesses with cyberattack costs and support detection, response, and recovery.

In practical terms, this is the part of the policy that may help your company pay for the work needed to understand what happened, contain the incident, restore systems, and keep the business moving.

Depending on the policy, first-party costs may include:

Incident response and forensic investigation
Legal advice and breach notification support
System restoration and data recovery
Business interruption losses
Ransomware negotiation and payment support, where legally permitted and covered
Crisis communications
Customer support or credit monitoring after a breach
Costs linked to restoring digital assets

For a small business, these costs create immediate pressure. A ransomware incident or account takeover can delay client work, stop payments, interrupt operations, and force urgent spending before the full impact is even clear.

Third-party liability

Third-party coverage helps when other people or organizations make claims against your business after an incident. This may include customers, partners, suppliers, or other affected parties.

Depending on the policy, this can include legal defense costs, settlements, privacy claims, contractual claims, and certain investigation costs. It is especially relevant for businesses that handle customer records, employee data, payment information, financial documents, legal files, confidential client work, or sensitive commercial information.

What cyber insurance may not cover

Cyber liability insurance is not unlimited protection. Every policy has conditions, exclusions, and duties your business must understand before buying.

Common areas to check include:

Pre-existing issues: A policy may not cover incidents linked to known vulnerabilities, prior compromise, or failures that existed before coverage began.

Failure to maintain controls: If your application states that two-factor authentication (2FA), cloud backups, or access reviews are in place, but those controls are not actually maintained, coverage may be disputed.

Negligence or misrepresentation: Claims can become harder if the business misrepresented its security posture or ignored obvious credential risks.

War and state-backed attack exclusions: Some policies may limit coverage for state-backed, war-related, or systemic cyberattacks. Review this section carefully with your broker rather than assuming every cyber incident is covered.

Fines and penalties: Some policies exclude criminal, civil, or regulatory fines, penalties, or sanctions that the business is legally required to pay.

Credential security can become part of the coverage conversation after a breach. If an incident begins with reused passwords, shared admin credentials, or accounts that should have been removed months earlier, the issue is not only technical. It may raise questions about whether the business had reasonable access controls in place.

What underwriters should expect before issuing a policy

Cyber insurance underwriting has become more security-focused. The NCSC advises businesses to understand what cybersecurity standards they already have in place, what controls they need to improve, and whether they can answer an insurer’s questions accurately before buying coverage.

It is safer to talk about evidence of security controls rather than saying every insurer requires a specific product. Requirements vary by insurer, business size, sector, revenue, data sensitivity, and claim history.

Common underwriting questions may cover whether:

2FA is enabled for email, remote access, admin accounts, business tools, and cloud services.
Cloud storage backups are regular, protected, and tested.
The business has an incident response plan.
Employees receive security awareness training.
Endpoint protection is in place.
Access is reviewed and removed when people leave.
Privileged accounts are controlled.
Passwords are unique, strong, and managed through clear credential policies.

Underwriters may not specifically require a password manager in every application, but they often look for evidence of credential management and access control maturity: clear password and sharing policies, 2FA enforcement, access reviews, protected privileged accounts, and reduced password reuse.

A business password manager supports that evidence by giving employees a secure way to create, store, autofill, and share credentials. It also gives administrators better visibility into access practices, policy enforcement, 2FA readiness, and privileged access control than scattered browser-saved passwords, spreadsheets, or chat messages.

The negligence risk in credential security

One of the biggest risks for small businesses is assuming that cyber insurance will cover any incident simply because a policy exists. In practice, coverage can depend on whether the business met the conditions of the policy and whether its security statements were accurate.

Credential security is a common weak point. A company may say it enforces strong access controls, but employees may still share passwords through chat, reuse the same credentials across systems, keep admin passwords in spreadsheets, or fail to use 2FA consistently on critical accounts.

That gap can be highlighted after an incident. An insurer may review how the breach happened, whether required controls were in place, and whether the business followed its own procedures. A claim linked to ignored credential risks may be harder to defend than one where the business can show it had reasonable controls, training, and access management in place.

A business password manager like Proton Pass for Business helps reduce that risk by making credential controls easier to apply in daily work. It supports unique passwords, secure sharing, safe onboarding and offboarding, and clearer access management. It helps ensure that employees handle credentials in line with the business’s stated security policies.

Why good security posture can affect cyber insurance cost

Business cyber insurance cost depends on many factors, including company size, revenue, sector, data sensitivity, claim history, coverage limits, deductibles, and security maturity. No security feature can guarantee a lower premium. But better controls can make a business look less risky to underwriters.

In practical terms, security posture affects three financial questions:

Can the business get coverage? Some insurers may decline higher-risk applicants or restrict terms if basic controls are missing.

What will the policy cost? A stronger security baseline may support better pricing, though premiums depend on the insurer and risk profile.

What happens during a claim? Better documentation and controls can make it easier to show what was in place before the incident.

The cyber insurance UK market shows why insurers are looking more closely at controls. The ABI reported that UK insurers paid £197 million in cyber claims in 2024, a 230% year-on-year increase. Malware and ransomware accounted for 51% of claims, up from 32% in 2023.

For a founder or COO, the ROI of security goes beyond breach prevention. It also shows up in insurability, cleaner applications, fewer exceptions, stronger claim defensibility, and less operational disruption if something happens.

How much does business cyber insurance cost?

Cyber insurance costs small businesses about $1,550 per year on average in the US, although premiums can range from a few hundred dollars to more than $8,000 depending on the business’s risks, security controls, and coverage limits.

In the UK, basic policies for smaller businesses start at under £200 per year, while small businesses may pay between £500 and £3,500, depending on their turnover, industry, security measures, data exposure, and level of cover.

Cyber insurance context for small businesses

Cyber insurance can feel confusing for small businesses because coverage is not standardized. Two policies may both be called “cyber insurance” but differ significantly in exclusions, limits, response services, ransomware wording, approved incident response providers, and security requirements before and after an incident.

The Association of British Insurers⁠ describes it as protection that can help businesses manage the costs of cyberattacks and support response and recovery. In practice, it should be treated as financial protection that works alongside stronger access control, backup readiness, incident response, and credential security.

A practical buying process should include three conversations:

With your broker or insurer: What is covered, excluded, and required?

With your IT or security provider: Which controls are already in place, and which gaps matter most?

With leadership: What level of financial and operational risk can the business realistically absorb?

Cyber insurance should be reviewed as both a financial product and a security-readiness check. The better your business understands its access controls, backups, incident response process, and credential management, the easier it becomes to evaluate whether a policy matches your real risk.

How to prepare before applying for cyber insurance

Before you apply, treat the insurance process like a security readiness check. You do not need enterprise-level maturity, but you do need accurate answers.

Start with these steps:

Review your access controls: Check which accounts are privileged, whether 2FA is enabled, and whether former employees or vendors still have access.
Strengthen credential management: Replace reused passwords, remove shared passwords from chats and spreadsheets, and create a clear process for secure sharing.
Document your backups: Know what is backed up, how often, where backups are stored, and when restoration was last tested.
Write an incident response plan: Define who leads, who contacts the insurer, who handles customers, and who can approve emergency actions.
Train employees: Cover phishing, password reuse, suspicious login prompts, and incident reporting.
Check your policy statements: Do not overstate controls on an application. If 2FA is only enabled for some systems, say so and plan the next improvement.

Here’s a simple cyber insurance checklist:

Security requirement	What to check
2FA	Is 2FA enabled for email, admin accounts, remote access, and cloud services?
Unique passwords	Does every business account use a strong, unique password?
Secure sharing	Are shared credentials managed through an approved password manager?
Backup testing	Are backups regular, protected, and tested?
Incident response plan	Does the team know who leads, who contacts the insurer, and who approves urgent actions?
Employee training	Do employees know how to report phishing, suspicious logins, and possible breaches?
Access review	Are former employees, contractors, and vendors removed from systems they no longer need?

Proton’s SMB cybersecurity report can help small businesses benchmark common cybersecurity gaps and understand why practical controls matter before incidents happen.

For broader prevention planning, Proton’s guide to data breach prevention for businesses explains how businesses can reduce the likelihood and impact of breaches before they turn into insurance claims.

How Proton Pass for Business supports insurability

Cyber insurance is financial protection, but underwriting starts with operational reality. If a business cannot show how it manages passwords, access, and shared credentials, the insurer may see more uncertainty.

Proton Pass for Business helps reduce that uncertainty by giving your team a structured way to manage credentials. Employees can generate strong, unique passwords, store them in encrypted vaults, use autofill, and share access securely.

For administrators, Proton Pass for Business supports centralized user management, secure sharing, policies, reporting and logs, SSO integrations, and SCIM provisioning. These features help your business show that access management is not improvised. They also support practical evidence by answering questions such as who has access, where shared credentials live, and how password practices are governed.

Proton Pass for Business supports insurability in three ways:

2FA readiness: Your team can store and manage credentials safely while ensuring strong authentication practices on critical accounts.

Access control: Admins can organize vaults, manage users, and reduce uncontrolled sharing.

Audit trail: Reporting and logs help show that credential management is being monitored.

Cyber insurance works best with strong security

Cyber insurance can help your small business absorb some of the financial impact of an incident. But it works best when paired with the controls that reduce the likelihood and severity of a claim.

Before buying or renewing cyber liability insurance, understand what the policy covers, what it excludes, and which security conditions apply. Be especially careful with credential security, as reused passwords, informal sharing, unmanaged admin access, and inaccurate application answers can all create risk before and after an incident.

The strongest approach to a cyber insurance for small businesses combines both: financial protection for when something goes wrong, and practical controls that make incidents less likely, less damaging, and easier to defend.

A business password manager like Proton Pass for Business is one of the clearest places to start because access is often central to cyber risk, underwriting questions, and incident response. When employees can generate unique passwords, share credentials securely, and admins can review access practices, the business is in a stronger position.

How to write a cybersecurity policy for your small business

Kate Menzies — Mon, 20 Jul 2026 16:35:55 GMT

A cybersecurity policy is a foundational document that gives your small business a clear way to explain how employees should protect company systems, accounts, devices, and digital data.

It turns security from scattered advice into shared expectations by answering questions such as which practices are allowed, what employees should avoid, who owns which decisions, and what happens when something goes wrong.

This guide gives you a practical framework for writing or reviewing a cybersecurity policy for your small business. You can use it as a starting template, adapt each section to your tools and risks, and connect the policy to operational controls that make it easier to follow.

What is a cybersecurity policy?

Why small businesses need a cybersecurity policy

Cybersecurity policy template: 9 core sections

Why do IT security policies for businesses fail?

How Proton Pass for Business supports policy enforcement

What is a cybersecurity policy?

A cybersecurity policy is a written document that defines how your business protects information, systems, devices, and accounts from cyber threats. It should explain what employees and contractors, including managers and administrators, are expected to do in day-to-day work.

A strong policy should feel like a reference people can actually use when decisions are unclear. It should answer questions like:

Which passwords and accounts need extra protection?
Can employees use personal devices for work?
Where should sensitive data be stored?
Who can approve access to business systems?
What should someone do if they suspect a breach?
How often will the policy be reviewed?
What happens to access when someone leaves the company?

For SMBs, the best cybersecurity policy is short, clear, and specific enough to remove guesswork.

Why small businesses need a cybersecurity policy

A cybersecurity policy can help your business in three ways:

Sets expectations: Employees know what is allowed, what is required, and what needs approval.

Creates accountability: If access, devices, data handling, and incident response have clear owners, security stops depending on individual memory.

Supports compliance and customer trust: Being compliant with data regulations such as the GDPR requires your business to process personal data securely using appropriate technical and organizational measures, including risk analysis, organizational policies, and technical measures.

A written information security policy helps show that your business has considered those responsibilities and created controls to reduce risk.

Proton’s SMB cybersecurity report reinforces why this matters for smaller teams: SMBs often face real security risk without the same resources as larger enterprises. A practical policy gives those teams a way to prioritize the basics and make them repeatable.

Cybersecurity policy template: 9 core sections

Use the following structure as a cybersecurity policy template. You don’t need to make every section overly long. The goal is to define the rule, assign ownership, and explain how employees should apply it.

1. Policy purpose and scope

Start by explaining why the policy exists and who it applies to. This section prevents a common problem: people assuming the policy only applies to “IT systems” or full-time employees.

Template copy:

This cybersecurity policy defines how [Company Name] protects business systems, accounts, devices, and data. It applies to employees, contractors, temporary workers, and third parties who access company information or systems.

The scope should include company-owned devices, approved cloud services, business accounts, remote work environments, personal devices used for work, and vendor access.

2. Acceptable use policy

The acceptable use section explains how employees can use company systems and accounts.

It should cover:

Approved business software and services
Restrictions on unauthorized apps or browser extensions
Rules for downloading files and software
Use of company email and messaging
Personal use of company devices
Prohibited activity, such as sharing accounts without approval or bypassing security controls

Keep this section practical. Employees should understand which everyday choices are acceptable without needing to interpret technical language.

Template copy:

Employees must use approved business systems for company work. Unapproved applications, personal storage accounts, and unauthorized browser extensions must not be used to store, process, or share company data unless approved by [role/team].

3. Password and access management requirements

It’s important to take admin controls into consideration. A policy can define who should have access, when two-factor authentication (2FA) is required, and how offboarding should work, but teams still need an operational way to apply those rules. A business password manager like Proton Pass for Business supports that through its admin panel, where your team can manage access, apply policies, review activity, and reduce reliance on informal password handling.

Your policy should state that:

Work passwords must be unique and strong.
Passwords must not be reused across business and personal accounts.
Shared credentials must not be sent through unapproved ways such as email, chat, screenshots, tickets, or documents.
2FA should be enabled everywhere, starting with high-risk accounts.
Access should be granted based on role and business need.
Access must be removed when someone changes roles or leaves.
Exceptions must be documented, including cases where 2FA cannot yet be enabled, a shared account is temporarily unavoidable, a vendor needs time-limited elevated access, or a legacy system cannot meet the standard password or access requirements.

Proton’s guide to creating a password policy can support this section with more detail on password rules, sharing, access management, and two-factor authentication.

This is also where policy needs operational support. A rule that says “use unique passwords” is weak if employees still have to create and remember every password manually.

A business password manager like Proton Pass for Business helps teams turn password requirements into daily practice: Employees can generate strong, unique passwords, store them in encrypted vaults, use autofill, and share passwords securely instead of using unsafe channels — all in one app.

Template copy:

Work passwords must be unique, strong, and stored in the approved business password manager. Passwords must not be reused across personal and business accounts or shared through email, chat, screenshots, tickets, or documents. Multi-factor authentication must be enabled for high-risk accounts, and access must be granted based on role and business need. When an employee, contractor, or vendor no longer needs access, permissions must be reviewed and removed.

4. Data classification and handling

A cybersecurity policy should define the types of information your business deals with and how each type of information should be protected. Here are three tiers that a small business can use without complicating things:

Public: Information approved for public use

Internal: Business information for employees and approved contractors that wouldn’t be appropriate to share externally

Confidential: Client data, financial data, credentials, contracts, employee records, or sensitive operational information — anything that can cause harm if leaked

Template copy:

Confidential information must only be stored in approved systems, shared with authorized people, and protected from unauthorized access. Employees must not store confidential business data in personal accounts, unmanaged documents, or unapproved devices.

5. Incident reporting and first response

Your policy should explain what employees must do when they identify or suspect a vulnerability. This does not need to be a full incident response plan, but it should define first actions and ownership.

Include examples such as:

Suspicious login alerts
Lost or stolen devices
Phishing emails
Accidental data sharing
Malware warnings
Unusual account activity
Unauthorized access to documents or systems

Use Proton’s guide to data breach prevention for businesses for further guidance on reducing breach risk before an incident happens.

Template copy:

Employees must report suspected security incidents immediately to [role/team/contact]. Employees must not delete evidence, reset affected systems, or communicate externally about an incident unless instructed by the incident owner.

6. Remote work and Bring Your Own Device (BYOD) rules

Remote work and personal devices within your business network can create unnecessary risk if not managed properly. Your cybersecurity policy should explain whether employees can use personal devices, which security requirements apply (such as BYOD security), and what happens if a device is lost or someone leaves.

Include:

Approved devices and operating systems
Screen locks and device encryption
Reporting lost or stolen devices
Use of public WiFi
Access to company systems from personal devices
Rules for personal cloud storage
Requirements for authentication apps and 2FA
Offboarding steps for remote employees

Proton’s remote work policy and BYOD policy guides can support this section with more detailed rules for distributed teams and employee-owned devices.

Template copy:

Employees may only access company systems from approved devices that meet security requirements. Lost or stolen devices must be reported immediately. Company data must not be stored in personal cloud accounts or unmanaged applications.

7. Third-party vendor access

Small businesses often rely on agencies, contractors, software providers, accountants, consultants, and managed service providers. Vendor access should never be treated casually because it can create a backdoor your business doesn’t fully control.

A business password manager can help make that control more practical by helping teams keep vendor credentials scoped, monitored, and easy to revoke when an engagement ends.

Your policy should define:

Who can approve vendor access
Which systems vendors can access
Whether vendor accounts must be individual or shared
How long access lasts
How often vendor access is audited
How minimum permissions are determined for each vendor
What happens when a contract ends

This section also supports supply chain security. The NCSC’s 10 Steps includes it as a key area for managing cyber risk, which is especially relevant for small businesses that outsource parts of IT, finance, marketing, or operations.

Template copy:

Third-party access must be approved by [role/team], limited to the systems required for the work, and reviewed at the end of the engagement. Vendor access must be removed when it is no longer needed.

8. Employee training requirements

A cybersecurity policy won’t work if people only see it during onboarding. Regular security awareness training ensures that your policy is always followed.

Your policy should explain:

When employees receive security training
Which topics training covers
How often refreshers happen
Who must complete training
How new risks or policy changes are communicated

Training topics can include phishing, password management, 2FA, safe file sharing, data handling, remote work, device security, and incident reporting.

Keep training short and practical. A succinct five-page policy with a checklist supported by short examples is usually more useful than an overstuffed, verbose 40-page document.

Template copy:

Employees must complete cybersecurity training during onboarding and at least [annually/twice a year]. Training will cover password security, phishing, data handling, device security, and incident reporting.

9. Policy review cadence

A cybersecurity policy should change as the business changes. New systems, remote work patterns, vendors, regulations, and incidents can all make old rules incomplete.

Define:

How often the policy is reviewed
An owner for the cybersecurity policy review
How changes are approved
How updates are communicated
What triggers an out-of-cycle review

Template copy:

This policy will be reviewed every [six or 12 months] by [owner]. It must also be reviewed after a major security incident, significant system change, regulatory update, or material change in business operations

Why do IT security policies for businesses fail?

Most cybersecurity policies fail for practical reasons:

The policy is too long: A small business cybersecurity policy should not try to cover every possible scenario. If it becomes too long, employees stop using it. Keep it concise and link to deeper procedures where needed.

The language is too technical: Employees should not need a security background to follow business cybersecurity guidelines. Use plain language and replace technical terms with everyday explanations where possible.

The policy is presented only during onboarding: If the policy is only mentioned once during onboarding, it will not shape daily behavior. Reinforce it through training, reminders, quick-reference guides, and updates when processes change.

The policy is never reviewed: A policy written two years ago may not reflect current systems, remote work practices, vendor access, or regulatory expectations. Review it regularly.

The policy is not enforced: This is the most common reason for failure. A policy can say that passwords must be stored securely, 2FA must be enabled, or vendor access must be removed, but those rules don’t matter if nobody keeps on top of it. Enforcement means assigning owners, using admin controls where available, reviewing exceptions, and making secure behavior easier than the shortcut.

For password and access management, Proton Pass for Business can help support policy enforcement operationally. It gives teams encrypted vaults, secure sharing, password generation, and admin visibility, so your business is not relying only on theory. Admins can also monitor password health, credential reuse, and dark web breach exposure across the organization securely, without knowing the employees’ passwords.

How Proton Pass for Business supports policy enforcement

A cybersecurity policy is only useful if the business can put it into practice. Password and access rules are a good example. You can write that passwords must be unique, shared securely, and removed when people leave. But if employees still use browsers, spreadsheets, chat messages, or personal notes, the policy is easy to ignore.

Proton Pass for Business gives employees a secure way to generate, store, autofill, and share credentials, while giving admins better visibility into how access is managed. This makes the password and access management section of your policy easier to follow.

For small businesses, the benefit is practical. You don’t need a large security team to start improving credential hygiene. A business password manager gives your team a central place for work credentials, supports safer collaboration, and helps reduce the risk of password reuse or ungoverned sharing.

Access control is one of the most practical places to turn policy into action. When credentials are easier to generate, store, share, and revoke securely, employees are less likely to rely on unsafe workarounds. Managers also gain a clearer way to support password and access requirements in daily operations.

Enforce your cybersecurity policy with a secure business password manager like Proton Pass for Business.

What is a firewall? What does it do, and how does it work?

Douglas Crawford — Fri, 17 Jul 2026 11:15:17 GMT

A firewall is a security system designed to monitor and control incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, such as the internet, thus protecting against unauthorized access and other cyberthreats.

Whether you’re protecting a home network, a home office setup, or a corporate network with thousands of endpoints, the same basic principle applies:

A firewall decides what gets in, what gets out, and what gets blocked.

In this guide, we’ll look at:

How does a firewall work?
What does a firewall do?
Firewall vs. antivirus: what’s the difference?
Why is a network firewall important?
A brief history of firewalls
Types of firewalls
How do VPNs and firewalls interact?
How to choose and deploy a firewall for your business
What a firewall can’t do
FAQ

How does a firewall work?

Imagine your house is a local private network (LAN) — that is, all the devices in your house that connect to your modem/router, which connects to the internet. A firewall works like a security guard at the door of your house. It lets in trusted visitors (safe data), blocks strangers (dangerous data), and keeps an eye on everyone inside to make sure they behave appropriately.

The security guard has a guest list (a set of rules) that says who is allowed to enter the house. For example, friends and family are on the list, but strangers and suspicious people are not.

When someone approaches the door, the security guard asks for their ID (checks the data packet — a unit of data transferred over a network). The guard looks at important details like their name (IP address) and reason for visiting (protocol/port number). If the person (data packet) matches the guest list, the security guard lets them in. If the person is not on the list or looks suspicious, the guard turns them away.

Once inside, the security guard keeps an eye on your visitors to ensure they don’t go into off-limits rooms (sensitive parts of your network). If someone tries to access these rooms without permission, they get escorted out.

Firewalls often work in both directions. That is, they filter both incoming and outgoing traffic, preventing not only those on the internet from connecting to restricted local resources, but also preventing local users from connecting to specified resources on the internet. Some firewalls are outgoing-only.

An outgoing firewall might prevent a local device from connecting to an IP address associated with malware, or it could be used to censor content. A school might use a firewall to prevent students from accessing social media content, or a restrictive government might use firewalls to block content it deems objectionable on social, religious, cultural, or political grounds (such as the Great Firewall of China).

The same “security guard” logic also applies in a business setting, albeit often scaled up dramatically. Instead of one house, imagine an office building, a data center, and a scattering of remote workers all connecting from home A business firewall (or, more often, several firewalls working together) has to consistently enforce the same guest list across all of them.

What does a firewall do?

A firewall performs three key functions:

1. Traffic filtering

Firewalls analyze data packets to determine if they should be allowed or blocked based on specific criteria, such as IP addresses, port numbers, protocols, and content.

2. Enforcing rule sets

Administrators configure firewalls with rule sets that define which traffic is permitted or denied. These rules are based on security policies that specify allowed and disallowed activities.

3. Monitoring and logging

Firewalls can continuously monitor network traffic and log significant events, providing network administrators with valuable insights into network activity and potential security risks.

Firewall vs. antivirus: what’s the difference?

For smaller organizations that already have antivirus software, deciding whether a firewall is also worth the security budget is a common dilemma. In most cases, the answer yes, as these tools protect different things.

Scope

A firewall protects the network, deciding what traffic is allowed to enter or leave in the first place.
Antivirus software protects the individual device, scanning files and processes that are already there for known malware signatures or suspicious behavior.

What they catch

A firewall can block a connection attempt before it ever reaches a device.
Antivirus software deals with threats that have already reached the device. For example, a malicious file downloaded through an already-permitted connection.

When they act

Firewalls act at the perimeter, in real time, on traffic.
Antivirus tools generally act after the fact, scanning files or running processes for signs of compromise.

So while both tools help protect against malicious threats, they cover different stages of an attack. A firewall reduces how much reaches your devices in the first place, while antivirus software catches what slips through.

Why is a network firewall important?

Using a firewall has several advantages:

Improves security by identifying and blocking potential threats before they enter the network
Safeguards sensitive information
Assists in meeting regulatory and compliance requirements
Helps to control and optimize network traffic

Firewalls can be deployed as a boundary between the internal network and the internet (which is known as a perimeter firewall), or within the network to protect specific segments and/or resources within that network (known as an internal firewall).

Cloud firewalls, also known as firewall-as-a-service (FWaaS), are hosted in the cloud and provide firewall protection for cloud-based infrastructure. Such firewalls are managed by cloud service providers.

For businesses specifically, firewalls are also often a baseline requirement rather than an optional add-on. Many compliance frameworks and cyber-insurance policies require some form of network firewall to be in place before they’ll consider an organization adequately protected.

A brief history of firewalls

Firewalls as a concept first appeared in the late 1980s, and have gone through four broad generations since:

Packet-filtering (stateless) firewalls: The earliest form.

Stateful firewalls: Added the ability to track the state of active connections rather than judging each packet in isolation.

Proxy (application-level) firewalls: Added full inspection of traffic contents, not just headers.

Next-generation firewalls (NGFWs): Combine the above with capabilities like deep packet inspection (DPI), intrusion prevention, and application awareness, and it results in most of what’s sold as a “firewall” in an enterprise context today.

Types of firewalls

Firewalls come in various types, each designed to meet different security needs and provide varying levels of protection.

What is a packet-filtering firewall?

Packet-filtering firewalls examine the headers of data (IP) packets, which include source and destination IP addresses, port numbers, and protocol information. They then apply rules based on these headers to either allow or block the packets.

While standalone packet-filtering firewalls exist in theory, the reality is that all firewalls filter packets — it’s the most basic function of a firewall.

What is a stateful firewall?

Also known as dynamic packet filtering, these firewalls track the state of active connections and make decisions based on the state and context of traffic. They inspect packet headers and maintain a state table that records information about active connections.

Unlike stateless firewalls, which filter packets solely based on predefined rules and the information contained in the packet headers (such as IP addresses and port numbers), stateful firewalls track the state of active sessions and use this information to make more informed decisions about whether to allow or block traffic.

The state table includes information such as the source and destination IP addresses, port numbers, and the current state of the connection. By understanding the context of the connection, stateful firewalls can make more sophisticated decisions. For example, they can recognize whether a packet is part of an existing, legitimate connection or if it is an unsolicited packet that might be part of an attack.

Almost all real-world firewalls are stateful firewalls. They might offer additional functionality, as you will learn below, but these are almost invariably a refinement of the stateful firewall.

What is a proxy firewall?

Proxy firewalls act as intermediaries between you and the internet. They make requests on your behalf, inspect the entire data packet (header and payload), and, if deemed safe, send the data to the destination.

Proxy firewalls are best suited to environments where deep inspection of application data is crucial, such as corporate networks handling sensitive information.

In principle, proxy firewalls improve performance and reduce bandwidth usage. However, this is often countered by the fact that they can be complex and resource-heavy, thus becoming a bottleneck that slows down network performance.

What is a next-generation firewall (NGFW)?

NGFWs combine traditional firewall features with additional functionalities, such as deep packet inspection, intrusion prevention systems (IPS), and encrypted traffic inspection. They can identify and control applications, detect and prevent advanced threats, and enforce security policies.

Next-generation firewalls are highly effective at identifying and stopping advanced threats and provide comprehensive security by integrating multiple security functions. However, they’re more expensive and complex to manage, making them best suited to organizations that require advanced security capabilities to protect against sophisticated cyberthreats.

What is a unified threat management (UTM) firewall?

UTM firewalls integrate a mix of security services— various firewall types, antivirus software, and intrusion detection, for example — to provide a holistic approach to network security.

Although they lack the advanced features and flexibility of specialized security solutions like NGFW firewalls, UTM firewalls are often regarded as a cost-effective solution for small to medium-sized businesses, as they simplify security management by consolidating multiple security functions.

What is a network address translation (NAT) firewall?

NAT firewalls modify network address information in IP packet headers while in transit, so that multiple devices on a local network can share a single public IP address. They are often used by domestic routers and office LAN gateway servers, through which local devices connect to the internet.

NAT firewalls add a layer of security by hiding internal IP addresses, but are usually used in conjunction with other firewall types to provide more comprehensive security.

What is a web application firewall (WAF)?

A web application firewall (WAF) is a specialized firewall designed to protect web applications by filtering and monitoring HTTP/HTTPS traffic between a web application and the internet. WAFs help to safeguard web applications from various attacks, such as SQL injection, cross-site scripting (XSS), and other common web exploits, by inspecting and filtering incoming traffic.

What is a human firewall?

A “human firewall” is an analogy that refers to the collective effort of employees within an organization to act as a line of defense against cybersecurity threats. This concept emphasizes the role of human awareness and behavior in enhancing organizational security, complementing technological defenses like firewalls, antivirus software, and intrusion detection systems.

How do VPNs and firewalls interact?

A VPN creates an encrypted tunnel between your device and the VPN server.

This prevents any firewall between the VPN server and your device from interacting with your data, so data inside the VPN tunnel simply bypasses the firewall. This includes firewalls on domestic modem/routers and office corporate servers.

Learn more about how VPNs work

To address this issue, most VPN providers (including Proton VPN) implement firewalls on their servers to protect their customers. For example, Proton VPN servers use stateful firewalls to reject all incoming traffic connections that weren’t initiated by you.

If you want uninitiated incoming connections (for example, if you are torrenting), we offer a port forwarding feature, which punches a hole through the firewall. This introduces some security risks, but port forwarding is only active if you choose to enable it.

VPN apps also use firewall rules (and similar platform-specific operations) to prevent DNS and IPv6 leaks.

Learn how to check if your VPN is working

VPNs and firewalls used to censor content

Because an encrypted VPN connection prevents firewalls from examining and filtering VPN traffic, services such as Proton VPN are highly effective at bypassing firewalls that aim to block content on the web.

How to choose and deploy a firewall for your business

For a household or small office, one firewall (typically built into a router or an operating system) is generally sufficient to meet your security needs. Businesses, however, often need to think about firewalls across several different environments at once. The right setup for this depends on what’s being protected:

Head office / campus: A perimeter firewall protecting the main office network, often alongside internal firewalls that segment sensitive areas (such as finance, HR, engineering) from the rest of the network.

Branch offices: Smaller, remote locations often need their own firewall, rather than relying entirely on head office. This is particularly true if they connect directly to the internet, rather than through a central hub.

Data centers: Firewalls at data centers typically need to handle high volumes of traffic and are often deployed alongside network segmentation to contain any breach to a small part of the infrastructure.

Cloud and multi-cloud environments: Traditional hardware firewalls don’t map well onto cloud infrastructure, which is where firewall-as-a-service (FWaaS) firewalls are useful. These scale with the cloud provider, rather than requiring physical equipment.

Remote and hybrid workforces: Employees connecting from home networks or public WiFi are outside the traditional office firewall perimeter entirely. This is typically addressed using a combination of endpoint firewalls, VPNs (either traditional setups where the company owns their own VPN servers, or modern third-party solutions using dedicated servers), and network access approaches based on zero-trust security (for larger organizations).

A few practical questions worth asking when evaluating firewall options for your business include:

Does it need to inspect encrypted traffic? A growing share of malicious traffic is encrypted, so if the firewall can’t perform TLS/SSL inspection by decrypting, checking, and re-encrypting HTTPS traffic using its own trusted certificate, it’s effectively blind to a large category of threats.

How is it managed? Managing a handful of separate firewall dashboards across offices, cloud accounts, and remote endpoints doesn’t scale well. Centralized management matters more as an organization grows.

What’s the performance cost? Deeper inspection (like DPI) requires more processing power. It’s worth understanding how a firewall performs with its full security features switched on.

Has it been independently tested? Vendor performance and security claims are worth checking against independent testing, rather than taken at face value. This is the same principle that should apply when evaluating any security or privacy product.

What a firewall can’t do

Firewalls are a key piece of network security, but they were never meant to work alone. One way to understand what they can do, is to be clear about what they can’t:

Neutralize threats already inside your network

If malware arrives through a permitted channel, such as an email attachment, a compromised update, or a user’s own device, there’s not much a perimeter firewall can do about it. This is where antivirus, endpoint detection, and internal segmentation matter.

Account for human error

A firewall can’t fix poor human judgement. Someone tricked by social engineering or phishing into handing over their password isn’t a traffic-filtering problem.

Filter encrypted traffic that wasn’t configured to inspect

Traffic sent through a VPN, for instance, deliberately can’t be inspected by a firewall. This is precisely why VPNs are effective for both privacy and bypassing censorship firewalls (see above).

Be effective due to misconfigured rules

A firewall is only as good as the rules it’s given. An overly permissive rule set (or one that hasn’t been updated as the network changes) can leave critical gaps in your defenses, despite the firewall being technically “in place.”

None of this means firewalls aren’t essential. It just means that you need to see and deploy them as one layer among many, such as firewall, antivirus, VPN, and employee training, rather than as a single point of defense.

Final thoughts: Firewalls and VPNs complement each other

Firewalls are an essential component of network security. Almost all firewalls are stateful firewalls, with variations that offer distinct features and benefits tailored to specific security needs and environments.

VPN services make extensive use of firewalls to keep both their own systems and those of customer devices safe, while at the same being an effective means of bypassing firewalls that aim to censor online content.

For businesses in particular, a firewall is best thought of as one layer of a broader security setup, to be used alongside tools like VPNs, antivirus software, and employee awareness training, rather than as a replacement for any of them.

Frequently asked questions

What is a firewall in a computer network?

In a computer network, a firewall is a security system consisting of hardware, software, or both that sits between a trusted network and an untrusted one (usually the internet). It controls what traffic is allowed to pass between them, based on a defined set of rules.

What does a firewall do?

A firewall filters incoming and outgoing network traffic, blocking anything that doesn’t meet its security rules, while allowing legitimate traffic through. It can also monitor and log network activity to help identify potential threats.

What is the purpose of a firewall?

The purpose of a firewall is to prevent unauthorized access to (or from) a network, protecting sensitive systems and data from external threats, while also giving administrators control and visibility over what traffic is allowed to move across the network.

How to conduct a password audit for your business

Ben Wolford — Wed, 15 Jul 2026 18:12:56 GMT

Most businesses don’t realize they have a password problem until an issue forces them to acknowledge it, such as an admin password kept in a spreadsheet, or login credentials that remain active for team members who left your company years ago.

This is a common occurrence. In the UK, the government’s Cyber Security Breaches Survey 2024 found that 50% of businesses identified a cyber security breach or attack in the previous 12 months, rising to 70% of medium businesses and 74% of large businesses.

In this situation, a password audit is one of the most valuable actions your business can take to stay safe. It’s a practical way to uncover credential risks that tend to build quietly in the background through weak passwords, unauthorized access, dormant accounts, and logins stored outside approved systems.

For small and mid-sized organizations in particular, this kind of review can help make meaningful security improvements without spending money or conducting a complex transformation program.

This article explains how to conduct a password audit for your business, what to look for, and how to turn the process from a one-off clean-up into a more consistent security practice.

What is a password audit?

A password audit is a systematic review of the passwords, accounts, and access permissions used across a business. Its purpose is to identify credential-related risks such as weak passwords, reused passwords, outdated logins, inactive accounts, excessive access, and credentials stored outside approved systems.

In practice, a password audit goes beyond checking whether a password is strong enough. It also looks at:

How passwords are managed across your organization
Who has access to what and whether that access is still necessary
How passwords are stored and shared
Whether your business has enough visibility to spot risk before it becomes a security issue

This broad scope is what makes a password audit useful. In most organizations, credential risk isn’t created by a single bad password. It builds gradually through small failures in oversight, inconsistent access controls, poor storage habits, and accounts that remain active long after they should have been reviewed or removed.

An effective password audit helps bring those issues into view. It gives businesses a clearer understanding of their current password hygiene and creates a practical basis for improving access control, tightening credential management, and reducing avoidable exposure over time. This kind of review is much easier to conduct when you’re using a business password manager with admin tools that support visibility, access review, and policy enforcement.

How to run a password security audit: a practical five-step framework

A useful password audit doesn’t need to begin with a perfect map of every account, tool, and access path in the business. It just needs a clear structure and a controlled system for managing credentials. Without these two things, the process can quickly become too broad and too easy to postpone.

The way to break the cycle of avoiding password audits is to centralize password management, define ownership, and review access through one approved workflow.

Here’s an in-depth guide to running your own password audit:

Step 1: Create a full credential inventory

Start by building a working inventory of the systems your business depends on. That includes the obvious core platforms, such as:

Email
Finance tools
Cloud storage
Collaboration software
CRM systems
Admin consoles
Any environment that holds company or customer data

It should also include less obvious tools and services operating in your network:

Shared social accounts
Dormant SaaS subscriptions
Contractor tools
Test environments
Services adopted by individual teams without central oversight

Cataloguing every tool is important because most credential risk starts with incomplete visibility. If you don’t know which tools are in use, you can’t review how access is being managed across them.

Businesses that already use a business password manager such as Proton Pass for Business begin their password audit with a practical advantage because credentials live in encrypted vaults.

Step 2: Map access against business need

Once you have a clearer view of your systems, the next step is to examine access. You need to review whether the right people still have the right level of access to the right tools.

Start by looking at each key system and asking who currently has access, if it reflects their present responsibilities, and whether any accounts carry broader permissions than necessary.

In many businesses, access expands gradually over time. Broad admin rights can be granted for convenience and never removed, for instance. Contractors may retain access after a project ends, or team members may change roles and keep permissions from previous ones.

That kind of drift increases risk even when the password itself is strong. The NCSC’s guidance on access control recommends assigning accounts to authorized individuals only, and giving users the minimum access and permissions they need, since anyone can become a liability. A password audit should therefore examine the reason behind each access level.

Step 3: Do a password health check

This stage of the password audit is for identifying any reused or weak passwords, inactive two-factor authentication (2FA), outdated logins, and insecure storage habits that make compromise more likely.

At this point, the review should focus on a few practical questions:

Are passwords unique to each account?
Are any passwords weak or easy to guess?
Are old credentials still being used and unaccounted for?,
Are employees writing down their passwords in browser storage or note-taking apps instead of business-approved systems?
Is 2FA enabled everywhere it can be?

Proton Pass for Business helps you with Pass Monitor, which includes:

Password health check tools for automatically detecting repeated or weak passwords and inactive 2FA
Dark Web Monitoring for alerting you if your credentials are involved in breaches
Proton Sentinel for detecting and blocking suspicious login activity that may lead to account takeover

Step 4: Review inactive accounts

One of the fastest ways to reduce credential risk is to simply remove what no longer needs to exist. Most businesses accumulate inactive accounts over time. For example:

Former employees that still have access to your company’s tools
Old SaaS platforms that remain tied to valid company credentials long after adoption has trailed off
Shared accounts designed for short-term use that end up staying live for months or years because no-one knows who owns them

These accounts attract less attention than active ones, which makes them especially easy to overlook. This review is also closely aligned with broader compliance discipline.

A strong business password review needs to include a deliberate effort to:

Remove dormant access
Close obsolete accounts
Confirm clear ownership for the systems that remain

Proton Pass for Business helps reduce the friction that often keeps these accounts alive by making ownership clearer, access easier to review, and credential changes easier to manage when people leave or roles change.

Step 5: Remediate and standardize

The final step is to turn what you found into action. A password audit only improves your organization’s security if the issues it uncovers are addressed in a structured way.

Once you have identified gaps, you can build a plan that is systematic rather than reactive. Here is a simple password audit checklist:

Immediately change weak or exposed credentials.
Replace reused passwords with unique ones.
Enable 2FA everywhere, starting with critical accounts.
Remove inactive or unnecessary accounts.
Revoke excess privileges.
Move credentials out of spreadsheets, documents, or browser storage.
Consolidate password storage into an approved business system.
Update your password and access policies.

This is also the right moment to align technical action with policy. If your current password policy is vague, unenforced, or unrealistic, your audit will simply surface the same problems again in six months.

Password audits and password policies work very well together: Proton’s guide to creating a password policy is a strong companion resource. And you can get started easily with our password policy template.

Remediation needs to prioritize by risk, not by neatness. Start with admin accounts, systems containing sensitive data, externally exposed services, and shared credentials with poor ownership. Then work outward.

Why do businesses skip password audits?

If password audits are so useful, why do so many businesses not bother conducting them? The process can feel harder to begin than it actually is.

In many organizations, credentials are stored in too many locations to review easily. Some employees save passwords in browsers. Others keep them in spreadsheets, shared documents, notes apps, or internal messages.

Different teams may use their own tools, buy software independently, or manage access informally. As a result, the business can lose track of which systems are in use and who has access to them, making it difficult to identify and address security risks.

The absence of a centralized system makes this even harder. Without a single location to manage business credentials, even a basic password security audit can turn into a manual exercise built on guesswork, screenshots, and individual memory. Many SMBs postpone reviewing their password practices because they assume it will require a full-scale security project. In reality, the first step is simply to create structure around what already exists.

Password audits are also often overlooked because credential risk tends to build quietly. Unlike a software outage or a phishing incident, poor password hygiene isn’t always obvious. Weak passwords, unnecessary access, dormant accounts, and informal sharing practices can remain in place for months without drawing attention. By the time they are noticed, they are often deeply embedded in day-to-day operations.

A password audit brings this hidden risk to the surface. It collects evidence and gives an organization the visibility and ownership it needs to strengthen access control, improve storage practices, and make more consistent security decisions.

Turn your password audit into an ongoing control

A password audit becomes much more valuable when it is part of an ongoing practice rather than a one-off review. Credential risk keeps growing if it isn’t addressed. Access changes as people join, leave, change roles, adopt new tools, or work with external partners for limited periods. If a review only happens once, the findings begin to age almost immediately.

Centralized password management is your best investment. It gives IT teams more than a secure place to store credentials. It creates the visibility and control needed to review access more consistently, enforce stronger standards, and respond faster when something needs attention.

Choosing a password manager for IT teams supports this operational model through effective admin dashboards, centralized administration, team policies, role-based access, SCIM provisioning, SSO, and audit logs, turning password management into a stronger operational and compliance control.

Can your ISP see what you do? Yes, in more ways than you think

Edward Komenda — Wed, 15 Jul 2026 16:10:00 GMT

Every time you browse the web, your activity passes through your internet service provider (ISP). While encryption prevents ISPs from seeing everything you do, they can still collect a surprising amount of information about your habits, both on and offline.

Whether you’re checking your bank account, streaming a movie, shopping online, or scrolling social media, every connection to the internet passes through your ISP. Unlike Google, Meta, or Amazon, you can’t simply log out of your ISP or choose not to use it. It’s an unavoidable part of modern life.

In this guide, we’ll explain what information ISPs can collect, how they use it, why privacy advocates have raised concerns about ISP tracking, and what you can do to reduce the amount of information your provider can access.

What can your ISP really see?

Modern websites typically use HTTPS encryption to protect the data you send and receive. That encryption limits what your ISP can see, but it doesn’t make your browsing completely private.

HTTPS prevents your ISP from reading the contents of encrypted webpages. For example, if you’re browsing Reddit, your ISP can’t see what posts you’re reading. If you’re logged into your online banking, it can’t see your account balance or transactions.

Depending on your connection and the services your provider offers, your ISP may be able to see:

The websites and domains you visited
When you visited them
How long you remained connected
The amount of data you transferred
Your approximate physical location through your network connection
Which devices are connected to your home network

This information comes from DNS requests, connection metadata, and the network infrastructure that routes your internet traffic.

A 2021 report from the US Federal Trade Commission examined the data practices of six major ISPs serving roughly 98% of the US mobile internet market. It found that several providers collected large amounts of customer data, combined information across different products and services, and shared it with third parties with limited opportunities for users to opt out.

For providers that also operate email services, search engines, television platforms, or smart home products, the amount of data collected can be even broader.

Why ISPs have so much data

Unlike individual websites or apps, your ISP sits between you and the internet itself. Every website you visit, every app you open, every connected device in your home ultimately communicates through your internet provider. That gives ISPs visibility into activity across your entire digital life rather than within a single service.

Some providers have expanded well beyond broadband connections. They also offer:

Mobile phone services
Television platforms
Email services
Smart home devices
Cloud services
Search products

This allows some companies to combine information from multiple services to build a more detailed picture of their customers.

According to the FTC report, several ISPs used this combined data to place customers into advertising categories based on inferred characteristics, including interests and demographics, before sharing those audience segments with advertisers and other third parties.

Unlike social media platforms, however, most consumers have very limited choice when it comes to broadband providers. In many areas, households have only one or two realistic options for internet access.

How ISP privacy protections changed

While privacy laws differ around the world, and several US states have since introduced their own protections, there is still no single federal privacy standard governing how ISPs collect and use customer browsing data. For consumers, however, the result is a patchwork of protections that often depends on where they live.

In 2016, the US Federal Communications Commission (FCC) adopted privacy rules that would have required ISPs to obtain customer consent before collecting and monetizing certain types of browsing data. However, Congress repealed those rules before they ever took effect.

In 2017, Congress repealed the regulations using the Congressional Review Act. Later that year, the FCC also voted to repeal net neutrality protections, with those changes taking effect in 2018.

Together, these changes significantly reduced federal oversight of how ISPs handle customer data and manage internet traffic. While some states have introduced stronger protections, privacy rules for ISP customers still vary widely depending on where they live.

Can your ISP slow your connection?

ISPs don’t just provide access to the internet. They also control the infrastructure your data travels across, giving them significant influence over how internet traffic is delivered.

One of the best-known examples involved Netflix and Comcast. In 2013 and 2014, Netflix customers on Comcast experienced severe performance problems as streaming quality deteriorated. Netflix argued that Comcast used its market position to demand additional payments for direct network connections before restoring normal service, with the company’s CEO describing the arrangement as an “arbitrary tax.”

The issue resurfaced in 2024 when Netflix argued before the FCC that ISPs which also own competing streaming platforms may have financial incentives that create conflicts of interest, even if no specific act of interference can be proven. Rather than alleging deliberate sabotage, Netflix argued that the structure of the market itself creates incentives that can disadvantage competing services.

A separate example emerged during California’s 2018 Mendocino Complex Fire, when the Santa Clara County Fire Department reported that Verizon had throttled the data connection used by one of its emergency response vehicles. According to the department, internet speeds were dramatically reduced while firefighters coordinated operations across the state, and restoring normal service initially required upgrading to a more expensive plan before Verizon later described the incident as a customer support mistake.

While these throttling incidents involved very different circumstances, both illustrate the level of control internet providers can exercise over the networks that millions of people rely on every day.

Can your Wi-Fi router track you inside your home?

One of the lesser-known developments in networking technology is Wi-Fi sensing. For over a decade, researchers have demonstrated that Wi-Fi signals can be used to detect movement by analyzing how wireless signals reflect off people and objects inside buildings. Academic studies have shown these techniques can identify movement, breathing patterns, and even estimate body position through walls under controlled conditions.

Today, some routers and smart home devices include forms of human presence detection designed to automate lighting, security systems, and other connected devices. Industry estimates suggest that tens of millions of US households already have access to some level of Wi-Fi sensing technology through ISP-provided hardware. One Verizon Fios router included built-in human presence detection, while Wi-Fi sensing company Cognitive Systems partners with more than 160 internet providers.

It’s important to distinguish between today’s consumer products and what’s possible in research laboratories. Most commercially available systems perform relatively simple presence or motion detection rather than identifying individuals or reconstructing detailed movements. Even so, the technology highlights how much capability now exists inside devices that many people simply rent from their ISP.

Because providers often control the firmware on ISP-issued routers, they also control which features those devices receive over time. While there’s no evidence that today’s consumer routers perform the more advanced forms of Wi-Fi sensing demonstrated in research, the technology illustrates how networking hardware continues to evolve, and why it’s worth understanding what your devices are capable of.

How to reduce ISP tracking

Although your ISP handles your internet traffic, you can reduce how much information it can collect. While no single privacy tool prevents all forms of tracking, combining several measures can significantly limit what your provider is able to see.

Use a VPN

A VPN encrypts your internet traffic before it leaves your device. Instead of seeing every website you visit, your ISP generally sees only that you’re connected to a VPN server. This prevents your provider from monitoring your browsing destinations through normal connection metadata.

Switch to encrypted DNS

Traditional DNS requests can reveal the websites you visit, even if the contents of those websites are encrypted. Using encrypted DNS technologies such as DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) helps prevent ISPs from viewing those requests in plain text. Many modern browsers and operating systems now support encrypted DNS. People using Proton VPN also have their DNS requests encrypted by default.

Use your own router

Many households simply use the router supplied by their ISP, but purchasing your own compatible router gives you greater control over firmware updates, security settings, and available features.

Enable HTTPS whenever possible

Most websites already use HTTPS by default, but it’s still worth ensuring your browser always prefers encrypted connections. HTTPS doesn’t hide which websites you visit, but it does prevent your ISP from viewing the contents of encrypted webpages, adding another layer of privacy to your online activity.

Your ISP may not see everything, but it still sees a lot

Your ISP occupies a unique position in your online life. It doesn’t necessarily know every page you visit or every message you send, but it can often see where you’re connecting, when you’re online, and how much data you’re using. In many cases, it can also control the hardware that connects your home to the web.

As networking technology continues to evolve, that visibility may expand even further.

Fortunately, protecting your privacy doesn’t require disconnecting from the internet. Simple steps like using a VPN, enabling encrypted DNS, choosing your own router, and understanding what your ISP can and can’t see can significantly reduce the amount of information your provider is able to collect.

While individual privacy tools can’t solve broader regulatory or industry issues, they can help you take back some control over your online activity.

Keep communicating through any downtime with Proton’s business continuity solution

Raphael Auphan — Wed, 15 Jul 2026 11:58:24 GMT

Technical outages are becoming more frequent, ransomware attacks are spreading to smaller businesses, and the US administration has become more aggressive in restricting access to American technology.

No matter the cause or duration, every tech stack disruption stops your team from collaborating and your clients from reaching you. If you’re running a business, it means costly downtime. For governments or nonprofits, your mission could be at stake.

To help you stay operational through an outage, Proton services are now available as a business continuity solution. Over 100,000 organizations already use Proton Mail as their primary email provider because it’s more secure and private than Big Tech tools and operates on independent infrastructure based in Europe. Our Easy Switch for Business tool makes the transition simple. But for organizations that aren’t yet ready to ditch Big Tech entirely, you can now get the benefits of Proton for out-of-band communications.

When a crisis hits, you’ll be able to keep sending emails in Proton Mail, hosting video calls with Proton Meet, and staying productive in Proton Workspace. Setup is easy, and switching over during an outage is as simple as updating a single setting.

Why plan for outages

Many of the services you use every day share the same underlying infrastructure. The email and messaging apps your team relies on often run on a small handful of providers behind the scenes — Amazon Web Services, Microsoft Azure, and Google Cloud underpin most of the internet’s third-party software.

When one of them goes down, it can take your inbox and business communications down with it, all at once.

But the risk of relying on Big Tech is much bigger than the risk of downtime. US-based providers are legally obligated to comply with their own government — including orders to restrict or cut off service to customers outside the US.

No matter where your business is headquartered, your access to the tools you depend on could be revoked, not by a technical failure, but by a political one.

By design, Proton’s European infrastructure exists safely outside the Big Tech ecosystem, and our legal jurisdiction is in neutral Switzerland. We also have a 10-year track record of industry-leading uptime (we guarantee 99.95% under our SLA). All this makes Proton perfectly suited for any business seeking secure communication tools in an emergency.

Learn how to restore communication with Proton

A fallback that keeps you connected in a crisis

Your entire team can switch over to Proton Mail and Proton Meet for end-to-end encrypted email and video conferencing the instant your main communication service becomes unavailable.

You’ll be able to stay in touch with colleagues, communicate with partners, and support your clients seamlessly.

Here’s how to get set up and switch over during an incident:

Before an incident

1. Consult with our team
We start by understanding your existing business continuity framework — what you already have in place, where the gaps are, and which people and functions need to stay operational in a crisis. From there, we recommend the right mix of active and dormant accounts for your organization.

2. Designate your accounts
Active accounts go to the people who need to be operational at any minute, such as your IT administrators, business continuity coordinators, and senior leadership.

They can log in, configure the environment, and test the service at any time — before an incident occurs.

Dormant accounts are for other users who would only be activated during an incident. They’re pre-provisioned — set up with addresses that are tied to the right user and permission group and ready in the system to be activated instantly — at a reduced price.

3. Configure your domain
You can set up your organization’s email domain (e.g., “yourbusiness.com”) inside Proton Mail in advance.

By doing so, you’ll be ready to use your same email addresses within Proton Mail without any interruption. Or set up a new domain in advance, so you can forward mail and test the service before you need it.

You can also do both, combining a seamless transition for your team with the ability to prepare and test ahead of time.

During an incident

1. Activate dormant accounts
When a trigger event occurs, your IT administrator makes one DNS change — updating the MX record to point to Proton’s mail servers instead of your primary email service (whether Google’s or Microsoft’s or another). That’s all it takes.

Administrators can distribute credentials to their team ahead of time or share access links after the trigger event. Dormant accounts become active once users log in.

2. Your team logs in
Employees access their Proton Mail inbox using the credentials or access link provided by their administrator. There’s nothing new to install, no credentials to reset, and no training required in the middle of a crisis.

3. Keep operating
Your team has access to Mail and Meet. All of it runs on Proton’s independent infrastructure in Europe — separate from Google, Microsoft, and AWS — so whatever took down your primary stack won’t affect Proton.

Learn how to restore communication with Proton

Start preparing for disruption of your primary mail system today

Outages of some kind are all but inevitable. Whether it’s in a week or a year, preparing now will make the difference between a managed response and an operational crisis.

Talk to us about how Proton fits into your business continuity plan

Learn how to restore communication in a crisis with Proton