The Proton Blog

Google’s selfie video sign-in puts your face on its servers

Elena Constantinescu — Fri, 16 Oct 2026 20:38:57 GMT

Google now lets you sign in to your Google Account with a selfie video. You film your face once, Google stores the clip on its servers, and if you get locked out, you record a new one that Google compares against the original.

The company presents selfie video verification as a backup for people who lose the device that holds their passkeys, next to recovery phones and recovery emails. The cost is a reference recording of your face, in motion and from several angles, stored on its servers under rules it can change.

Once Google holds that recording, it could help train its AI, power age checks, or end up in a government data request, and Google’s privacy promises leave room for all three. Here’s what that means for your privacy.

How Google’s selfie video verification works
Your face lives on Google’s servers, for as long as its rules allow
Could your selfie video end up training Google’s AI?
What Google stores, the US government can request
Age checks need a face, and Google already has yours
Facebook video selfie verification
Account recovery doesn’t need your face on Google’s servers
Give Google less of you

How Google’s selfie video verification works

To use Google’s selfie video verification, you have to enroll. While signed in, you look at your camera and follow guided head movements so Google capture several angles. The recording is then stored on Google’s servers and used as your reference video.

When you need to get back in, you have to record a new selfie video, which is compared to the reference video. Liveness checks, synthetic media detection and, on some devices, hardware signals that the video came from a real camera are meant to stop photos and deepfakes.

After a significant change in appearance, you delete the old reference video and record a new one, and Google may ask you to update it periodically.

Your face lives on Google’s servers, for as long as its rules allow

Google stores the reference video on its servers so the feature works across devices. It does not offer an option to keep it on your phone, though it could have asked for a separate reference on each device, as face unlock does. Because the matching runs on Google’s servers, Google can decrypt the video.

Deleting the video removes it from Google’s servers. According to its general privacy policy, it takes around 2 months to clear active systems, up to 6 months for backups, and longer when Google cites security, fraud prevention, or legal requests.

Could your selfie video end up training Google’s AI?

Google says the video is used only to sign you in, and that allowing it to improve its verification technology is optional. It’s unclear whether that refers to face matching only or extends to broader AI training, such as for its Gemini models.

Before you consider opting in, remember that what Google knows about you is valuable. A reference video refreshed over years shows how a face ages. A re-enrollment after a drastic change, when Google no longer recognizes you, shows which features stay the same.

Letting Google use your video to improve its verification technology may be optional, but it’s important to remember that Google privacy settings and policies shift, especially when it comes to AI. In June 2026, Google changed settings for Search, Maps and Translate so saved images, audio and video can train its AI models, which effectively opted everyone in by default.

What Google stores, the US government can request

As a US company, Google must answer FISA orders, CLOUD Act demands for data stored anywhere in the world, and National Security Letters, which usually come with gag orders that stop Google from telling you. Proton research on Big Tech government requests found US account disclosures at Google grew 557% between late 2014 and early 2025. Beyond handing over data on request, the company signed a deal letting the Pentagon use its AI for classified military work.

Google points to two safeguards:

Its system only checks a selfie against the video on the same account and can’t search accounts by face.
The selfie you record when signing in is deleted right after the check.

Neither safeguard covers the reference video, which stays on Google’s servers until you delete it. Anyone who obtains that file, through a court order, a breach or a future product, could run it through a face recognition system.

Age checks need a face, and Google already has yours

Age verification laws make online services check how old you are, usually with an ID scan or a face scan that estimates your age. Some form of it is already law in the UK, Australia, France, Italy, Germany and 25 US states.

Google already tests machine learning to estimate whether US users are under 18, and asks people it flags by mistake to prove their age with a selfie or ID. It also says selfie video sign-in may be restricted for younger users. A verified, liveness-checked face video is exactly what facial age estimation needs. Google hasn’t announced that use, but as age verification laws spread, it has the data ready, and age check results tend to persist and get linked to accounts.

Facebook video selfie verification

Google isn’t the only Big Tech company turning your face into a login. Meta uses video selfie verification on Facebook to confirm identity, including to recover hacked accounts. When it started testing, Meta said it compares the video with the account’s profile photos and deletes the facial data after matching. Google goes further by asking for a dedicated reference video and keeping it.

Account recovery doesn’t need your face on Google’s servers

Google secure sign-in already works without your biometrics. Passkeys and on-device unlock check your face or fingerprint locally, and only a cryptographic proof leaves your device. Google itself recommends passkeys as the main way to sign in. You can change a password but not your face, so a cloud copy of it is a permanent risk taken on just to help you get back in if you lose the device that holds your passkeys.

To stay recoverable without a face video:

If you’ve already enrolled and want to stop Google from using your selfie video to improve its systems, keep the option to improve Google’s verification technology switched off.
To leave selfie video sign-in altogether, delete the video in your Google Account.
Use passkeys, and store them in a password manager that syncs them across your devices with end-to-end encryption.
Save backup codes and set a recovery email and phone you control.

Give Google less of you

Selfie video is one more piece of you that Google holds. Every feature that asks for your face, voice or habits adds to the same profile, governed by the same shifting policies and exposed to the same government requests.

If you’re thinking about deGoogling your digital life, Proton is a European alternative that helps you stay in control of your data. Protected by end-to-end and zero-access encryption and Swiss privacy laws, your sensitive data stays private. Not even we can access your encrypted content. Unlike Google, our business model doesn’t rely on advertising, and we don’t use your data for AI training.

Security incident logs: How to create logs that satisfy GDPR and regulators

Kate Menzies — Fri, 16 Oct 2026 17:31:30 GMT

The most difficult part of a security incident usually occurs after the incident itself is over: when the business has to explain what happened, when it was discovered, what data was involved, who was affected, and why certain decisions were made.

For many SMBs, these records don’t exist in a complete form. Details may be scattered throughout chat messages, inboxes, helpdesk tickets, screenshots, and in team members’ memories. Businesses stay afloat during an incident with these patchwork records, but they become an issue when supervisory authorities, an insurer, a customer, or a board member asks for a clear timeline.

Businesses of all sizes need a thorough security incident log. It should be a single source of truth to record what happened, how the incident was handled, and what evidence supports the decisions made along the way.

The record is valuable even when you don’t need to report an incident. We’ll explain why security incident logs are helpful for your business and how to create your own.

Why security incident logs matter

Incident logs vs incident response plans

What a security incident log should contain

A simple incident log template for SMBs

How to record notification decisions

What supervisory authorities expect from security incident logs

The credential access log

Why security incident logs matter

Security incident logs create accountability at the moment a business is most likely to lose track of details. During an incident, actions happen quickly: passwords are reset, accounts are disabled, IT providers are contacted, customer data is checked, and leadership is briefed. Those steps may be exactly what the business needs at the moment, but they become much harder to explain later if no one records when each action happened, who approved it, and what evidence supported the decision.

For businesses based in Europe, this isn’t just good practice. Under the General Data Protection Regulation (GDPR), both in the UK and EU, personal data breaches need to be assessed, and some must be reported to the corresponding supervisory authority.

In the UK, the ICO’s report a breach⁠ guidance explains that organizations must assess the likely risk to people’s rights and freedoms and notify the ICO when that risk is likely. Article 33 also requires controllers to document personal data breaches, including the facts of the breach, its effects, and the remedial action taken. The same requirements apply under the EU GDPR.

For example, the ICO does not expect every SMB to have enterprise-grade systems, but it does expect appropriate records. Its breach response and monitoring framework says organizations should have procedures to make sure personal data incidents and breaches are detected, managed, and appropriately recorded. That means an incident log should not be created only when a serious breach has already happened. It should be part of the normal response process.

Good records also support insurance claims. Cyber insurers may ask for evidence of when the incident was discovered, what containment steps were taken, which accounts were affected, and whether the business followed its incident response process. A well-kept log can show that the business acted promptly and consistently.

It also helps the company learn. Memories and oral records aren’t reliable, but a record that shows the incident began with a reused password, missing multi-factor authentication (MFA), vendor access, or delayed offboarding gives the business something concrete to fix and a clearer direction for strengthening security over time.

Incident logs vs incident response plans

A security incident log and an incident response plan are connected, but they are not the same document.

An incident response plan explains what the business should do when something goes wrong. It assigns roles, escalation routes, containment steps, communication responsibilities, and recovery procedures. The incident log records what actually happened. It is the timeline, evidence trail, decision record, and follow-up file for a specific event.

That distinction matters because even a good plan can fail without documentation. A business may follow the right steps but still struggle to prove it later. The log should make it possible to answer practical questions: when did we know, who acted, what did we contain, what data was at risk, what did we decide, and what changed afterward?

Incident response plan: What your business should do	Security incident log: What actually happened
Who leads the response Who contacts IT, legal, insurer, or regulators How to contain, recover, and communicate	When the incident was discovered Which systems and data were affected What actions were taken, by whom, and when

What a security incident log should contain

A useful incident log needs to be consistent enough for a business to reconstruct the event later and explain the decisions made during the response.

Date and time of discovery

Record when the business first became aware of the incident, who noticed it, and how it was discovered. If the time is approximate, mark it as approximate. Discovery time matters because GDPR reporting timelines and insurance requirements often depend on when the business became aware of the issue.

Nature of the incident

Describe what happened in plain language. Avoid vague labels such as “security issue” or “possible breach” without context. The log should explain which systems were affected and whether the incident involved credentials, email, files, customer data, payment systems, endpoints, or third-party access.

Data involved

If personal data may have been affected, record what kind of data was involved: names, email addresses, phone numbers, addresses, account details, financial information, employee records, customer communications, login credentials, or any other relevant category. Estimate how many individuals may be affected, and make clear whether the number is confirmed or still under investigation.

Likely cause

Record the known or suspected cause, even if the investigation is still ongoing. As new details emerge, the log can be updated from “cause unknown” to “phishing email led to credential compromise” or “former contractor account remained active.” The log should show how the business’s understanding changed over time.

Immediate containment actions

Document what was done to limit damage. This may include password resets, session revocation, MFA enforcement, account suspension, mailbox rule removal, device isolation, vendor access removal, firewall changes, or temporary service shutdowns. Where possible, include the owner and timestamp for each action.

Notification decisions

Record whether the business notified the relevant supervisory authority (the ICO in the UK, or the national data protection authority elsewhere in the EU affected individuals, customers, suppliers, insurers, legal advisers, or law enforcement. If the decision was not to notify, document the reasoning. That explanation is often as important as the notification itself.

Remediation steps and timeline

Containment addresses the immediate incident. Remediation reduces the chance of the same issue happening again. Record follow-up actions such as enforcing MFA, removing shared credentials, updating access policies, improving offboarding, fixing a misconfiguration, or changing how backups are protected.

Lessons learned

End with what the business learned and what will change. This should not be written as blame. It should identify the weakness, the improvement needed, and who owns the follow-up.

A simple incident log template for SMBs

Specialist software isn’t necessary for documenting incidents. A spreadsheet, secure internal form, ticketing system, or shared register can work if access is controlled and entries are kept consistent.

An effective incident log should include these fields:

Incident ID: A unique reference number.
Date and time discovered: When the business became aware of the incident.
Reported by: Employee, provider, customer, vendor, monitoring alert, or external party.
Incident type: Phishing, malware, credential compromise, data loss, unauthorized access, ransomware, supplier incident, device loss, misdirected email, or other.
Summary: What happened, written in plain language.
Systems affected: Applications, accounts, devices, databases, inboxes, or third-party services involved.
Data involved: Whether personal data was affected, what type, and how many people may be impacted.
Likely cause: Known, suspected, or under investigation.
Containment actions: What was done immediately.
Notification decision: Supervisory authority, individuals, customers, insurer, or no notification with reasoning.
Evidence links: Screenshots, tickets, logs, emails, access records, export files, or provider reports.
Remediation actions: Steps taken after containment.
Owner: Person responsible for follow-up.
Status: Open, monitoring, contained, resolved, closed.
Lessons learned: What should change.

How to record notification decisions

Notification decisions deserve their own space in a security incident log because they’re often reviewed after the incident.

Under both UK and EU GDPR, organizations must assess the likely risk to people’s rights and freedoms when a personal data breach occurs. If risk is likely, the supervisory authority must be notified as soon as possible and, where feasible, within 72 hours, the ICO in the UK, the national data protection authority in each EU member state. If the risk is high, affected individuals must also be notified without undue delay. The thresholds and the clock are the same on both sides; only the authority changes.

A good incident log should show that the business made this assessment. It should record whether personal data was involved, what kind of harm could result, what protections were in place, and why the business decided to report or not report.

For example, an incident involving an exposed admin password may not immediately reveal whether personal data was accessed. The log should reflect that uncertainty. It can record the initial concern, the investigation steps, the account activity review, and the final conclusion once evidence is available.

At this point in the process, many businesses focus on organizing the technical fix and forget to record the compliance reasoning. Passwords are reset, accounts are secured, and operations continue. Weeks later, the business can’t explain why it decided the incident was not reportable.

What supervisory authorities expect from records

Supervisory authorities do not only look at whether a breach was reported. They may also ask how the business:

Identified the incident
Assessed the risk
Decided whether notification was required
Documented the actions taken

A good record should make the story of the incident clear from beginning to end. It should show what happened, what personal data was involved, what harm could result, what the business did to contain the issue, and why it reported or did not report the breach.

The level of detail should match the seriousness of the incident. A misdirected email will not need the same record as a ransomware attack, but it still needs to be documented to show that the business assessed it properly.

These records should also be stored securely. Incident logs may include sensitive details about affected individuals, exposed systems, employee actions, screenshots, access logs, or remediation steps. Access should be limited to the people who need it, and retention should align with the company’s wider data retention policy.

The credential access log

Many incidents involve credentials: they can be triggered by a reused password, shared account, compromised inbox, exposed admin login, suspicious MFA prompt, or an employee who wasn’t offboarded properly.

For that reason, credential access records can become a direct input into cybersecurity incident documentation. When an incident involves a shared login or sensitive account, the business needs to know who had access, how access was shared, whether permissions changed, and whether the credential was rotated after the incident.

A business password manager⁠ like Proton Pass for Business helps teams manage credentials in encrypted vaults, generate unique passwords, use autofill, share credentials securely, manage passkeys, and use built-in two-factor authentication. For incident documentation, the strongest value is the access trail around credentials: who had access to shared vaults/accounts, how access was managed and who used it, and what changed after the incident.

A password manager for IT teams adds admin features such as policies, reporting, logs, role-based access control, SCIM provisioning, and SSO integration. These features can help businesses show how credential access is controlled and provide evidence when a credential-related incident is investigated.

A password manager can’t replace an incident log, legal assessment, regulatory notification process, or incident response plan. But it provides credential evidence that can feed into those processes.

Keep a complete audit trail of credential access with a business password manager⁠.

Third-party vendor risk management: How to assess and monitor your supply chain security

Ben Wolford — Fri, 16 Oct 2026 17:28:06 GMT

Most businesses don’t just rely on internal systems. They run on cloud platforms, payroll providers, marketing tools, IT partners, and dozens of SaaS accounts that keep daily work moving. Each vendor solves a problem, and each one also creates a new relationship of trust.

Vendor risk management (VRM) is the process of assessing, approving, monitoring, and reviewing the security risks that come from working with third parties. It helps businesses understand which vendors can access sensitive systems or data, which controls those vendors have in place, whether their security practices are sound enough to justify that access, and how quickly access can be changed if a contract ends or an incident happens.

We’ll explain how to approach vendor risk management within your own business: how to assess the vendors you already work with, how to classify third party vendor risk, what to include in a vendor security checklist, and how to control vendor credentials before they become long-term exposure.

What vendor risk management covers

Your guide to vendor risk management

Your vendor security checklist

How Proton Pass for Business supports vendor access control

What vendor risk management covers

Vendor risk management is powered by a simple principle: every external party that touches your data, systems, or business processes changes your risk profile.

Most vendor risk is created by everyday work. For example, a third-party agency may be brought into a business network because a team needs speed, expertise, or software the business does not have in-house. Access is granted, data is shared, and the relationship is established as part of everyday work.

Risk is created when it’s not clear what that vendor can access, which controls stand between that access and a breach — multi-factor authentication (MFA), named accounts, encryption — or how quickly that access could be found and cut off. Revoking it usually happens within the system itself or through SCIM provisioning; the hard part for most businesses is knowing where to actually look.

The vendor may be a large cloud provider, a niche SaaS platform, a freelance developer, or an accounting firm. The size and industry of the vendor is not the main issue. Their access is.

Vendor risk manifests in several different ways:

Data risk: The vendor can view, store, process, transfer, or delete business or personal data.
Access risk: The vendor can log in to systems, manage settings, use integrations, or reach admin panels.
Operational risk: The business depends on the vendor for a critical workflow, service, or customer-facing process.
Compliance risk: The vendor’s role affects your obligations under data protection laws (such as GDPR compliance requirements), contractual, or sector-specific requirements.
Credential risk: Vendor access is shared, reused, undocumented, or difficult to revoke.

Vendor risk is difficult to spot because it often builds through small access choices that make sense in the moment: A team member shares a login they shouldn’t, or a supplier account retains permissions for convenience, or a contractor permission that no one revisits after the project ends. Over time, those exceptions become part of the business environment, even when no one is actively managing them.

How to build a vendor risk management (VRM) process

Done effectively, vendor risk management doesn’t make every decision more complicated. It creates a reliable framework for how your business grants access with clearer limits. We’ll explore the key steps your business can take to assess your own vendor risk and build a risk management strategy.

1. Build an inventory of your vendors

Instead of letting vendor risk management become a reactive task when you’re asked for security evidence or renewing a contract, make it a proactive task. Start by understanding the vendors already inside your operations.

Taking a vendor inventory doesn’t need to be complex. It needs to be clear enough to show:

Who owns the relationship
What service the vendor provides
Which systems or data they can access
Whether personal data is involved
Whether subprocessors are used
When the next contract or security review is due

Access is a crucial component to record because vendors have different privileges and access needs. Some vendors use named accounts. Others rely on shared credentials, admin access, API keys, shared inboxes, or temporary logins that remain active long after the original need has passed. These differences matter because they determine how quickly access can be changed during offboarding or an incident.

The inventory should also include smaller vendors that may sit outside formal procurement. A plugin, consultant, freelance developer, agency, or specialist SaaS service can create meaningful exposure if it touches sensitive data or critical workflows.

The main value of an inventory is creating better access controls. When a vendor relationship ends, your business knows which accounts to disable, which credentials to rotate, which integrations to remove, and what should happen to stored data.

2. Classify vendors by risk, not convenience

After mapping your vendors, group them by the risk they create. This keeps the process proportionate and avoids treating every supplier as either harmless or critical.

High-risk vendors usually process sensitive data, support essential operations, or hold privileged access. This may include cloud infrastructure, identity platforms, payroll, finance, HR systems, managed IT, security services, or core SaaS platforms.

Moderate-risk vendors support important work but have narrower access. They may include collaboration platforms, analytics tools, project management systems, help desk software, or agencies with limited permissions.

Low-risk vendors have little or no access to sensitive data or business-critical systems. They should still be recorded, but they do not need the same depth of review unless their role changes.

The tier should follow the actual access, not the vendor’s reputation, size, or price. A familiar platform can become high risk if it stores sensitive data. A small contractor can be at high risk if they hold admin privileges.

Use the risk tier to decide how deeply to assess the vendor, how often to review the relationship, and which minimum controls apply.

3. Set security requirements before access is granted

Vendor assessments work best when the business knows its minimum requirements before access is approved.

For high-risk vendors, those requirements should cover the controls that protect data and keep access accountable: MFA, encryption in transit and at rest, role-based access control, audit logs, incident response procedures, vulnerability management, subprocessor controls, data deletion commitments, and business continuity planning.

Security evidence can support that review. ISO 27001, SOC 2, national schemes such as Cyber Essentials in the UK, penetration test summaries, or security whitepapers can all help, depending on the vendor’s role and the sensitivity of the relationship.

Certifications and audit reports describe how a vendor operates. They say much less about who the vendor actually is. A recent investigation into Passwork’s safety proves that this distinction matters: a European registration, a polished website, and a “built for trust” message were enough to clear the bar at organizations that never traced the ownership, jurisdiction, or origin of the code they were installing.

For any vendor holding sensitive access, two questions belong alongside the control checklist: who owns and controls the company, and under which country’s laws does it operate; and can independent experts inspect the code, or is the business trusting a closed system on the vendor’s word alone?

Moderate-risk vendors may need a lighter review, but they should still be able to explain how they protect accounts, restrict employee access, handle data, notify customers of incidents, and remove access when the relationship ends.

For low-risk vendors, the main check may be whether they truly have no access to sensitive systems or personal data. If that changes, the vendor should be reassessed.

A good process is strict where risk is high and lightweight where risk is genuinely low. It shouldn’t turn every supplier review into an enterprise audit, but it should prevent sensitive access from being approved on trust alone.

4. Monitor vendors after onboarding

Vendors change their systems, subprocessors, policies, staffing, and security controls. Your business may also give them more access over time. Without monitoring, your original assessment becomes outdated.

A practical monitoring process can include annual reviews for high-risk and moderate-risk vendors, checks before contract renewal, reassessment when access expands, and review after any reported incident. Critical vendors may need more frequent access checks.

Monitoring should include the credential layer. Check whether vendor accounts still belong to active contacts, whether permissions match the current scope, whether shared credentials still exist, and whether integrations or API keys are still needed.

This is where many businesses find avoidable exposure: old agency accounts, unused contractor logins, shared passwords that no one owns, integrations created for a past project, and admin permissions granted for convenience.

Vendor risk also belongs in continuity planning. If a critical supplier becomes unavailable, reports a breach, or forces emergency access changes, the business needs a way to keep essential work moving. Proton’s guide to business continuity strategies⁠ explains why resilience depends on more than backups, especially when access and credentials are involved.

5. Control third-party credentials

Many vendor risk programs look solid on paper and then fail at the credential level. A vendor can look compliant on paper and still create exposure through the way access is handled day to day.

The risk exists in the gap between the formal process and the realistic one: credentials stored outside approved systems, shared accounts with no clear owner, or API keys that stay active after the vendor relationship changes.

If those access paths are not reviewed and revoked, the business may keep carrying vendor risk long after the original work has ended.

Third-party access should follow the same discipline and use the same password policies as internal access:

Give vendors only the access they need
Use named accounts where possible
Avoid shared credentials unless there is no alternative
Store shared credentials in a controlled credential management system
Share files with vendors through encrypted cloud storage for business with expiring links, not email attachments
Review access regularly
Revoke access when work ends
Rotate credentials after vendor staff changes or incidents
Require MFA wherever the service supports it

A business password manager makes these rules easy to implement. It gives teams a secure place to store vendor credentials, share access without sending passwords through chat or email, rotate passwords, and remove access when a vendor relationship ends.

Your vendor security checklist

A vendor security checklist should help your business onboard new vendors securely.

Use it to understand the relationship clearly:

What data will the vendor access, process, or store?
Will the vendor process personal data on our behalf?
Will the vendor sign a data processing agreement (DPA) and delete our data when the contract ends?
Where will data be stored and processed?
Does the vendor use subprocessors?
Does the vendor enforce MFA?
How does the vendor control employee access to customer data?
Can our business assign role-based permissions?
Can access be removed immediately?
Does the vendor provide audit logs or admin activity reports?
How does the vendor encrypt data?
How quickly will the vendor notify us of a security incident?
Does the vendor have business continuity or disaster recovery procedures?
Can the vendor provide security documentation, certifications, or audit summaries?
Has the vendor experienced a publicly reported security incident, and how did they handle it?
Who owns and controls the company, and under which jurisdiction does it operate?
Is the product open source or independently audited, so its security claims can be verified?

The checklist should show any risk your business is accepting. A vendor that lacks formal certification may still be suitable for low-risk work. A vendor with admin access, weak authentication, vague incident timelines, or no clear deletion process is a different decision entirely.

For vendors already in use, bring the checklist back during renewals and scheduled reviews. The original approval may no longer reflect the way the tool is used today. A vendor brought in for a small project can quietly become part of customer operations, finance workflows, or critical integrations.

How Proton Pass for Business supports vendor access control

Vendor risk management becomes much harder when third-party access is managed outside a controlled system. A vendor may be approved, documented, and covered by contract, but the real exposure often depends on everyday access paths: shared credentials, permissions, passkeys, recovery codes, API keys, and accounts that need to be reviewed or removed as the relationship changes.

A business password manager like Proton Pass for Business⁠ helps businesses bring that access into a more secure and auditable process. Teams can store vendor credentials in end-to-end encrypted vaults, generate strong and unique passwords, use autofill to reduce manual handling, manage passkeys, and share access without sending passwords through email, chat, or project documents.

For vendor access specifically, shared vaults can help separate credentials by supplier, project, team, or sensitivity level. This makes it easier to keep access organized, review who has access to what, and remove access when a contract ends, a vendor contact changes, or an incident requires fast containment.

A password manager for IT teams⁠ adds the administrative layer needed as the process becomes more formal. Policies, reporting, logs, role-based access control, SCIM provisioning, and single sign-on integration help businesses manage access consistently across teams instead of relying on individual habits.

Proton Pass for Business supports your business by controlling the credentials and access paths vendors use to work with your business. It is also open source and independently audited, so it passes the same checklist we recommend you apply to your own vendors. When supplier access is stored, shared, reviewed, and revoked from a controlled environment, vendor risk becomes easier to manage beyond the initial assessment.

Control third-party credential access securely with a business password manager⁠.

How to prepare for a cyber insurance assessment: What underwriters check and how to qualify

Kate Menzies — Fri, 16 Oct 2026 17:24:58 GMT

Cyber insurance applications used to feel closer to paperwork. Today, they feel much more like a security review. A business owner or COO renewing a policy may be asked about multi-factor authentication (MFA), backups, access controls, staff training, patching, incident response, and password management before an insurer even confirms terms.

Underwriters want to know which controls are in place, where they apply, how consistently they are enforced, and whether the business can prove it. This is because cyber insurance can’t be used as a replacement for cybersecurity. It sits alongside security controls, incident planning, recovery processes, and risk management as part of managing cyber risk

For businesses preparing to apply or renew, here’s what you need to know about what insurers expect to see before they are comfortable taking on the risk.

What cyber insurance underwriters really check

The controls most insurers expect

A practical cyber insurance checklist

Why businesses struggle to qualify

How SMB risk affects insurance conversations

How Proton Pass supports cyber insurance readiness

What cyber insurance underwriters really check

A cyber insurance assessment is designed to understand how likely a business is to suffer a cyber incident, how severe that incident could become, and how prepared the business is to recover.

The underwriter is not only looking at what a company does or how much revenue it generates. They also want to understand how it handles access, credentials, data, systems, suppliers, and continuity. A company with weak admin controls, no MFA enforcement, and untested backups presents a different risk profile from one that can show clear policies, enforced controls, and recovery evidence.

That is why cyber insurance requirements often focus on operational security. Insurers want to know whether attackers can easily get in, whether the business can contain the damage, and whether essential systems can be restored without paying a ransom or remaining offline for days.

Cyber insurance underwriting can involve a detailed questionnaire, follow-up questions, evidence requests, scans, or calls with IT providers. For smaller businesses, this process may be difficult, especially when security hasn’t laid out formal processes.

For example, it isn’t enough to say that your company uses MFA. An insurer may want to know where and how MFA is enforced, whether it covers admin accounts, and which critical applications, if any, are left out. A stronger answer is specific, documented, and backed by evidence.

The controls most insurers expect

Cyber insurance requirements vary by provider, policy type, company size, and risk profile. Still, most assessments now look for the same basic signs: whether your business can prevent common attacks, limit the damage if an account is compromised, recover from disruption, and prove that controls are actually in place. This often includes how your business handles passwords. A strong password policy and a secure business password manager are among the most effective password management best practices you can put in place.

MFA

This is one of the first controls insurers look for because many claims stem from credential abuse. You may be asked whether 2FA is enabled for email, VPNs, remote access, cloud platforms, password managers, and other critical applications.

The assessment may also go further, asking whether MFA is enforced for all users, only for certain systems, or only for admin accounts, and how that enforcement actually works.

There’s a difference between MFA being available and MFA being mandatory: an underwriter will want to know whether it’s enforced, whether it’s configured at the identity provider or app by app, and what happens when someone fails or bypasses the prompt.

A stronger response shows where MFA is required, which applications are covered, how it is enforced, and how exceptions are approved and reviewed.

Admin and privileged account protection

Insurers also want to understand how your business protects accounts with elevated access. Admin accounts can change settings, create users, access sensitive data, disable security controls, or move across systems, which makes them especially valuable to attackers.

Businesses may be asked whether admin access is limited to specific people, reviewed regularly, protected with MFA, and separated from everyday user accounts. Evidence can include access policies, user lists, role-based permissions, and logs that show privileged activity.

Backups and recovery readiness

Backups matter because insurers look beyond prevention. They also want to know how quickly your business can recover. If a ransomware attack, accidental deletion, or system failure affects your business, the insurer wants to know whether it can recover without paying a ransom or losing critical data.

This usually means having backups that are regular, protected from unauthorized access, and tested. It isn’t enough to say backups exist. You should be ready to show what is backed up, how often backups run, where they are stored, who can access them, and when restoration was last tested.

Endpoint and email security

Many attacks start through an employee inbox or device, so insurers often ask about endpoint and email protection. This can include anti-malware, endpoint detection, spam filtering, phishing protection, and controls that block suspicious attachments, links, or login attempts.

For email specifically, insurers may also ask whether your domain uses email authentication (SPF, DKIM, and DMARC) to stop attackers from spoofing your company’s address.

For smaller businesses, this may be handled by an IT provider or through built-in features in the tools they already use. What matters is being able to explain what protection is active, which devices and accounts are covered, and how alerts or incidents are handled.

Patch management

Outdated software gives attackers an easier path into business systems. Because of this, insurers may ask how quickly your business applies security updates to operating systems, browsers, applications, servers, and other critical software.

They may also ask whether updates are automatic, manually reviewed, or managed by an external IT provider. A stronger answer explains who owns patch management, how updates are tracked, and how the business handles urgent vulnerabilities.

Employee security training

Insurers know that employees are often targeted through phishing, social engineering, fake invoices, malicious links, and credential theft.

Recurring security awareness training helps reduce that exposure, and phishing awareness training in particular addresses the attack type behind most credential-related claims. Still, the assessment may ask for more than a general statement that employees are trained.

Businesses may need to show how often training happens, what it covers, whether new employees receive onboarding, and whether staff know how to report suspicious activity. Practical, recurring training is more useful than a one-off session that no one revisits.

Incident response planning

A written incident response plan shows that your business knows what to do when something goes wrong. Insurers may ask whether your business has a documented process for identifying, reporting, containing, and escalating security incidents.

The plan should make clear who is responsible, who needs to be contacted, how evidence is preserved, and how the company communicates with employees, vendors, customers, legal counsel, or regulators when needed. Even a simple plan is better than relying on improvisation during a crisis.

Third-party access controls

Vendors, contractors, agencies, IT providers, and software partners can introduce risk when they have access to business systems or data. Insurers may ask whether third-party access is limited, reviewed, and removed when it is no longer needed.

They may also look for MFA on vendor accounts, separate credentials for external users, and a clear process for approving access. The business should be able to show who has access, what they can access, why they need it, and when that access was last reviewed.

A practical cyber insurance checklist

Before starting a cyber insurance application or renewal, your business should gather proof that its security controls are not only planned, but already working. Underwriters don’t expect every smaller business to have enterprise-level documentation. But they do expect clear answers, consistent practices, and evidence that the company can explain how access, recovery, training, and incident response are handled.

A checklist will not guarantee coverage or lower premiums, but it can make your assessment more effective, reduce back-and-forth, and help the business enter the underwriting process with stronger answers.

Cyber insurance readiness checklist

MFA

Evidence to prepare: List of systems where MFA is enforced, including email, cloud apps, remote access, admin accounts, and any documented exceptions.

Password management

Evidence to prepare: Password manager policy, user adoption records, shared vault structure, admin settings, and reports showing weak, reused, or exposed passwords.

Backups

Evidence to prepare: Backup schedule, storage location, access controls, retention policy, and the date of the most recent restore test.

Incident response plan

Evidence to prepare: Written response plan, escalation contacts, internal roles, reporting steps, and any recent tabletop exercise or plan review.

Training records

Evidence to prepare: Security training dates, attendance records, onboarding materials, phishing awareness content, and reporting instructions for employees.

Patch management

Evidence to prepare: Patch policy, update logs, list of covered systems, ownership details, and records for urgent vulnerability remediation.

Privileged access review

Evidence to prepare: Admin user list, role-based permissions, access review records, MFA status for privileged accounts, and offboarding documentation.

Why businesses struggle to qualify

Businesses often struggle with cyber insurance because the application exposes gaps that day-to-day operations can hide. A company may have MFA on some systems, backups in place, an IT provider on call, and employees who know the basics of phishing. But insurers look for consistency across the business: where controls are enforced, who owns them, how often they are reviewed, and what evidence supports each answer.

This is especially difficult for smaller businesses that have built security gradually, without formal documentation. Access may be granted through different systems, shared credentials may still live in spreadsheets instead of in a secure team password manager, backups may not have been tested recently, and security training may happen informally.

None of these issues automatically means a business is uninsurable, but they can create delays, exclusions, higher premiums, or follow-up questions during underwriting.

The strongest applications are usually not the ones with the most complex security programs. They are the ones that can clearly show how core controls work, where the remaining gaps are, and what the business is doing to close them.

How SMB risk affects insurance conversations

Insurers care about controls because small and mid-sized businesses are not invisible to attackers. Proton’s SMB Cybersecurity Report⁠ found that one in four SMBs were breached last year despite having cybersecurity measures in place. The report also points to human error, inconsistent security policies, and lack of data control as key causes.

Many businesses approach their cyber insurance applications with security measures already in place, but the assessment often shows whether those measures are consistent, current, and easy to prove. MFA may protect some accounts but not others. Backups may run on schedule but have no recent restore test behind them. Admin access may have expanded as the company grew, without a clear record of who still needs it.

For a COO or business owner, that scrutiny can be useful before the policy is even issued. It turns everyday assumptions into specific evidence: access lists, backup records, MFA coverage, password practices, documented policies, and known gaps. Instead of relying on what people believe is happening, the business gets a clearer picture of how its controls actually work.

Seen this way, the assessment is not only an obstacle to coverage. It can help the business identify the weaknesses that would matter most during a breach, and fix them before they become harder, more expensive, or more disruptive to address.

How Proton Pass supports cyber insurance readiness

Cyber insurance assessments look at the business as a whole, including backups, patching, incident response, employee training, network security, and vendor risk. A password manager can’t satisfy every requirement on its own, but it can strengthen one of the areas insurers examine closely: how your business handles credential management and access.

A business password manager like Proton Pass for Business⁠ helps teams replace insecure password habits with a more controlled system. Employees can create and store unique passwords in end-to-end encrypted password vaults, use autofill to reduce reuse, manage passkeys, and securely share credentials without relying on email, spreadsheets, chat threads, or browser-saved passwords.

Built-in two-factor authentication also helps teams keep passwords and verification codes in one secure workflow, instead of scattering access across different apps and personal devices, which adds friction and pushes people toward shortcuts.

As a password manager for IT teams, Proton Pass adds the visibility and control needed to make those practices easier to enforce. Teams can configure password requirements, enforce 2FA policies, manage vault access, assign role-based permissions, provision users with SCIM, support single sign-on (SSO), and use logs for compliance or incident response reviews. These features can support common underwriting questions around MFA, password management, shared credentials, privileged access, onboarding, offboarding, and access reviews.

The broader cyber insurance application will still need documentation across the rest of the security program. But for the credential portion of the assessment, Proton Pass can help your business give a clearer answer: who has access, how credentials are protected, how sharing is controlled, and what evidence is available when an underwriter asks.

Tick every cyber insurance box with a business password manager⁠.

Folders, URL matching, and compromised password alerts are now available for Proton Pass

Son Nguyen Kim — Thu, 15 Oct 2026 13:25:38 GMT

Following our summer roadmap, we’re releasing some updates for Proton Pass that our community have been requesting. We’ve focused on making Proton Pass easier to organize and control, and strengthening the account protection checks it conducts for you. With the latest version of Proton Pass, you can now:

Organize your vaults with folders
Customize autofill with URL matching
Protect your accounts with improved compromised password alerts

These features are rolling out gradually over the next few days and will be available for all users soon.

Make day-to-day life easier with folders

Whether for personal use or for work, most of us store hundreds, or even thousands of items in our password managers, so it can be difficult to find what you need. That’s why we’re releasing one of our most-requested features for Proton Pass: folders.

You can:

Organize vault items into folders and subfolders, to keep everything structured and easy to find rather than scrolling through one long list.
Drag and drop items across both folders and vaults for faster, easier organization.
Filter and search within a folder and its subfolders to find items easily.
Create nested folders to organize your items in as much detail as you need.

With folders and subfolders, you can organize passwords and items more effectively without creating more vaults than you need. For businesses, this means an easier way to manage team credentials in password vaults as your organization grows.

Folder sharing is on our roadmap. For now, folders follow the sharing settings of their vault.

Which Proton Pass plans include folders?

Folders are available on Proton Pass Plus, Proton Pass Family, and Proton Unlimited plans, as well as business plans, including Proton Pass Professional, VPN and Pass Professional, and Proton Workspace.

If you have a free or a Pass Essentials plan, you can’t create folders but you can use folders in vaults shared with you by anyone with a paid plan.

Try folders now or Upgrade your plan.

Customize autofill with URL matching

Using Proton Pass to autofill your passwords is one of the easiest ways to save time logging into your accounts. But there may be times when you want to disable autofill on specific websites or restrict it to an exact URL for security purposes.

Autofill behavior is now customizable, so you can decide when and where your information is filled in. We’ve added basic and advanced capabilities including parent domain and subdomains, exact host matching, or never on a URL you choose. For more control, advanced modes support wildcard patterns and regular expressions. You can also choose which fields to autofill, making forms easier to complete while keeping sensitive information from being filled in when you don’t want it to.

Stay safe with improved compromised password alerts

We’re adding compromised password detection to our existing checks for weak and reused passwords and breached email addresses. This new check happens locally on your device — no one at Proton Pass has access to your passwords or anything else in your vaults.

To check whether a password has been compromised, Proton Pass compares its fingerprint against a list of fingerprints from known data breaches published by security researchers. If there’s a match, you’ll be alerted so you can change your password.

Tell us what you think

Your feedback helps us understand what you want to use in Proton Pass, so share your thoughts on Reddit, UserVoice, and X. Thank you for being part of the Proton community and helping us build a truly private password manager.

Proton product roadmaps for autumn and winter 2026

Andy Yen — Thu, 15 Oct 2026 12:06:47 GMT

Getting away from Big Tech is rarely as simple as closing an account. Over time, a single provider can become woven into your digital life: Your files are stored there, your inbox runs through it, your logins depend on it, and so does the AI assistant you turn to for everyday tasks.

That makes switching less about replacing one product and more about untangling a whole ecosystem. This autumn and winter, our roadmap targets exactly those sticking points: moving your data out, covering every device you use, sharing access without giving away your most valuable information, and bringing assistance into the tools you already work in.

If you missed what we committed to earlier this year, our product roadmap for the first half of 2026 covers everything that came before.

Here’s what’s coming over the next six months.

Proton Mail

When choosing our privacy-first ecosystem, many people start with Proton Mail. This season, we’re making it easier to bring your old inbox over and to keep your new one under control.

Content search on mobile

Content search is almost here for Proton Mail on Android and iOS, rolling out over the coming weeks. Search the full content of your messages, not just subjects and senders, while Proton still can’t read a word of your inbox. Look for the detail you remember, like a delivery address, a project name, a phrase from an old conversation, and Proton Mail surfaces the messages that contain it.

Easier migration and account linking

Until now, setting up your Gmail connection required leaving the Proton Mail app to complete the process in a browser, and then coming back. We’re fixing that. Soon you’ll be able to set up your Gmail connection entirely within the Proton Mail mobile app. You’ll be able to send and receive from your Gmail address, have your recent messages imported, and manage everything without ever being bounced out of the app.

And we’re improving how external accounts are handled. If you first signed up for Proton through VPN, Drive, or Pass using a Gmail address, and later created a separate Proton Mail account, joining the two currently takes a manual process. We’re working to make this easier.

Free subdomains for business teams

Getting your team onto Proton Mail shouldn’t depend on owning a domain. We’re building free Proton subdomains for businesses, so your organization can claim an address of its own and start sending and receiving email right away. Every seat on your plan works from day one, with no registrar to deal with and no DNS records to configure. When you’re ready to connect your own domain, you can add it at any time, and your subdomain addresses will keep working.

Still in progress

We’re also putting the finishing touches on work from our last roadmap, including the next-generation Calendar, which we’re rebuilding from the ground up to give you a faster, smoother and more intuitive scheduling experience.

Proton Drive

A cloud drive earns trust through years of reliable service. For Proton Drive, our focus stays on the fundamentals: finding what you’ve stored, keeping every client fast and dependable, and making it practical to leave your old provider for good.

Search improvements on every client

We’re bringing improved search across all clients and more fields, now you will be able to search by more than just the file name on mobile and web. End-to-end encryption makes this a difficult technical problem, and we plan to roll out incremental improvements to search capabilities as they are developed — so think steady expansion rather than a single switch.

Continued performance and quality

Earlier this year, we rebuilt Drive around a single, shared engine that unifies all our cloud storage apps across platforms and powers all uploading, downloading, and encryption. We’re are now continuing to improve Drive so it’s faster and more reliable across clients.

For Docs and Sheets, the focus is also on stability and reliability, alongside some of the features people have asked for most: dark theme, editing Sheets on mobile, page breaks in Docs, ODT import and export in Docs, tables in Sheets, quick stats for selected cells in Sheets, and subscript and superscript in Docs. Check out the Docs and Sheets roadmap on Reddit.

Easy Switch from Google Drive

Moving your data from another cloud storage provider currently means downloading everything to a device and then manually uploading it again, which is time-consuming and difficult. We’re making it easier to switch from Google Drive, so your data doesn’t have to make that round trip.

Linux beta and folder sync on macOS

We are working towards releasing a beta of the official Proton Drive app for Linux. The initial launch will likely consist of our headless daemon mode only, meaning you’ll have a sync engine running that keeps a configurable list of directories up to date the same way it does on Mac and Windows.

That’s the same sync engine behind a major change on macOS: You’ll be able to select any folder for syncing on Mac, similarly to how you select folders on Windows today, with the same functionality on both platforms. It’s by far the biggest missing feature of the Drive Mac client.

Proton Pass

Proton Pass already makes it easy to securely store, use, and share credentials. Next, we’re expanding those capabilities with safer ways to share access, more seamless sign-in across devices, and more flexible tools for managing teams and organizations.

Stronger credential security and safer sharing

We’re adding the ability to share a login without revealing the password; recipients can sign in but never see the credential, which makes sharing with family, contractors, and teammates considerably safer. We’re also adding expiration for shared items and vaults, so access can end automatically after a set period instead of lingering until someone removes it manually.

Pass Monitor v2 will take a more proactive approach to your security. It brings a revamped UI and proactive alerts, notifying you directly about weak, reused, and compromised passwords, as well as breached email addresses, so you catch risks before they become a real problem.

Convenience and ease of use

Folders are being rolled out, letting you organize logins by project, team, or year. Next, we’re adding the ability to share folders and subfolders, just like vaults and items today, giving you more flexibility and control over how you grant access.

On macOS and Android, we’re improving autofill: deeper macOS integration so Pass autofills at the system level, and more reliable autofill on Android. We’re also adding support for credential exchange protocol to make it easier to move passkeys and credentials between password managers. The goal is to make Pass work more consistently wherever you sign in.

Improved organization management

Following Admin Roles, role-based access control extends to policies for specific users and groups. Org policies currently apply to everyone; this adds the ability to include or exclude individual users or groups, so permissions can match how teams actually work.

We’re also adding vault transfer on off-boarding, letting admins automatically move a departing user’s vault content to someone else when deleting their account. And org management moves into a revamped admin console: user and access management, authentication, security, billing, alerts, and action items in one central dashboard.

Proton VPN

A VPN can’t protect you when it’s off. And the easier it is to use, the more likely you’ll just keep it on. This is why we’ll be rolling out our intuitive new app design across all supported platforms, allowing you to feel at home on whichever device you’re using. We’re also improving our kill switch and making it simple to pause Proton VPN when you need to.

Redesigned apps for Linux, iOS, macOS, and Android TV

Last year, we overhauled our Windows app. Now we’re bringing the same intuitive, consistent, and native experience to macOS, iOS and iPadOS, and Linux. Our Android TV app will also connect faster and make the features you actually use even easier to reach.

A smarter kill switch

If your VPN connection drops, the kill switch ensures your real IP address isn’t exposed. We’re improving it on Linux, macOS, iOS, and iPadOS, and adding an advanced kill switch on macOS.

Pause and resume

Some sites and apps won’t work while your VPN is on, so you may sometimes need to briefly turn it off. The tricky part is remembering to turn it back on. With pause and resume, you’ll choose how long to pause, and Proton VPN will reconnect automatically when that time is up. This feature will come to Windows and Android first, with other platforms to follow.

Lumo

Lumo 2.0 reshaped the core experience of our AI assistant this summer. Now we’re taking that experience to the places people already work: their own products, phones, and desktops.

Lumo API

We’re releasing the Lumo API, giving developers and businesses a way to bring Lumo directly into their own products and workflows, while getting the same zero-access encryption and no-logging protections as the Lumo app.

Improved mobile apps

We’re revamping the Lumo mobile apps to deliver a faster, smoother, and more reliable experience on iOS and Android. This will make Lumo feel more responsive and easier to use day to day, while giving us a stronger foundation to keep improving the mobile experience over time.

Lumo for desktop

We’ll launch a dedicated Lumo desktop app for faster, easier access throughout the day. It was originally planned for earlier this year, but we prioritized Lumo 2.0 first. With that now complete, we’re returning to the desktop app.

Moving beyond Big Tech with you, our community

Everything we’ve released this year, including the new features of our core services, has been possible with your support. As an independent, European alternative to Big Tech, we see building a private ecosystem of apps as a reclamation of our rights to privacy on the internet and proof that there’s a better way to build tech: for people, not profit.

Your trust and support are what helps us make better products. Feedback is invaluable to each of our teams, so let us know in our forums and on Discord, X, Bluesky, Facebook, LinkedIn, Threads, Telegram, Reddit, and UserVoice, or leave us a review in the App Store or Play Store.

Thank you for helping us build a more private internet, and we’ll see you in the spring for our next roadmap updates.

How to delete your Facebook account

Proton Team — Wed, 14 Oct 2026 14:04:17 GMT

Deleting your Facebook account is permanent after a 30-day grace period; deactivation is reversible. Here’s how to do either, plus how to export your data first.

Before you wipe Facebook of your data, consider downloading a copy of it and, if you’re not ready to fully commit, making your account private instead. There are also ways to keep using Facebook more safely if you’re not ready to leave.

How to permanently delete your Facebook account and data
Download your data before deleting
Temporarily deactivate your Facebook Account
How to deactivate Messenger
Memorialize your account
Protect your privacy on Facebook
Adjust your Meta AI settings

How to permanently delete your Facebook account and data

Ready to say goodbye? Deleting your account and all its associated data takes just a few steps, and the process is similar to deleting an Instagram account, since both apps are owned by Meta.

Before you start, understand what you’re giving up. You won’t be able to reactivate your profile once it’s deleted, and all the photos, videos, and posts you’ve shared will be gone for good. The same applies to any pages or groups you run exclusively (you can hand control of these to another user first if you want them to continue). You’ll also lose access to Facebook Messenger, and you’ll need another way to log into any third-party apps or services you originally signed up for using your Facebook account.

Note that some information may still be visible to others after deletion — messages you sent to friends, for instance, remain in their inboxes even after your account and its copy of the conversation are gone.

Simply deleting the Facebook app from your phone doesn’t touch your account or your data; it just removes the app. To actually remove your profile, you need to go through account deletion.

1. In your browser, sign in to accountscenter.facebook.com.

2. Go to Manage accounts.

3. Select the Manage button next to account you wish to delete.

4. Select Deactivation or deletion.

5. Select Delete account and Continue.

6. Follow the prompts, enter your password, and confirm

Once you confirm, your account enters a 30-day grace period. If you log back in during that window, the deletion is automatically cancelled. After 30 days, the deletion is permanent and can’t be undone.

Download your data before deleting

Before you delete your account, save anything you want to keep. Once deletion is complete, you won’t be able to get your photos, posts or messages back.

To download your data:

1. In your browser, sign in to accountscenter.facebook.com.

2. Go to Your information and permissions → Export your information.

3. Click Create export.

4. Choose a Meta profile.

5. Choose whether to export locally onto the device you’re using, or to an external (cloud) service.

6. You can customize the information you wish to export by selecting the exact data points, a date range, format and quality level for media downloaded. Higher quality photos and videos will take up more room.

Facebook lets you export the following data:

Your Facebook activity
Personal information
Connections
Logged information
Security and login information
Apps and websites off of Facebook
Preferences
Ads information
Data logs

Click Start export when you’re done.

Temporarily deactivate your Facebook Account

If you’d rather take a break than commit to permanent deletion, you can deactivate your account instead. Deactivation hides your profile, posts, and photos from other users, but keeps everything stored on Facebook’s servers. You can reactivate at any time simply by logging back in, and your account will be restored exactly as it was.

This is a good option if you want to step back from the app without losing your data, though it doesn’t offer the privacy benefits of full deletion, because your information remains on Facebook’s servers.

To deactivate:

1. In your browser, sign in to accountscenter.facebook.com.

2. Go to Manage accounts.

3. Select the Manage button next to the account you wish to deactivate.

4. Select Deactivation or deletion.

5. Select Deactivate account, followed by Continue.

6. Enter your Facebook password and select a reason for deactivating your account.

7. Click Continue to finalize the deactivation process.

How to deactivate Messenger

If you want a break from Messenger without deleting anything, you can deactivate it. Because Messenger is connected to your Facebook account, you’ll need to deactivate Facebook first. The option to deactivate Messenger then becomes available. These steps work in the Messenger app on iPhone or Android.

1. Open Messenger app and tap Menu → Settings.

2. Tap Accounts Center → Personal details → Account ownership and control.

3. Tap Deactivation or deletion and select your account.

4. Choose Deactivate account, enter your password, then follow the prompts to confirm.

Deactivating doesn’t delete your messages, which stay visible to people you’ve chatted with until you reactivate. To come back at any time, just log in with your username and password.

Memorialize your account

Facebook also lets you plan for what happens to your account after you die. You can designate a legacy contact, typically a family member or close friend, who can manage a limited version of your profile once your account is memorialized.

This person will be responsible for informing Facebook of your passing by providing a death certificate or obituary with a photo. Once the death has been confirmed, your profile will be changed so that friends can still post and see your shared images, posts, and videos, but no one else will be able to login and post as you.

Your legacy contact can pin a tribute post to the top of your memorialized timeline, respond to new friend requests, and update your profile or cover photo. They cannot log in as you, read your private messages, or edit or delete your existing posts. Memorialized profiles display “Remembering” above the name, and are protected from things like birthday reminders and friend suggestions that could otherwise be distressing to the people who knew you.

If you’d rather not have your account memorialized at all, you can instead choose to have it permanently deleted after your death.

To configure your preferences:

1. In your browser, sign in to accountscenter.facebook.com.

2. Go to Manage accounts.

3. Select the Manage button next to account you wish to memorialize.

4. Select Memorialization.

5. Choose a legacy contact, or choose to have your account deleted after your death.

Protect your privacy on Facebook

If you’d rather keep using Facebook with a bit more peace of mind, there are several ways to reduce what Meta knows about you. Using a VPN will hide your real IP address from Meta, and therefore also your rough location (at least when using the website — the mobile app can access your GPS data). But Meta will still be able to see all your photos, photos you’ve been tagged in, posts, likes, people you’ve messaged (but not the contents of the messages themselves), groups you’ve joined, etc.

Another way to make your Facebook more private without deleting anything is to make your profile private. You can control what information is visible to the public versus only to friends, and restrict certain content, like older posts or photos, to yourself alone. Just be aware this only hides information from other Facebook users, not from Meta.

To do this, click on your profile picture → Settings & privacy → Privacy checkup.

Review categories like who can see your posts, friend list, and profile information, and set each to Public, Friends, or a custom selection

You can also control whether your profile can be found in search, both on Facebook and via external search engines, and review which posts allow comments from the public.

Adjust your Meta AI settings

Meta AI shows up in a couple of different forms across Facebook, and it’s worth understanding what each one actually does with your data, since the two are easy to conflate.

The first is an opt-in feature, currently available in the US and Canada, which can scan your phone’s camera roll (with your explicit permission) to suggest AI-generated collages or photo edits. This feature is only available in the mobile app.

According to Meta, this camera-roll media isn’t used to train its AI unless you actually use the editing tools or choose to share the results, but granting permission does mean photos are uploaded to Meta’s servers on an ongoing basis. If you’d rather not participate, you can simply decline the permission prompt, or turn the feature off afterwards in the app’s camera roll settings.

The second, separate issue is that as of December 2025, Meta uses your conversations with the Meta AI chatbot itself to help personalize the ads and content you see across Facebook, Instagram, and WhatsApp. There’s no way to opt out of this.

The only exemption is for anyone in the EU, UK, and South Korea, where stricter privacy regulations mean the “feature” is not available.

Final thoughts

Deleting Facebook is simple in the sense that Meta provides a clear way to do it. What takes more thought is deciding how much of a break you actually want. Full deletion is permanent after a 30-day window, taking your data with it. Deactivation is fully reversible but leaves your information sitting on Facebook’s servers. Whichever path you choose, downloading your data first ensures you don’t lose anything you want to keep.

7 types of business meetings and top tips for each

Greg Ng — Wed, 14 Oct 2026 13:24:40 GMT

The way businesses meet has changed. Teams now regularly work across offices, homes, cities, and time zones, making video conferencing software an essential part of day-to-day collaboration.

But meetings often involve sensitive information, including business strategies, project timelines, and client and employee details. As business conversations increasingly move online, productivity and privacy are more important than ever.

Below are seven common examples of business meetings, along with practical tips to help make each one more effective and secure.

7 common types of business meetings

Strategy meetings

Strategy meetings help leaders and teams align on how to achieve specific goals, such as entering new markets and hitting revenue targets. The decisions made in these sessions can shape the direction of a department, project, or entire company.

Productivity tip: Share a clear agenda in advance and ask attendees to review relevant information beforehand. This enables everyone to arrive prepared and contribute to a more focused discussion.

Privacy tip: Strategy meetings usually involve commercially sensitive data. If you’re hosting them online, use an internal communication tool with end-to-end encryption. This ensures only authorized participants can access what is said and shared during the meeting.

Project check-ins

Also referred to as standups or team syncs, these meetings are meant to help keep everyone up to speed on ongoing projects. Team members can share progress, raise blockers, and confirm which tasks are on schedule.

Productivity tip: Keep the discussion focused on updates, decisions, and dependencies. If something needs further discussion, schedule a follow-up meeting with only the people directly involved so everyone else can continue with their tasks.

Privacy tip: Even these routine meetings can still reveal a lot about internal priorities, customers, and team structures. Consider if your meeting tool collects participant information or other metadata that could expose these details to third parties.

Brainstorming sessions

Brainstorming sessions are spaces for teams to explore new ideas. They can help improve processes, plan campaigns, and develop new products or strategies. These meetings are usually open-ended and invite open feedback from all attendees.

Productivity tip: Enforce timeboxing to keep the session focused and efficient. For example, set a timer for 10 minutes dedicated to idea generation. Once the timer rings, move on to the next phase for evaluating and prioritizing shortlisted ideas.

Privacy tip: New ideas can become valuable intellectual property. Check how your video conferencing software handles meeting content, recordings, and AI features. Your ideas should not be used to train AI models or for other purposes that your organization has not approved.

Problem-solving meetings

Also known as solution meetings, these focus on resolving specific issues or internal challenges. From fixing client deliverables to settling a misunderstanding between team members, these calls can be complex and sensitive.

Productivity tip: Define the problem at the start of the meeting, then focus the conversation on evidence, objective options, and next steps. Avoid turning the meeting into a search for who to blame.

Privacy tip: A secure online meeting environment allows participants to speak freely about internal challenges without fear that your meeting tool will store or use what they say. Avoid using AI transcription or unnecessary recording features, and to keep things truly private, use a fully encrypted video conferencing tool like Proton Meet.

One-on-one meetings

As the name suggests, these meetings are held between two people — typically a manager and a direct report. These meetings can be used for discussing performance or project updates, sharing feedback and career aspirations, or for raising concerns.

Productivity tip: Prepare a few talking points to keep the conversation focused. This ensures that the meeting stays useful while leaving room for both sides to address important topics.

Privacy tip: One-on-one meetings often touch on sensitive employee matters, such as salary and health concerns. Ensure you’re using a video conferencing tool that is compliant with data protection regulations such as GDPR to protect your employees’ privacy.

Town halls

Often referred to as an all-hands, these meetings involve the entire company. Leaders usually conduct town halls to share updates about company performance, strategic priorities, and major changes.

Productivity tip: Use a structured agenda and leave time for questions. Because a town hall has the whole company in attendance, even a short overrun can result in a significant number of lost productivity hours.

Privacy tip: A larger audience compounds the risk of unwanted access and accidental sharing. Use a video call platform that can support your company’s size without compromising on full encryption and meeting controls.

Client meetings

Client meetings help businesses build relationships, manage accounts, and move deals forward. Taking that online reduces friction and makes these conversations much easier to schedule, reducing travel time and costs.

Productivity tip: Make joining the meeting as simple as possible. Opt for browser-based video conferencing solutions to avoid installation and setup issues during your call.

Privacy tip: Privacy is paramount when dealing with external partners. Using a secure meeting platform signals that privacy is part of how your business operates, rather than an afterthought.

What to include in a business meeting agenda

Regardless of the meeting type, going into a discussion without a clear agenda leads to wandering conversations and can impact productivity. A good business meeting agenda sets expectations before the meeting starts, helps participants understand what needs to be discussed and prepared, and indicates the desired outcome. When setting a meeting agenda, ensure these are included:

Objective(s): State what the meeting needs to accomplish.
Topics and timing: Allocate time for each topic or speaker to keep the discussion on track.
Owners: Identify which participants will lead or be involved in each part of the meeting.
Pre-work: Link to any pre-reading material as needed and share it well beforehand so participants can prepare appropriately.

Once the meeting is over, share clear meeting minutes so everyone knows what was decided and what needs to happen next.

Why security is important for business meetings

Most advice on company meetings focuses on efficiency. But while productivity matters, it shouldn’t be the only consideration when choosing a video conferencing tool. Business meetings often contain valuable information about your company, and improper protection puts your business at risk.

Not all meeting tools offer the same level of protection. Some providers only encrypt data in transit, giving them control over your data when it reaches their servers. Others collect metadata about your meetings that reveal company relationships, and may even use your data to train AI.

For businesses, especially those in regulated industries, privacy should be built into the tools employees use every day. This applies just as much to small teams: securing communication tools is a core part of cybersecurity for startups, where a leak could have disastrous consequences on fundraising potential, partnerships, or customer trust.

A video conferencing platform with end-to-end encryption helps meetings run smoothly, while ensuring confidential data stays only accessible to you and the people you authorize.

Keep company meetings secure and confidential with Proton Meet

Closing the door of a physical meeting room helps keep conversations private. Proton Meet brings that same expectation of confidentiality to all your online calls.

Built by the team behind Proton Mail, Proton Meet protects your audio, video, screen shares, and chat messages with end-to-end encryption by default. This means only participants have access to the contents of each meeting — not advertisers, third parties, or even Proton. With Messaging Layer Security (MLS), Proton Meet protects calls from unauthorized access and prevents meeting content from being used to train AI. And with Proton being based in Switzerland, your business benefits from some of the world’s strongest privacy protections.

From intuitive screen sharing to browser-based access, Proton Meet gives your business the tools you need to collaborate without compromising on privacy. Calls can be joined and hosted from any device, and external guests can also be invited for meetings even without a Proton account. Start holding secure business meetings today with Proton Meet for Business.

Get Proton Meet for Business

Run more secure, organized meetings with new Proton Meet features

Risa Tang — Wed, 14 Oct 2026 11:57:41 GMT

An effective meeting starts with the right people in the room and keeps things focused once they’re in. Today, we’re launching two new features in Proton Meet to empower teams with productive video conferences.

Waiting rooms give hosts more control over who joins, and chat threads keep in-meeting conversations organized. Both features are now live and protected by the same end-to-end encryption that underpins every Proton Meet call.

Waiting rooms: Decide who joins, and when

Proton Meet already keeps your calls end-to-end encrypted, but privacy also depends on who has access to the conversation. With waiting rooms, everyone except the host waits to be admitted.

Every Meet call is private by design and uses Messaging Layer Security (MLS), an open source end-to-end encryption protocol. Users in the waiting room aren’t part of the MLS group and won’t have access to any of the meeting content. They receive access only when the host admits them, so sensitive discussions stay limited to the right people. Participant names are also end-to-end encrypted and decrypted on the host’s device, so our servers can’t see who is waiting.

Waiting rooms are available now on all Proton Meet paid plans, including Meet Professional, all Workspace plans, and the Meet add-on. If you have a free plan, you can upgrade for access.

Chat threads: Keep every conversation easy to follow

In-meeting chat is where team members raise questions, provide answers, and confirm next steps. In a busy call, messages and replies often stack up out of order, making it hard to tell if something has already been addressed and what the response was.

Chat threads let you reply directly to any message so each discussion stays contained without disrupting the wider chat. And they follow the same privacy standard as the rest of Meet. Messages, replies, and reactions are all end-to-end encrypted, including the thread structure, so Proton’s servers can’t see which messages are replies and what they reply to. Chat exists only for the duration of the call with no server-side history, and disappears once the meeting ends for utmost confidentiality. Each message sender’s identity is also verified through their authenticated meeting credentials to help prevent impersonation.

Chat threads are available now to all Meet users, on both free and paid plans.

Bring more control to your next meeting

Waiting rooms and chat threads make Proton Meet even better suited for the way businesses meet online: Greater control over who joins and better ways to communicate once they do. Alongside these features, this release also includes general performance and stability improvements, so Meet is smoother and more reliable than ever. Every Meet call and chat is protected with end-to-end encryption that ensures no one outside of that meeting, not even Proton, has access to its contents.

Try both features in your next call with your Proton Meet account today, or speak to our sales team to find the right plan for your organization.

Open Proton Meet Get Meet Professional

The Palantir Mafia is changing the business of war and surveillance

Proton Team — Tue, 13 Oct 2026 18:07:20 GMT

Palantir has become one of the most recognizable technology companies working with the U.S. government. Its software is used by military and intelligence organizations, while its work with law enforcement and immigration agencies has made it a focus of privacy and civil liberties debates around government surveillance.

Speaking broadly, Palantir’s software helps organizations connect and make sense of large amounts of existing data. That capability can be useful for businesses and governments alike, but its applications become more consequential when the data involves military operations, policing, or immigration enforcement.

Palantir’s influence extends beyond the company itself. A growing group of defense and surveillance startups has emerged from the same network of former Palantir employees, investors, and executives. Some build weapons. Others build the software that connects sensors, drones, databases, and people. Several work directly with Palantir or with the same large defense contractors that have supplied the U.S. military for decades.

You could call this network the “Palantir Mafia,” borrowing the language once used for the PayPal alumni who went on to reshape Silicon Valley. Within it is a smaller group with a particularly strong connection to military and surveillance technology.

The companies are different, but the pattern is striking. People leave Palantir, carry experience from government and military projects into new businesses, and often find the capital and relationships needed to sell those products back to governments.

The result is a new layer of the military-industrial complex, built around software, data, artificial intelligence, and venture capital.

Meet the companies spreading Palantir’s model

While all of the companies in the “Palantir Mafia” perform different jobs, their connections create a recognizable pattern. Former Palantir employees are carrying knowledge, relationships, and ways of working into new defense companies, while investors and established contractors help those companies reach government customers.

Epirus

Epirus, founded by Joe Lonsdale (who also co-founded Palantir), makes Leonidas, a high-power microwave system designed to disable drones. The system can be deployed in different configurations, including on vehicles, and it has been integrated with General Dynamics Land Systems’ Stryker combat vehicle.

Epirus has also joined Palantir’s Warp Speed program, giving the companies another direct connection.

Valinor

Valinor is newer and less flashy. Founded by former Palantir executive Julie Bush, the company describes itself as tackling “unsexy” problems in defense. Its products include systems for drones and other military infrastructure, and its software can connect with Palantir’s platforms. The name itself is a nod to the works of J. R. R. Tolkien which also inspired the names of Palantir and Anduril.

Valthos

Valthos takes a different approach. The company develops AI systems intended to detect and prevent biological weapon attacks. Its co-founder and CEO, Kathleen McMahon, was previously the Head of Life Sciences at Palantir. Valthos reflects a broader concern among some technology executives that advances in AI and biotechnology could make biological threats easier to create.

Anduril

Then there is Anduril, the biggest and best-known company in this group. Founded in 2017 by three former Palantir employees, including Trae Stephens, who is also a partner at Founders Fund. Its products include surveillance and combat drones, autonomous systems, and Lattice, a software platform that uses sensor data to identify and track objects.

Anduril’s growth shows how far this model has moved. The company was valued at $61 billion after a 2026 funding round, putting it in a very different financial category from most defense startups.

Its technology has also crossed between military and domestic security. Lattice has been used in border surveillance, showing how systems developed for national security can have applications closer to home.

Kela

Kela, an Israeli defense technology company, follows a similar software-first approach. It provides a platform that can connect drones, sensors, and weapons from different manufacturers into a single system. Its co-founder and president, Hamutal Meridor, previously ran Palantir’s Israeli operation. Kela has also secured work connected to the Israeli military.

Rivet Industries

Rivet Industries was founded by David Marra who previously worked at Microsoft on a military mixed-reality headset program. Marra later then spent a year at Palantir. Rivet now develops wearable systems for soldiers. In 2025, the Army awarded Rivet a $195 million Soldier Borne Mission Command contract, and the company works closely with Palantir.

Peregrine Technologies

Peregrine Technologies was founded in 2018 by Nick Noone, who previously ran Palantir’s U.S. Special Operations business. At Palantir, Noone worked with data to identify ISIS members in Syria. He later took that experience to a small police department in California, initially building Peregrine’s technology for free before turning it into a commercial product.

Peregrine now provides software to hundreds of agencies. Its platform brings together information that police departments already have access to, making it easier to search and visualize data from different sources.

From foreign battlefields to local police

Palantir’s own history includes a predictive policing project in New Orleans. The system used information such as arrest records, social media posts, police contacts, and family relationships to generate assessments about people’s likelihood of being involved in violence. The project was later examined by researchers and civil liberties organizations concerned about the lack of transparency and the risks of assigning people police risk scores. The Harvard analysis of predictive policing provides additional context on the New Orleans system.

Peregrine says it does not operate a predictive policing system of that kind. Instead, the company says it helps agencies organize and visualize existing information rather than adding new surveillance sources.

The problem is that “existing information” can still be extensive. Once those systems are connected, the question is no longer simply what a company collects itself. It becomes a question of what information a police department can bring together and what conclusions it can draw from it.

That is one of the most important parts of the Palantir model. A company does not necessarily have to collect every piece of information itself to make a large amount of information more useful.

Bankrolled by the Founders Fund

There is another connection running through several of these companies: Founders Fund.

Co-founded by Peter Thiel, the venture capital firm backed Palantir and has invested in or supported several companies in this wider network. Trae Stephens is particularly important because he sits at the intersection of several parts of it. He worked at Palantir, became a Founders Fund partner, and helped co-found Anduril.

That makes the network less mysterious. You don’t need a formal organization with membership cards or a central office. Shared investors, former colleagues, and existing government relationships can create many of the same effects.

Founders Fund has also been unusually explicit about its investment philosophy. Its manifesto argues that successful entrepreneurs often have what it calls a “near-messianic attitude” and believe their company is essential to making the world a better place. It also argues for independent, contrarian thinking rather than simply following the rest of the venture capital industry.

Defense has traditionally been difficult territory for venture capital. Government procurement can be slow, contracts are complicated, and established contractors already have decades of relationships and infrastructure.

The newer defense companies are approaching the problem differently. They bring venture-backed software culture, rapid product development, and consumer technology ideas into a market that has historically been dominated by large contractors.

The money follows the opportunity. So does the talent.

The startups aren’t replacing the old defense giants

It would be easy to tell this story as a simple battle between Silicon Valley startups and traditional defense contractors.

Epirus has integrated its Leonidas system with General Dynamics’ Stryker vehicle, and General Dynamics Land Systems has invested in Epirus. Rivet names Northrop Grumman as a partner. Anduril has integrated Lockheed Martin radar into its battlefield software.

The relationship is closer to an expanding ecosystem than a hostile takeover. That matters because the growth of defense technology startups does not necessarily shrink the role of companies such as General Dynamics, Northrop Grumman, and Lockheed Martin. Instead, startups can provide new software, sensors, weapons, and interfaces that become part of existing military systems.

The distinction also changes how we should think about disruption. In consumer technology, a startup can sometimes replace an incumbent by building a better product and taking its customers. Defense procurement works differently. A new company can win a contract while still relying on established manufacturers, military infrastructure, and government procurement systems.

The result can be a larger market in which startups and traditional contractors both benefit.

The scale of that market is already visible. In 2025, the U.S. Army awarded more than $350 million for work on virtual displays for soldiers, with money going to both Anduril and Rivet. The two companies can compete for contracts while also building products that fit into the same broader military technology ecosystem.

The companies don’t need to destroy the old military-industrial complex to change it. They can become another layer within it.

Who decides what this new military industry becomes?

Governments want better intelligence, faster software, autonomous systems, counter-drone weapons, and tools that can connect huge amounts of information. In some cases, those technologies can give soldiers or investigators information they could not easily obtain before.

But greater technical capability also changes the balance of power.

When a company develops software that can connect databases, sensors, cameras, weapons, and government agencies, the technical decision about what the system can do becomes a political decision about what governments are able to do.

That is why the story of Palantir’s former employees matters beyond a list of startups. The network shows how quickly expertise can move between military intelligence, private technology companies, domestic policing, and surveillance.

It also shows how venture capital can influence what gets built. Dwight Eisenhower warned about the military-industrial complex in his 1961 farewell address. He argued that the country needed to guard against the acquisition of “unwarranted influence” and warned that the growth of military and industrial power could endanger democratic processes. He ended with an appeal for an “alert and knowledgeable citizenry.”

More than six decades later, technology has changed but the basic question has not.

Who has the power to decide how military and surveillance systems are built, where they are deployed, what data they can use, and how their capabilities expand? This becomes harder when the systems are developed by private companies, financed by investors, and sold through government contracts that most citizens never see.

The companies emerging from Palantir’s orbit are not a single organization, and they do not all have the same products or goals. Some are building defensive systems. Some are developing tools for policing. Some are working on ways to connect military hardware and software.

What connects them is a network of people, capital, technology, and government relationships.

That network is becoming an increasingly important part of how the United States and its allies approach defense and surveillance.

The question is not whether these technologies will shape the future. They already are. The question is who gets to shape them, and who gets to decide where the power they create should stop.