How to use activity monitor | Proton Business Suite

Security is about much more than protecting data; it’s also about visibility and control. Our activity monitor feature is available for all Proton Business Suite and all Proton Professional plans and provides the insight you need to enhance security, ensure compliance, and detect suspicious behavior across your organization.

Why use activity monitor?

IT and security teams need visibility into how Proton accounts are used within their organizations. They need a way to track user activity, ensure compliance with security policies, and detect threats like unauthorized access attempts or credential misuse.

When an incident occurs, admins need to perform post-forensic analysis by auditing historical information to identify weaknesses and threats. Without a detailed audit trail, your organization risks blind spots in its security and compliance gaps that could expose it to cyber threats.

With activity monitoring, admins can track, audit, and review account-related events through a centralized dashboard. Events such as failed login attempts and changes in user activity are logged with:

• User
• Event type with a timestamp
• Device name and app version
• IP address IP address of the user (or the IP address of the VPN server, if used), and the ISP(nova janela) the IP address belongs to. Optional.
• Location — the user’s approximate location (based on their IP address). Optional.

This allows your organization to enforce security policies, identify anomalies, and investigate potential security breaches proactively.

When activity monitor is turned off, no event data is collected. When activity monitor is turned on, your team can also access all events related to their Proton Account, allowing them to check for themselves if account has been compromised. Activity monitor can be used alongside Gateway monitor(nova janela) to provide a comprehensive view of how your team uses Proton services.

How to turn on activity monitor

Sign in to account.proton.me with your Proton for Business administrator account and go to Organization → Activity monitor and toggle the Activity monitor switch on. Activity monitor is available across all Proton products.

Once activity monitor is turned on, you can toggle the Enable/Disable detailed events button to show or hide the IP and ISP and Location details.

How to view activity monitor events

Once activity monitor has been turned on, go to:

Admins: Organization → Activity monitor

Users: Account → Security and privacy → Activity monitor

Administrators can see events for all team members (see screenshot above), while users can see events for their own account:

If you’re an admin, you can search for events using a name or email address and filter events by time range.

Admins can elect the Export button to download the activity monitor logs as a CSV file.