The Proton Sentinel high-security program

The Proton Sentinel program is an advanced account protection program that provides maximum security for those who need it. It mitigates security threats by combining AI with human analysis.

Everyone with a subscription to a Proton Unlimited, Family, Visionary, Lifetime, Business, or Pass Plus plan can benefit from the Proton Sentinel program. If you’re a journalist, activist, executive, or someone who deals with sensitive data and communications, we strongly encourage you to enable it.

The Proton Sentinel program provides:

• Advanced security protection, including strict challenges for suspicious login attempts
• Greater visibility on logins and account changes in their security logs
• 24/7 escalation of suspicious login attempts to security analysts who will review assessments made by the automated systems
• Support requests related to account security will automatically be escalated to trained security specialists.

This makes it much harder for an attacker to take over your account. However, accounts shared by multiple people without two-factor authentication may not want to enable Proton Sentinel at this time as they have a higher chance of being challenged during logins.

How to enable the Proton Sentinel program

1. Sign in using your Proton Account username and password at account.proton.me. 
2. Click Settings → All settings → Security and Privacy and click the Enable Proton Sentinel toggle switch to enable the Proton Sentinel program.

How to view enhanced security events

We believe you’re the ultimate guardian of your security, which is why we enable you to self-monitor account events in case you notice something suspicious. To view enhanced security events:

1. Sign in using your Proton Account username and password at account.proton.me. 
2. Click Settings → All settings → Security and Privacy. You can find your logs under the Security events section. If you don’t see them, ensure you enabled the Enable security events toggle.

The Proton Sentinel program security events log provide extra information in the Protection, Device, Location, and ISP columns. Note that currently only important security events such as login attempts and account setting changes will have this extra information:

• The Protection column shows any actions our systems took, such as Recovery verification in the screenshot above.
• The Device column shows the operating system and device that caused the event, helping you identify suspicious activity.
• You can also enable detailed events, which will display data in the IP address, ISP, and Location columns. These columns show which internet service provider handled a login attempt and where it originated from, making it easier to identify fraudulent ones.

If you notice any suspicious activity in your security events, you should report it to us by contacting us via our online support form.