AI has already transformed how many companies operate, whether it’s writing code, answering support tickets, or handling data. It has certainly changed how we work at Proton. So it is fair to ask what the arrival of AI means for the security of the products you depend on.

The short answer: We have added powerful new AI review layers on top of existing human ones, and much of our security posture hasn’t changed at all. It’s worth discussing all this in more detail, though, so let’s dig in.

The foundations remain the same

Proton uses end-to-end and zero-access encryption. We do not hold the keys to your emails, files, or passwords, so we cannot read them, and no AI tool can, either. Our documented security principles have not changed since June 2024, before AI was even a major factor in our work here, and they all still apply. They include basing decisions on risk, centralizing governance, and granting exceptions only in an explicit, controlled way. We have not loosened them for AI. We have applied them to it.

Independent verification

Proton is ISO 27001 certified. In July 2025, we also completed our first SOC 2 Type II audit, carried out by Schellman, an independent auditing firm. The auditors examined our controls for access management, incident response, system monitoring and risk assessment. These same controls apply no matter how we build software, with or without AI. Proton services undergo regular security audits both internally and externally, and we have another SOC 2 audit scheduled for 2027. And as always, our code remains open source and available for independent review and verification. Anybody, human or AI, can scan that code to verify its security.

The controls for AI-written code

At Proton, the same unified controls apply to all code, whether it was written by AI, a human, or a combination of both. AI-generated code doesn’t get to take any shortcuts or bypass any checks. These unified controls include:

  • A person is required to approve every code change. As has been the policy for years, every change must be reviewed, and one or more people are expected to ultimately approve those changes. AI reviewers have been added to the process, but they cannot deploy code to production on their own. The specific people required to sign off depends on which codebases have been modified: For example, core cryptography code changes always need to be reviewed by our expert cryptography team.
  • Security scanners are still required. Automated security scans must run on code changes.
  • People are always accountable. Engineers can hand tasks to AI, but they stay responsible for the result and must follow our policies and use their professional judgment. Code generated with the help of AI must meet or exceed human standards.
  • Designs are reviewed before major features are put in to code. Engineers present designs to their peers, who check the security, dependencies, testing, roll-out and roll-back plans.

The controls around AI and our infrastructure

  • AI agents get only the access they need. We apply the same least-privilege rules to AI agents as to employees. Anything an employee wasn’t allowed to do before AI is still not allowed.
  • Cyberdefense is strengthened. Our internal Security Information and Event Management (SIEM) system records actions within our security perimeter, whether they come from a person or an AI agent. Our human security analysts act on every suspicious alert.
  • Our infrastructure is protected. Only authorized devices can reach our internal systems. Authorization requires physical tokens that AI systems cannot physically manipulate on their own. We monitor all servers and employee laptops for indicators of compromise.

Should security companies use AI?

Because of AI, attacks that once might have required a nation-state can now be executed by almost anyone. A defender relying on manual processes and hand-crafted tools will be hopelessly outgunned. An attacker only needs to find one flaw, while a defender needs to close all of them. AI is the only tool that makes that defense possible. Cybersecurity is an arms race, and the teams working on security at Proton have been some of the earliest adopters of AI, because the safety of your data depends on winning that race.

How we use AI for security

  • AI reviews code changes, alongside humans. AI reviewers complement our human reviewers and flag issues earlier in development, catching defects pre-merge that manual reviews would have only caught much later, if at all. They add to human review; today, our policy is that every change is subject to human approval.
  • AI helps discover vulnerabilities first. We run continuous AI-powered security reviews against our own code so we find weaknesses before anyone else does. Alongside our own models, we use non-public cyber models from OpenAI and Anthropic for threat analysis and code scanning. These models receive source code and threat intelligence only, never customer content.
  • AI strengthens security monitoring. Our security operations center watches our perimeter and endpoints for compromise, with Proton Sentinel protecting customer accounts. AI tooling built by Proton lets a team of analysts patrol an attack surface that has grown far beyond what unaided humans could monitor, surfacing the signals a human team then investigates and acts on.

Conclusion

Proton’s security controls have been strengthened by the introduction of AI, as we now have advanced capabilities that were not available before. Things can be done faster and more thoroughly with AI, and given the threats we face, they must be, or we won’t be able to keep up.

No company can remove every risk, and we won’t claim to. What we can promise is a disciplined approach: We manage risks explicitly, keep improving our security, and keep a person accountable for every change that reaches production software.