The Proton Blog

A Gmail scam is exploiting Google Account recovery emails

Edward Komenda — Fri, 04 Sep 2026 11:59:42 GMT

One morning in August, a member of our team answered a call from a California number.

The caller, polished and speaking with a flawless American accent, claimed to be from Google. An attempt had been made, the caller said, to change the account recovery address on the employee’s Gmail account, and an email about it was sitting in his inbox at that very moment.

Upon further investigation, however, our team member soon learned things were not as they seemed.

This was a phishing scam, and a more sophisticated form of social engineering. It used a carefully scripted conversation designed to build just enough trust that you believe the caller really is Google, ultimately persuading you to hand over some form of access.

Our colleague ended the call before reaching that moment, so the exact ask went unheard. But the structure of the scam tells you exactly where it was headed.

How this Google account recovery scam works
The tells, annotated
Why this Gmail scam is so convincing
How to protect yourself from account takeover attempts
A safer inbox starts with better email security

How this Google account recovery scam works

The setup

Before the phone rings, the scammer creates a fresh, anonymous Gmail address, which consists of random letters and digits. Using Google’s legitimate “add a recovery email” flow, they try to add the victim’s address as the recovery email for the scammer’s own throwaway account.

The first real email

Google’s system needs the victim’s confirmation, so an authentic message arrives asking them to verify the recovery email. The sender, branding, and code are real. (Figure 1 below)

The call

The scammer makes a call, poses as a member of Google’s security team, and describes a suspicious account access attempt that was supposedly blocked, even claiming to have intercepted the victim’s authenticator code. The word “blocked” casts the caller as the hero. In reality, the attack is the phone call.

The second real email

Still on the line, the victim receives a genuine “Security alert” announcing that a recovery email was changed on a linked Google Account. Skimmed, it looks like a compromise. Read carefully, the fine print reveals it’s a copy of an alert sent to the scammer’s address. (Figure 2 below)

The vanishing act

The first email offers a legitimate escape: removing your address from the stranger’s account. But the moment our colleague hung up, the scammer withdrew the recovery request, erasing the trail, and likely moved on to the next target.

The tells, annotated

Figure 1 shows the first Google email, which contains a security code needed to confirm your address as the recovery email for the scammer’s account.

The genuine Google sender — real, which is precisely what makes it dangerous.
“Wants to use your email address as their recovery email” — the reversed logic, as this is about someone else’s account.
The anonymous throwaway address — no way to verify who’s behind it.
The expiring code — manufactured urgency, keeping you stressed and compliant.
“Remove email” — the one action that stops it, and exactly what the scammer cancels when you hang up.

Figure 2 shows how a genuine Google security alert can appear alarming at first.

The subject addresses the scammer’s inbox, not yours — the first sign this alert isn’t about you.
“A copy of a security alert sent to” the throwaway address — the biggest tell, and the easiest to miss on a skim.
The alarming headline — designed to scare before you read the fine print.
“If you didn’t change it, check what happened” — planted doubt that primes you to trust the caller.
The “Check activity” button — a prompt to act fast instead of read carefully.

Why this Gmail scam is so convincing

Both phishing emails come from Google’s real servers, so every conventional anti-phishing check passes.

Each element corroborates the others: real notifications, plus a caller who knows exactly what just landed in your inbox. At the same time, the conversation can discourage any attempt you may have to click “Remove email”, keeping you focused on the caller’s instructions.

A Google data breach can make scams like this more convincing if exposed information gives attackers details they can use to personalize vishing or phishing attacks. Even when passwords aren’t leaked, names, contact details, or account-related information can help scammers sound more credible and build trust.

How to protect yourself from account takeover attempts

You can protect yourself by slowing the interaction down and verifying what’s happening through Google directly:

Hang up and verify independently. If someone calls claiming to be from Google, end the call and check your account directly rather than following their instructions.

Read Google security emails carefully. Pay attention to which account the alert actually refers to, especially any line saying the message is a copy of an alert sent to another address.

Do not share verification codes. Google will not need you to read out an authenticator code, recovery code, or other sign-in credential over the phone.

Use “Remove email” if you do not recognize the account. If Google says someone wants to use your address as their recovery email, remove it from that account.

Do not let the caller rush you. Scammers rely on urgency to keep you reacting instead of checking what the notification actually says.

Review your Google Account security directly. Open your account settings yourself and check recent activity, signed-in devices, recovery details, and security alerts.

Report suspicious calls and messages. Reporting the attempt can help Google and your phone provider identify repeated abuse.

Review your Google privacy settings. While privacy settings won’t stop this particular scam, regularly checking what data you share and which apps and services have access to your Google Account can reduce your exposure.

A safer inbox starts with better email security

Scams like this are a reminder that even legitimate security emails can be turned into tools for social engineering. Staying skeptical of unexpected calls, checking account activity independently, and reading alerts carefully can help you avoid falling for them.

Looking for a better alternative to Gmail? Proton Mail gives you a secure email service built around protecting your data and communications with end-to-end and zero-access encryption.

If someone tries a similar scam while pretending to be Proton, there’s a simple rule to remember: Proton will never call you about an account security issue. You can protect your account from takeover by enabling two-factor authentication. On paid plans, Proton Sentinel combines automated detection with human security analysis.

Proton Mail also includes protections against more conventional phishing attempts, such as cloud storage email scams. PhishGuard blocks and flags suspected phishing emails, while link confirmation prompts you to verify before opening external links from an email.

No email service can provide perfect protection against account takeover. However, if someone does manage to break into your Proton account using email or SMS recovery, they won’t automatically gain access to your emails and contacts, thanks to separate data recovery protections.

Amazon is tracking you. Here’s how to stop it and what to use instead.

Proton Team — Tue, 01 Sep 2026 18:58:04 GMT

Amazon has the resources to know a lot about you: what you buy, what you watch, what you read, when you’re home, what you ask your voice assistant, what you eat, what websites and apps you use.

The sheer breadth of Amazon’s ecosystem sets it apart. It has woven itself into everyday life through online shopping, a streaming service and devices, e-readers home security cameras, smart speakers, grocery services, and other businesses that span entertainment, retail and gaming.

Individually, each of these products and services collect data to deliver what you’ve signed up for. Together, however, they create a remarkably detailed picture of your daily habits.

And the more you use Amazon, the easier it becomes for it to collect even more information about you.

The good news is that reducing Amazon’s knowledge about you doesn’t require giving up online shopping. In many cases, altering a few privacy settings can limit the amount of data that’s collected. In others, choosing different services or devices can give you greater control over where your information is stored and who has access to it.

In this guide, we’ll walk you through Amazon’s ecosystem and explain what data each service collects, why it matters, and the practical steps you can take to keep more of your personal information to yourself.

How Amazon tracks your shopping habits
How Ring cameras collect and share your data
How Fire TV and Kindle track what you watch and read
How Alexa collects and uses your voice data
Amazon-owned companies you may not realize are collecting your data
What is Amazon Web Services (AWS), and why does it matter?
How to reduce Amazon’s tracking without giving up convenience

How Amazon tracks your shopping habits

Over 150 million Americans shop on Amazon every year. The company accounts for roughly 40% of all U.S. retail e-commerce sales, giving the company a detailed view of millions of shoppers’ everyday lives.

Orders for baby products may indicate a growing family. Fitness equipment and supplements can hint at health goals. Gardening tools, pet supplies, kitchen appliances, books, and electronics all contribute to a profile of your interests and lifestyle.

Amazon Prime goes a step further. Because Prime encourages customers to centralize their shopping, streaming, reading, and music subscriptions under a single account, Amazon gains additional context on how you spend your time. Watching movies on Prime Video, listening to Amazon Music, or reading books on a Kindle paint a picture of your customer profile and can also reveal how often you’re home or how regularly you shop.

To be fair, data collection is common across e-commerce retailers. Every online retailer collects some information about its customers. To process an order, a company may need your name, shipping address, payment details, and contact information. It may also record your IP address, browser type, device identifiers, and the products you’ve viewed or purchased.

But privacy advocates have raised concerns about how Amazon handles customer information. A report by WIRED described how some Amazon employees improperly accessed customer order histories. It also said that it wasn’t uncommon for employees to look up the purchase histories of acquaintances.

How to protect yourself

You don’t have to stop using Amazon to limit its data collection. Review your Amazon privacy settings. (Instructions are below.) Disable browsing history if you don’t want products you have viewed to influence recommendations, and opt out of interest-based advertising where available.

Avoid using “Login with Amazon” to sign in to third-party websites, which allows Amazon to become part of your activity outside its own platform.

Consider whether every purchase needs to go through Amazon. Buying directly from manufacturers, supporting independent retailers, or using specialized stores for books, electronics, and household goods helps spread your digital footprint instead of concentrating it in a single ecosystem. While no retailer is completely anonymous, reducing your reliance on any one platform makes it harder for a single company to build a profile of you.

To remove access, go to Your Account and click Remove next to any third-party app or site you no longer want connected to your account.

From your Browsing History page, click the settings icon in the top-right corner to open more options.

Selecting More settings opens additional privacy controls.

From there, click the Browsing History toggle to turn it off.

Next, in Advertising Privacy and Preferences, select “Do not show me interest-based ads provided by Amazon” and click Submit.

Clicking Delete ad data removes your personal information from Amazon’s advertising systems.

Video doorbells have become one of the most popular smart home devices on the market, and Amazon’s Ring has played a major role in that growth. Being able to see who’s at your door, receive motion alerts while you’re away, and review recorded footage can be useful and convenient.

But these features also rely on cameras that are constantly monitoring the area around your home and, in many cases, uploading footage to the cloud.

Ring has expanded its AI-powered features. New tools such as facial recognition and features that can help locate lost pets aim to make neighborhood security more collaborative. However, these systems work by analyzing and sharing more visual data than traditional security cameras. Some of these features are enabled by default, meaning users may participate without fully understanding what information is being collected or how it’s used.

Ring has faced criticism over its own security. In 2019, attackers gained access to thousands of Ring accounts by using stolen credentials from unrelated data breaches and were able to view live camera feeds and speak through the devices‘ built-in microphones. The incident highlighted the importance of using unique passwords and enabling two-factor authentication.

Ring has also been criticized for sharing footage with law enforcement without a warrant. The company says it complies with legal requests and emergencies, but reports have shown that video footage has been provided to police without a warrant or the user’s explicit permission. For privacy-conscious users, this raises important questions about who ultimately controls cloud-stored recordings.

How to protect yourself

If you own a Ring device, disable features such as Search Party, Community Requests, and any optional marketing or analytics sharing if you don’t intend to use them. Enable end-to-end encryption where supported to better protect recordings in transit, and configure privacy zones so your camera avoids capturing public footpaths or neighboring properties whenever possible. (See instructions below.)

If you’re shopping for a new security camera, consider devices that prioritize local storage over cloud storage. Cameras that support recording directly to an SD card or network video recorder (NVR) reduce your dependence on a manufacturer’s servers. Brands like Reolink offer cameras built around this local-first approach.

Support for standards such as Real-Time Streaming Protocol (RTSP) and Open Network Video Interface Forum (ONVIF) also makes it easier to integrate cameras into your own home network without relying exclusively on proprietary cloud services.

Ultimately, no internet-connected camera can guarantee complete privacy. But by understanding where your footage is stored, who can access it, and which features you’ve enabled, you can make more informed decisions about the trade-offs between convenience and control.

In the Ring app, open Control Centre and tap Amazon Account Linking.

Click Unlink next to Other Amazon Services.

Enter your Ring account password and tap Unlink Accounts to confirm.

To limit analytics sharing, go to Privacy Information in the Ring app menu and tap Cookies and Third-party Service Providers.

Toggling off Third-party Web and App Analytics Cookies opts you out of third-party analytics tracking.

How Fire TV and Kindle track what you watch and read

When you’re reading on your Kindle or streaming through Fire TV, Amazon is also collecting information about you.

Kindle devices, for example, record more than the books you purchase. Depending on your settings and how you use the device, Amazon may also collect your reading progress, the amount of time you spend reading, the passages you highlight, the notes you make, and the words you look up in the built-in dictionary.

Fire TV knows how you use the device, what apps you open, what content you watch, and what you search for. It also supports Automatic Content Recognition (ACR), a technology that identifies what’s being displayed on your screen by taking hundreds of screenshots of your viewing behavior in an effort to support targeted advertising.

The challenge is that even if you replace your streaming device, your television itself may still collect similar information if it’s connected to the internet.

How to protect yourself

If privacy is your priority, start by reviewing your Fire TV privacy settings and disabling any optional data collection or interest-based advertising. You can also reduce data collection by keeping your television offline and using a dedicated streaming device instead. If you’d rather reduce tracking, Apple TV collects less viewing data than many of its competitors . Likewise, Kobo e-readers paired with Calibre offer a way to build a digital library without relying entirely on Amazon’s ecosystem.

No connected entertainment device is completely private. However, understanding which device is collecting your data can significantly reduce how much information is shared while still letting you enjoy your favorite books, films, and TV shows.

How Alexa collects and uses your voice data

Smart speakers like Amazon Echo and their built-in virtual assistants like Amazon Alexa have become a convenient way to control lights, play music, set reminders, and answer questions without lifting a finger. But they work by doing something many other devices don’t: They listen for your voice. While Echo devices are designed to activate only after hearing a wake word, they have become the subject of privacy concerns.

One notable incident occurred in 2018, when an Echo mistakenly sent a private conversation between a couple to one of their contacts. Amazon said that an unlikely sequence of misinterpreted voice commands was to blame, but it served as a reminder that voice assistants aren’t infallible.

Amazon has also faced scrutiny over how it handles voice recordings after reports revealed that employees reviewed a sample of Alexa interactions to help improve speech recognition systems. Separately, the US Federal Trade Commission fined Amazon over allegations that it retained children’s Alexa voice recordings even after parents requested they be deleted. These incidents raised broader questions about how long voice recordings are stored, who can access them, and how they’re used.

As generative AI has become increasingly important to technology companies, voice data has taken on greater value. Amazon has announced new AI-powered Alexa features that rely on cloud processing, meaning voice requests are analyzed on Amazon’s servers rather than entirely on the device itself. For users concerned about privacy, this represents another trade-off for convenience.

How to protect yourself

Amazon provides several controls that allow you to reduce the amount of information linked to your account. You can review and delete your voice history, choose how long recordings are retained, and opt out of using voice recordings to help develop new Amazon services where those options are available.

If you’d rather avoid sending voice commands to the cloud altogether, it may be worth considering smart home platforms that support local voice processing. Open-source solutions like Home Assistant Green can process commands on local hardware. While these systems often require more technical setup than a plug-and-play smart speaker, they offer a level of transparency and control that many commercial devices don’t.

Ultimately, the convenience of a voice assistant comes down to trust. If you’re comfortable sending voice commands to a cloud service in exchange for smarter features, Alexa remains one of the most capable assistants available. But if you prefer to minimize the amount of personal data leaving your home, reviewing Alexa’s privacy settings or choosing a locally processed alternative can help you regain more control over what your smart speaker hears.

In the Alexa app, go to More and tap Alexa Privacy.

Review Voice History lets you delete your voice recordings, while Review Smart Home Device History shows your connected device activity.

Scrolling further, you’ll find Review Activity History, Manage skill permissions and ad preferences, and Manage Your Alexa Data. Here, you’ll find additional ways to limit what Alexa collects and shares.

Amazon-owned companies you may not realize are collecting your data

Even if you stop shopping on Amazon, you may still be using Amazon-owned services without realizing it. The company has acquired businesses that span entertainment, books, gaming, groceries, and retail. While each service has its own purpose, many also collect information that contributes to your overall Amazon profile.

Film fans may frequent IMDb, bookworms may track their reading lists on Goodreads, audiobook listeners might subscribe to Audible, gamers are likely familiar with Twitch, and shoppers may regularly visit Whole Foods or Zappos. On the surface, these brands operate independently, but behind the scenes, they’re within Amazon’s ecosystem.

Whole Foods is perhaps the clearest example of Amazon extending its reach into the physical world. In addition to integrating Amazon Prime discounts, the company has experimented with technologies designed to connect in-store purchases with customers’ online identities. One example was Amazon One, a palm-scanning payment system that allowed shoppers to pay by scanning their hand instead of using a card or phone. Although Amazon has essentially phased out the technology at Whole Foods stores, it demonstrated the company’s ambition to link physical shopping with digital customer profiles.

How to reduce your data flowing into Amazon

Replacing every service overnight isn’t realistic or necessary. Instead, consider switching the services you use most often. StoryGraph offers an alternative to Goodreads for tracking books, TMDB provides movie and television information without relying on Amazon, and audiobook listeners can explore services like Libro.fm or borrow titles through Libby using a local library membership.

When it comes to groceries and everyday shopping, supporting local businesses can reduce your dependence on a single retailer. Recognizing just how broad Amazon’s ecosystem has become can help you make small changes that can significantly reduce how much of your digital life is tied to a single account.

What is Amazon Web Services (AWS), and why does it matter?

It may surprise you to find out that Amazon’s most profitable business isn’t its marketplace or Prime. It’s Amazon Web Services (AWS), one of the world’s largest cloud-computing platforms.

Many businesses use AWS to host websites, store data, run applications, process transactions, and deliver online services to millions of users around the world.

This became clear during major AWS outages in late 2025, which disrupted businesses, government agencies, healthcare providers, and popular online services. When a cloud provider of this scale experiences problems, the effects ripple across the internet, preventing users from accessing banking apps, streaming platforms, and other sites.

Interestingly, unlike Amazon’s retail business, AWS isn’t collecting data. Instead, its influence comes from its position as critical infrastructure. If a website or service is hosted on AWS, Amazon provides the computing power that keeps it online. A significant portion of the internet depends on this infrastructure.

This position also gives AWS considerable influence over the services it hosts. Over the years, AWS has suspended or removed customers from the platform after determining they had violated its terms of service. While supporters argue these decisions help protect users and maintain platform integrity, critics point out that when a small number of cloud providers host a large share of the internet, those decisions can have far-reaching consequences.

For individual users, however, there isn’t a practical way to avoid AWS entirely. You can neither easily tell whether the websites, apps, or online services you use are hosted on Amazon’s infrastructure, nor can you choose which cloud provider those companies rely on.

What you can control is the infrastructure you use yourself. Privacy-conscious users may prefer to self-host services such as cloud storage or media libraries using their own hardware instead of relying entirely on large cloud providers. Platforms like Nextcloud make this increasingly accessible.

Self-hosting isn’t for everyone. It requires time, maintenance, and a willingness to learn. But for those who value privacy and digital independence, it offers an alternative to large cloud providers. Even moving a handful of personal services off the cloud can reduce the amount of data entrusted to big technology companies.

How to reduce Amazon’s tracking without giving up convenience

Amazon’s products and services are designed to work together. A purchase on Amazon.com can lead to a recommendation on your Kindle. A Ring camera can integrate with Alexa. Prime connects shopping, entertainment, and groceries under a single account. Behind the scenes, AWS powers a significant portion of the internet itself. Individually, these services can be genuinely useful. Collectively, they give Amazon an unusually broad view of your digital life.

For many people, breaking out of Amazon’s box isn’t that simple. But privacy isn’t an all-or-nothing decision. Every step you take can help to reduce the amount of information Amazon has on you.

The most important thing is to make choices deliberately. Convenience often comes at the cost of sharing more personal data, but understanding those trade-offs puts you back in control.

Team password management: How to organize password vaults by department

Kate Menzies — Tue, 01 Sep 2026 16:34:31 GMT

Team password management is simple at three people. At 15 people, it starts to break down.

A small company might have a handful of tools, a few shared accounts, and usually one informal place where passwords live: a spreadsheet, a pinned message in chat, a shared document.

As more people join a business, informal sharing makes it difficult to see the difference between useful access and risky access. Passwords for everyday tools end up mixed with credentials for finance, admin, client, or infrastructure systems. The list may still look organized from the outside, but it no longer reflects who actually needs access to what.

As a business grows, shared credentials need structure and control: who can access each password, which department owns the credentials, and how access changes as people join, leave, and switch roles.

We’ll explain how to organize password vaults by team or department, how group-based access supports least privilege, and how to make onboarding and offboarding more secure — before credential sprawl becomes a security and operations problem.

Why shared password access doesn’t scale

Informal sharing is usually the first model growing companies rely on. Informal sharing is built for convenience: passwords may live in a spreadsheet, a chat thread, or someone’s browser, and nobody has to ask for access every time they need a login.

That convenience is quickly outweighed by chaos and risk. Once more teams, contractors, clients, and tools enter the business, that shared list becomes too broad for the work people actually do. The finance team may need banking, payroll, and invoicing credentials, but not ad accounts or developer tools, for example. Marketing may need analytics, content, and social media access, but not legal portals or infrastructure credentials.

The cracks show in everyday work, but offboarding is where this model becomes dangerous. When someone leaves, the business has no reliable way to know which credentials they had access to, copied, or still remember. Rotating a password means distributing the new one all over again through the same unprotected channels, with no record of who received it. Faced with that effort, many businesses skip rotation.

A business password manager with structured vaults and group-based access replaces imprecision with control: access can be granted, reviewed, and revoked deliberately.

The larger the vault becomes, the less useful it is as an access control. It may still store passwords securely, but it no longer reflects how the business actually works, who owns each credential, or who should be able to use it.

Team-based access supports least privilege

The principle behind credential access by department is simple: people should only have access to the credentials they need for their work.

The principle of least privilege is useful because it gives credential access a clear test: does this person need this credential to do their job, or do they have it because access was granted once and never questioned again? In team password management, that question should shape how vaults are created, who joins them, and when access is removed.

This is especially important for shared credentials. A shared login is already harder to govern than an individual account because more than one person can use it.

When that credential is also accessible to people who don’t need access to it, the business carries exposure without any benefit: every extra person who can view it is another device where it can be autofilled, copied, or phished. The business may know that the password is stored somewhere safe, but not whether everyone with vault access still has a valid reason to use it.

Groups in Proton Pass for Business solve this: admins can organize people into groups that mirror teams, departments, or projects, then assign those groups to specific vaults and items, so access follows the role rather than a list of individual grants.

Vault structure should match risk. Low-risk operational logins can be shared easily, while admin credentials, finance tools, HR systems, customer exports, and backup access need tighter controls.

What good vault structure looks like

A useful vault structure should help people find what they need without giving them everything.

A practical baseline for most growing SMBs includes six password vaults by team::

Finance: Accounting, payroll, banking, invoicing, tax portals, payment platforms.
Marketing: Social media, analytics, advertising, content management, design tools.
Sales and customer success: CRM, proposal tools, customer portals, support platforms.
Operations: Vendor portals, project management tools, logistics, procurement.
IT and security: Admin consoles, backup accounts, device management, DNS, hosting, infrastructure.
Leadership: Board materials, investor portals, executive-level services, sensitive vendor accounts.

When vault structure and group access work together, admins can manage permissions at scale: assign a finance group to the finance vault, an IT group to infrastructure vaults, and a project group to temporary client work. Access then scales with the org chart instead of with an admin’s memory.

After the base structure is in place, create restricted vaults where the risk justifies them. An IT team may keep a general IT vault and a separate privileged admin vault, both assigned to the appropriate groups.

This becomes essential during onboarding and offboarding. Adding someone to a group grants them all necessary vaults at once; removing them revokes everything at once.

The goal is not to make vaults complicated. The goal is to avoid mixing credentials with very different risk levels. A social media scheduler should not share access with payroll administration.

Password vault structures for different team sizes

A very small business doesn’t need enterprise-level vault architecture. Too much structure too early can create confusion and slow adoption.

Even at one to two people, separating business credentials from personal ones in separate vaults sets a foundation for growth.

For a team of three to 10 people, a few broad vaults may be enough: company operations, finance, marketing, and IT. The main priority is to avoid one vault for everything and keep the most sensitive credentials separate.

For a team of 10 to 50 people, vault structure needs to follow how the business is actually organized. At this stage, credential access becomes part of everyday operations: people join teams, contractors come in for specific projects, managers become responsible for the tools their teams use, and admins need a way to review access without opening every credential one by one. Contractors and external collaborators can be assigned to project-specific vaults without scoped access, so they only see what their engagement requires — and lose access automatically when the project ends.

For teams of 50 or more — larger SMBs and mid-market teams — vaults may need to follow both departments and roles. A department label is not always specific enough; someone may work in finance without needing banking access, or support IT operations without needing privileged admin credentials.

The structure should fit the business, not the other way around. The following sections explain how to operationalize that structure through onboarding, offboarding, and ongoing access reviews.

Building structure into onboarding

Onboarding often exposes weak password management. A new employee joins and someone has to remember which credentials they need, where those passwords live, who can share them, and which access should wait until after training or approval.

A team-based model removes that reliance on memory. When a new finance hire joins, they don’t need a colleague to manually identify and share each credential. They can simply be added to the finance group for the access they need. No one should have to forward links, paste passwords into chat, or remember which tools the finance team usually uses.

The person should simply be added to the finance group and automatically inherit the vaults and items assigned to it — only the credentials tied to that role. This makes onboarding faster and keeps sensitive accounts from spreading beyond the team that needs them. People can start work without chasing passwords, while the business avoids giving broad access for convenience.

This is also where a clear password policy helps. Proton’s guide to creating a password policy explains how businesses can define password creation, secure sharing, access management, and authentication rules. Those rules become easier to apply when credentials are already organized by team.

Making offboarding more secure

With one shared company vault, revocation is all-or-nothing: the departing employee may have touched dozens or hundreds of credentials, facing broad rotation or — worse — leaving ex-employees with lingering access.

A precise offboarding looks like this:

Remove the person from team and project groups.
Review any credentials they owned or managed.
Rotate higher-risk passwords where needed.

The business can focus rotation and review effort on the credentials that actually carry risk, instead of treating every password as a fire drill.

This is where creating groups pay off. If access is managed only through shared vaults, an admin has to revoke the person from each vault one by one. With groups, removing them from the group revokes every vault and item assigned to that group at once — one action instead of an audit.

The same logic applies when someone changes roles. A person moving from sales to operations should not keep old CRM admin credentials by default. Role changes should trigger a vault access review just as much as offboarding does. With group-based access, this review is fast: move the person between groups, and their access updates automatically — old CRM credentials gone, new operations vaults granted, in one simple step.

Better visibility for admins

Good team password management gives admins a clear view of access. They should be able to answer basic questions quickly.

Key access questions admins should be able to answer

Who can access finance credentials?
Which vaults include contractors?
Which users have access to admin passwords?
Which credentials are shared across departments?
What changed after an employee left?
Which vaults contain high-risk or privileged accounts?

The NCSC’s identity and access management guidance emphasizes controlling who and what can access systems and data. It also points to the importance of limiting access to what is needed and reviewing access regularly.

This is difficult when access is organized around convenience instead of responsibility. A clean vault structure gives admins a stronger starting point for security audits, access reviews, and customer questionnaires.

For IT teams, Proton Pass for Business supports centralized management, policies, secure sharing, reporting and logs, SCIM provisioning, and SSO integrations. Teams gain centralized visibility that browser-saved passwords and shared spreadsheets don’t provide.

Common mistakes in shared vault management

Shared vault problems usually begin as shortcuts. They make access easier in the moment, but they also make it harder to know who can use which credentials later.

Five mistakes account for most shared vault failures in growing businesses:

Keeping one company vault for too long

A single vault may work at the beginning, but it eventually gives too many people access to credentials outside their role.

Depending on one admin’s knowledge

If only one person knows where critical credentials live, the business is reliant on memory instead of process — and that knowledge walks out the door with them.

Treating vault access as permanent

People change roles, contractors finish projects, and vendors leave. Vault access should change with them.

Forgetting credential rotation

Some passwords need to be changed after offboarding, role changes, or periods of overly broad sharing, especially for admin accounts, finance tools, customer systems, and vendor portals.

Mixing everyday logins with privileged access

A team vault can make daily work easier, but high-risk credentials still need stricter review and narrower access.

Each of these mistakes has the same root cause — access organized around convenience — and the same cure: structure that reflects team, roles, and risk.

How Proton Pass for Business supports team password management

Proton Pass for Business helps businesses move from informal password sharing to structured credential management. Teams can generate strong passwords, store credentials in encrypted vaults, share access securely, and manage business passwords from one place.

A business password manager gives teams a safer place to store and share credentials, but the structure around those credentials still matters. For growing teams, the next step is making sure shared access reflects how people actually work: by department, role, project, and level of risk.

With groups in Proton Pass, credential access is managed at the level teams actually work: admins assign vaults and items to groups mirroring their departments or projects, and membership changes update access automatically — adding a hire grants everything they need; removing them revokes it all.

Clearer structure makes secure sharing easier to manage in the flow of work. Credentials are organized around the teams and roles that actually use them, admins have a better view of access, and employees can find the passwords they need without moving secrets into chat, email, or personal notes.

Organize your team’s credential access with a business password manager.

Become a Proton Pass managed service provider (MSP) with our new program

Raphael Auphan — Tue, 01 Sep 2026 11:56:18 GMT

Small and medium-sized businesses are under threat from hackers in a way they’ve never been before. They’re the new favorite targets of ransomware attacks. AI-fueled phishing scams and malware-as-a-service make criminal work easier than ever. Our SMB Cybersecurity Report found that hackers breached one in four SMBs last year, costing most of them between $10,000 and $100,000.

The best solution is also the simplest: Use a business password manager.

To make strong cybersecurity even more accessible to SMBs, Proton Pass is launching a pilot program for managed service providers. We’re inviting MSPs in our community and beyond to take part. By joining the program now, you’ll be able to offer and manage Proton Pass Professional subscriptions from a dedicated portal in your own Proton Pass dashboard.

Many organizations use our Proton Pass password manager within their own infrastructure, and some IT firms and MSPs deploy it for other businesses. But until now, a more feature-rich managed services portal hasn’t been available. This program gives you the opportunity to add Proton Pass to the product portfolio offered to your customers while helping to shape the development and features of the Proton Pass MSP product.

What is the Proton Pass MSP pilot?

The pilot program introduces a dedicated portal that allows MSPs to sell and manage Pass Professional subscriptions across multiple client organizations from one interface.

Before we roll out MSP services for broader availability, we’re inviting MSP businesses to take part in this initial pilot program. We’ll work closely with them to understand how they use the portal and what new features they would like to see.

This launch focuses on the core features you need as an MSP, including:

Allowing multi-organization user provisioning and management
Having an overview of all sub-organizations that you manage, showing allotted vs. used licenses per client, with one-click access to each client’s admin dashboard

What to know about the pilot program

If you’re interested in taking part, here’s what to expect:

After you get in touch with our sales team and set up an agreement, you’ll be granted access to the new MSP portal.
You’ll be subscribed to your own Proton Pass plan that allows you to create and manage client sub-organizations from the dedicated MSP portal.
Every seat allocation or disablement is recorded as a timestamped event.
At the end of each month, you can export a detailed report that you can use to bill your own clients.
You’ll also be sent an invoice by Proton in line with the detailed report.

Find out more about the pilot program.

Why partner with Proton Pass as an MSP?

When you provide third-party password management services for businesses, your clients trust you to protect their entire IT perimeter, which includes valuable and sensitive business data. That means choosing reliable tools that meet high security standards, not just ones that offer the right price or make claims you can’t verify.

Security your clients can rely on

Everything we claim about Proton Pass’s security is backed up by regular third-party security audits and our application code is all open-source so anyone can verify it. Our zero-knowledge architecture and end-to-end encryption form a secure foundation for any business.

Read why fintech Elemnta chose Proton Pass

Effective password management for teams

Proton Pass provides secure credential management with customizable policies and granular reporting that make it an ideal choice for managed service providers. You can manage all of your clients’ organizations from one console, ensuring that business password policies are followed and strict security standards are met.

Easy enough for anyone to use

When you’re introducing a new password manager, encouraging adoption can be a challenge. Proton Pass was designed to work for anyone, no matter their familiarity or confidence with tech. Companies that switch to Proton Pass say the intuitive interface led to more widespread adoption.

See how French coworking firm Morning rolled out Proton Pass

An EU-based alternative for digital sovereignty

Many businesses are looking for European alternatives to the American tech they’ve relied on because they’ve realized they don’t truly have control of their own data. When clients ask how you address this problem, Proton Pass can be the simple answer.

You can learn about all the Proton Pass features and see how Pass compares to other password managers. Our sales team is also available to help you if you have any questions about the MSP program or need answers for your clients.

Find out more about the pilot program and how businesses can benefit from adopting a secure European business password manager.

August 27 outage: Incident report

Bart Butler — Fri, 28 Aug 2026 21:12:56 GMT

In the early hours of August 27, 2026, Proton experienced a widespread outage that impacted services for a number of users. The root cause was a total failure of the cooling system in our Frankfurt datacenter. While all systems at Proton are redundant and we have enough capacity to endure a complete data center failure, there are a small number of scenarios where the failover can take longer and lead to user-facing disruptions.

Here’s a timeline of what happened, what choices we made during the incident and why, and how it was resolved.

Timeline

Just after 11 p.m. (Central European time) on Wednesday, August 26, a cooling system failure occurred in the main room of our Frankfurt datacenter. At around 11:15 p.m., the temperature started rising from approximately 21.8°C (nominal temperature) to 51.9°C in less than half an hour, with some measurement probes reporting 60°C air temperature in the room. As the temperatures rose, server and networking equipment within the facility started to die one by one.

The user-facing incident began at around midnight on August 27, when the failures escalated to the point that critical redundancy was lost. This occurred when both the primary and backup network switch on a critical rack failed, and this rack unfortunately contained several primary database copies. While almost all Proton systems are redundant and will failover automatically/immediately, primary database failovers are not done automatically without human supervision.

We retain this control out of a desire to avoid so-called “split brain” situations, where a temporary unavailability of a primary database means that the replica copies miss some updates and become de-synced in ways that can be difficult to reconcile later. Furthermore, when a primary database failover occurs, the standard operating procedure is to failover to a replica in the same datacenter for latency and performance reasons. However, the specific nature of the problem meant that this might be ill-advised, since we potentially could be failing over to something that would also go down.

The decisions

At this point, Proton’s on-call engineers needed to make a couple consequential decisions while operating under extreme pressure.

Do they prioritize bringing the service back online, or prioritize addressing the cooling problem and saving the hardware inside the datacenter?
Should we failover to replicas within the same building Frankfurt (faster and less disruptive, but possibly a temporary fix if the heat could not be brought under control), or failover to Zurich?
Do we failover everything or just what is down at the moment? We have contingencies for complete data center failure where things failover fully and mostly automatically rather quickly, but a situation where random servers are dying one by one is not handled well by our failover logic.

Ultimately the rate at which temperatures were rising forced us to prioritize saving the hardware versus bringing services back online. This is not a choice that typically needs to be made, because cooling systems are typically redundant, and the complete loss of cooling is quite rare, meaning that there is quite a bit of time before temperatures become critical. The problem is exacerbated by large increase in server power density in recent years with higher power CPUs and GPUs for AI. As a result, what used to take 3-4 hours to go critical went critical in 20 minutes.

The on-call team therefore focused their attention on communicating with the on-site datacenter operations team to restore cooling while powering off as many servers as possible to protect them. Due to a server equipment shortage tied to the ongoing AI boom, lots of this equipment — if lost — would not be possible to replace on short timelines. Saving it had to be a priority, even at the cost of potentially extending the downtime.

By 00:45 CEST, we were able to restore cooling and temperatures at the facility began to drop, and the on-call team switched focus to service recovery. At this point, we made the decision to failover the primary databases to Frankfurt if a replica was still alive, and to Zurich in cases where there was no replica alive in Frankfurt, to avoid changing our traffic flows too much and possibly creating new instability. This option was selected because we assumed that, now that we had the cooling under control, it would be relatively easy to bring Frankfurt back online and faster than switching over to Zurich.

Unfortunately, this turned out not to be the case. During the incident, many network cards in the Frankfurt infrastructure reached a temperature of 105C (normal operating temperature is 45C), which triggers a special temperature protection mode and causes the network cards to be disabled until there is a cold system reset. Our security posture limits the ability to access the out-of-band controller for our systems, which required us to wake up additional staff to assist with the recovery.

By 01:30 CEST, we were able to get most services back online for most users. However, some less critical systems, such as push notifications or payment processing, were not recovered until around 02:00 CEST.

As we reported during the initial incident report, no emails were lost, but email delivery in both directions was delayed during the incident.

While user-facing services were fully restored, that was not the end of the night for our engineers, in particular the database team. Our infrastructure was left in a highly abnormal state, with some primary databases in Zurich and others in Frankfurt, and several of them operating with reduced redundancy and/or reduced performance. Our team worked through the night to resolve the most pressing of these issues, and the work continued through the day on August 27 to restore full redundancy.

While we were able to save almost all of the infrastructure, some servers unfortunately suffered heat death, and we don’t know yet if the heating incident will impact the lifespan of the surviving equipment.

Root cause and next steps

A subsequent investigation on August 27 traced the root cause of the cooling failure to an air filter replacement on both of the redundant air compressors powering the cooling system. Unfortunately, the datacenter operator performed this operation in the middle of the night, without prior notice, and also failed to communicate the cooling failure when it happened, which dramatically cut down the time we had to respond. We are working closely with the operator to prevent a repeat of this incident.

However, it is also a known limitation of our current database infrastructure that an outage of this type could lead to a longer than normal recovery process. The series of events that led to this incident are highly improbable — yet they happened.

The database resilience work required to address this failure mode is already underway and remains planned for completion by the end of the year. Additional infrastructure capacity, including new datacenter space, is also currently being commissioned and is expected to become available within the next few weeks, which will further reduce our single site dependency.

Unfortunately, this incident occurred before those improvements were fully in place. We are now reviewing where we can safely accelerate the remaining work while maintaining the level of care required for changes to critical database infrastructure.

We recognize that our users expect a very high level of reliability from Proton, and this incident reinforces the importance of completing this work and continuing to raise our resilience standards. We apologize again, unreservedly, to every user who was impacted.

How to choose remote work tools that don’t create security debt

Alanna Alexander — Fri, 28 Aug 2026 12:32:43 GMT

Remote work tools may not feel like a major infrastructure decision when you’ve just started scaling your business. They can feel like a relatively minor task compared to making payroll, shipping your MVP, or keeping your runway alive… But that’s where the danger lies.

The remote work tools you pick on day one become infrastructure you’re stuck with, and the gaps between those tools quietly accumulate into serious problems you won’t notice until it’s too late. That’s security debt — and it’s more common than you’d think.

One in four SMBs experienced a breach last year, despite actively investing in security tools. The problem wasn’t the password managers or VPN they chose: it was the gaps between them.

Security debt doesn’t hit you immediately, but it does compound in the background until the worst possible moment: When an enterprise customer asks for your audit trail and you don’t have one. Or an investor asks where your data is stored and you tell them it falls under US jurisdiction. Or a security questionnaire asks you to list everyone who has had access to your core systems in the last 24 months, and you realize you never tracked this.

Here’s how to build a secure stack of remote work tools that closes those gaps and is built to last.

11 of the best remote work tools for your team

Every business has different needs, but there are certain categories of remote work tools that just about every business needs to fill. Here are the 11 tools we recommend for each.

1. Slack (Best for team chat)

Launched in 2013, Slack has become the default choice for teams that want chat, voice, and video in one place. It replaced the endless email threads of old with channels organized by team, topic, or project, and its deep integration library (Google Calendar, Jira, and hundreds more) makes it a notification hub for your whole stack. One drawback to consider: on some plans, admins can access message history, a potential privacy concern for some businesses.

To find out what else is out there, read our list of the best internal communication tools.

2. Proton Mail (Best for business mail)

Email providers with economic models built around ad targeting can’t guarantee that your emails won’t be read by anybody else, whatever their privacy policy claims. Proton Mail is end-to-end encrypted by default, and protected under stringent Swiss privacy law, so only you and your recipient can read what’s sent. (Please note: emails to non-Proton recipients aren’t end-to-end encrypted unless you password-protect them first.)

3. Loom (Best for async video)

If you’ve ever been in a meeting that could easily have been a two minute video, Loom could be the solution for you. It lets you create video notes, recording your screen, face, and voice together, to be shared as a link. Popular use cases include recording onboarding walkthroughs, bug reports, and async updates across time-zones. (Note that Loom recordings are stored on Loom’s own servers rather than your team’s infrastructure, worth knowing if you prefer to keep company data under your own control.)

4. Proton Meet (Best for video conferencing)

Unlike Zoom, Proton Meet is end-to-end encrypted by default, which means not even Proton can access what’s said or shared on a call. Guests join with just a link, no account required, and the free plan covers one-hour calls with up to 50 participants. One caveat: Proton Meet works well for internal team calls, but if your workflow leans on integrating video directly into a CRM or support tool, you should check compatibility before switching.

5. Jira (Best for project management)

Jira is built for software teams running agile workflows: think sprints, backlogs, and issue tracking that ties directly to your codebase through Bitbucket or GitHub integrations. As such, Jira is the default choice for many engineering teams already inside the Atlassian ecosystem. On the downside, it is more configuration-heavy than general-purpose tools like Asana, and outside of a dev team it can feel like overkill.

6. Trello (Best for tracking tasks)

Simplicity is Trello’s strength, stripping task management down to cards moving across boards labeled to do, doing, and done. There’s almost no learning curve, making Trello a natural starting point for a small team. Once your team grows, however, that simplicity can become a limitation: you won’t find it so easy to perform cross-project reporting on it.

7. Miro (Best for visual collaboration)

When gathering around a physical whiteboard is impossible, a Miro board gives teams a remote — and much more flexible — option: an infinite digital canvas for planning, collaboration, and brainstorming. You can drag and drop files onto boards, set up repeat workshops with templates for retrospectives and planning sessions. While Miro is great for teams who can work in live, synchronous sessions, it’s less useful for teams working async across time zones.

8. Proton Drive (Best for cloud storage)

Proton Drive is the privacy-first alternative to Dropbox and Google Drive. Though it has fewer direct integrations than those apps, Proton Drive does a better job of protecting your data, encrypting files on your device before they ever reach Proton’s servers so that Proton can never decrypt them, even under a court order. Version history, access logs, and granular permissions come built in, and shared links expire by default rather than staying open indefinitely.

9. Proton Pass (Best for password/credential management)

The risk of credentials leaking increases sharply outside of a controlled office environment. Unlike most password managers, Proton Pass encrypts every field of every saved item by default: not just passwords, but usernames and notes too. It also includes email alias generation to keep your team’s real email addresses out of signup forms. (Note that advanced admin controls — SSO and SCIM directory sync — are reserved for the Pass Professional tier, not the base plan.)

10. Notion (Best for building a knowledge base)

With Notion, you can organize and centralize your business’s internal knowledge and documentation in pages, databases, and wikis, building a single source of truth for your teams and eliminating doubt over which document versions are current. But be warned: Notion’s flexibility can become a risk, enabling the building of an unstructured wiki that sprawls unless someone keeps an eye on it.

11. Lumo

Even small teams benefit from AI assistance that lets them draft, edit, summarize, and research faster without having to add to head count. Lumo is Proton’s AI assistant, built to offer all the power of AI without compromising your IP and sensitive data. Gemini and Copilot need access to your document data to function, but Lumo never trains on your inputs. (Lumo is available on Premium Proton plans only.)

Why even the best remote work tools can put you in security debt without you knowing it

Even genuinely good remote collaboration tools add up to a shaky stack when each one operates under its own security model. A stack with no unified access control, no audit trail, no data sovereignty, and security debt accumulating from day one.

Security debt comes in four types:

Access debt: Your stack forces you to manually provide and revoke access across five or six different platforms. It’s on you to remember (and memory is far from 100% reliable). Result: the contractor who left you six months ago can still open your files.
Audit trail debt: The access that you’re controlling isn’t recorded anywhere. You know someone accessed that folder, but you can’t prove it. And when a future investor, customer, or regulator asks you who had access to what, when, you haven’t got a good answer.
Jurisdiction debt: Your files are sitting on servers that fall under the CLOUD Act. You didn’t mean for that to happen: you just chose Dropbox.
Human error debt: Fragmentation means more manual steps, which means more human error, which means…? Let’s just say that 39% of breaches last year were caused by human error.

None of this is inevitable. Every risk we’ve listed is easier to cleanly avoid if you choose a more unified stack of remote collaboration tools from Day One.

What a secure remote work stack actually looks like

Most SMBs (66%) say demonstrating cloud data security (especially as far as client data is concerned) is very or critically important when winning new business. A unified platform gives you that — by closing the gaps where security debt accumulates:

Unified access control: One admin layer. Instead of having to work through a six-platform checklist, you need to be able to perform one action to add and remove a team member from your infrastructure.
Encryption by default: Your data is encrypted in transit and at rest. End-to-end encryption means your provider can’t read your files and can’t be compelled to hand them over.
Data sovereignty: Your data is governed by laws you understand, in a jurisdiction you trust. (Not one that falls under the CLOUD Act.)
Automatic audit trails: So you never need to tell an investor (much less a regulator) that you don’t have one.
Built to scale securely: Your permissions, access tiers, and admin controls work whether your company is ten people or 100. No need to rebuild, no need to slow down.

Cybersecurity for startups starts earlier than you think — the earlier you build it in, the less you’ll have to bolt on (or clean up) later.

Your remote work toolkit, built on Proton Workspace

We’ve already introduced you to Proton Mail, Meet, Drive, Pass, and Lumo in this article. But selecting the best tool for each job doesn’t automatically close the gaps between those tools. To do that, you need a unified stack like Proton Workspace.

With Workspace, the security-critical layer of your stack is in safe hands: yours. Your data is under your control, encrypted from end to end (not even Proton can see it) and protected under one of the world’s strongest privacy jurisdictions.

Compliance isn’t a concern: Proton is ISO 27001 certified, GDPR and HIPAA compliant.

You’ll need to add tools on top for management and team messaging. But you’ll do so on a foundation that’s already secure.

Access debt: resolved. One admin dashboard. One action to provision a new team member across every Proton service, one to remove them when they leave
Audit trail debt: resolved. Version history, access logs, and granular permissions are built into Proton Drive and Proton Docs by default
Jurisdiction debt: resolved. Headquartered in Switzerland, outside US and EU jurisdiction
Human error debt: resolved. Expiration dates are set on links by default. Files are automatically encrypted in storage. Security is enforced automatically, not manually

The tools you pick on day one create the security debt you’ll pay off later. Build on the right foundation, and you can stop worrying about security debt — and start using your security posture as a selling point.

Try Proton Workspace

Team collaboration software: 7 tools that won’t waste your money

Alanna Alexander — Thu, 27 Aug 2026 18:35:04 GMT

Most businesses build their team collaboration software stack the same way: one tool at a time, filling needs as they come up. When you’re just starting out, this seems like a reasonable approach.

But there’s a catch. Approaching the challenge of enabling team collaboration this way is how you end up with a Frankenstein’s monster of a stack, made entirely of parts that are stitched together inorganically.

Even if the parts are good, the disconnection between them causes problems. You’re paying more subscription fees than you can track. You’re not sure who has access to what. And you’re drowning in admin work.

This is a guide to taking the alternative route: building a team collaboration stack that has the essential tools in one place and is as consolidated as possible to save you money and time.

7 team collaboration tools your stack needs

Every team collaboration stack needs to cover the same ground: chat, email, video, documents, storage, and project management. It’s also worth adding visual collaboration and a knowledge base to that list.

Here are the seven tools you need to cover everything — with privacy built in wherever a genuinely private option exists.

1. For team chat: Element

Slack might be the most popular choice for team chat, but it’s not the most private. Element covers the same ground, with video calls, file sharing, and bridges to other chat networks — but it also encrypts private chats and direct messages by default. Element is built on Matrix, an open-source, decentralized protocol, so you can self-host for full control, or use a managed service. In either case, nobody outside the conversation ever holds your decryption keys. (With one exception: Element’s Enterprise Cloud offers an optional compliance tool that lets admins read conversations, including encrypted ones, but you can keep that switched off if privacy is your priority.)

2. For business email and calendar: Proton Mail

Proton Mail gives you all the same essential business email functionality as Gmail or Outlook, with the added bonus of end-to-end encryption. Google and Microsoft process messaging content to power search and AI features; Proton Mail’s encrypted architecture ensures your business communications are for your eyes only. Proton Calendar is bundled in, so your event details — including meeting titles and guest lists — also stay private, and scheduling doesn’t require a separate app or another login.

3. For project and task management: Stackfield

Stackfield beats out market-favorite Trello on data privacy, applying genuine end-to-end encryption across tasks, chat, files, and project notes, protecting them from exposure to both cybercriminals and court orders. Stackfield also offers jurisdictional safeguards: as a German company hosting exclusively on EU servers, they can’t be reached directly by the US CLOUD Act. But Stackfield isn’t simply a more secure version of Trello: it goes beyond Trello’s boards and cards with list, Kanban, and Gantt views, plus bundled team chat, calendar, and workflow automation.

4. For video conferencing: Proton Meet

Zoom might be the go-to for video conferencing for many businesses, but it’s far from the most private option. Its AI Companion feature processes call content — including anything commercially sensitive — to generate summaries and transcripts. Proton Meet’s default end-to-end encryption ensures that what’s said on a call stays between the people on that call. Guests join with a link and no account, and the free tier covers one-hour calls with up to 50 participants.

5. For visual collaboration: Miro

Miro is essentially a digital whiteboard, but its infinite canvas gives distributed teams a shared space for planning, brainstorming, and workshops that no whiteboard — or even chat thread or document — can replicate. Miro packs in enough features that mastering all of it takes time, but getting started takes just minutes: templates for retrospectives and roadmapping sessions mean new teams aren’t starting from a blank canvas.

6. For cloud storage and document collaboration: Proton Drive

Proton Drive offers business cloud storage that matches Google Drive and Dropbox on granular per-file permissions and version history. Where it pulls ahead is what happens if a breach occurs. Google and Dropbox need access to your file content to index it for search and power AI features; that means they hold the keys to your contracts, financial records, and product roadmaps, and a breach on their end could expose that content directly. Proton Drive is end-to-end encrypted by default with zero-access architecture: Proton can’t decrypt your files, so neither can anyone who breaches its servers.

Proton Drive also covers document collaboration, since Proton Docs and Proton Sheets are included with every Proton Drive plan. Docs and Sheets cover the same core functionality as Google and Microsoft’s document tools (real-time co-editing, comments, and version history), while adding end-to-end encryption, ensuring your contracts, drafts, and financial models get the same protection as everything else in your stack.

7. For a knowledge base: Notion

Many businesses — particularly those scaling fast — struggle with the chaos that comes with disorganized internal documentation. Notion centralizes internal documentation, wikis, and reference material in one searchable space, cutting down on the scattered, outdated copies competing for attention.

Unfortunately, Notion content isn’t protected by end-to-end encryption, and there isn’t any end-to-end encrypted alternative with the same wiki structure. If your team stores confidential client files, strategy documents, product plans, or company IP in the cloud, we recommend using a more secure Notion alternative: Proton Drive.

It doesn’t replicate Notion’s wiki structure, but real-time co-editing and zero-access encryption beat an unencrypted wiki for anything sensitive.

The hidden cost of a disconnected collaboration stack

Let’s say you’re starting from scratch and decide to go with the seven tools we recommend. Here’s how your collaboration stack will look (notice that there are’s only seven rows, as Drive includes both Docs and Sheets) — and it looks pretty solid.

	Best for	Pricing	Key feature
Element	Team chat	Free (self-hosted Community edition); Enterprise/Sovereign = custom quote (no public per-seat price)	End-to-end encrypted by default, self-hostable, built on open-source & audited Matrix protocol
Proton Mail	Business email	Mail Essentials (includes Proton Calendar) $6.99/user/month(annual)	Shared domain, encrypted calendar and contacts built in
Proton Meet	Video conferencing	Meet Professional $7.99/user/month(annual)	Link-based guest access, no download required
Proton Drive	Cloud storage & document collaboration	Drive Professional (also includes Proton Sheets) $7.99/user per month (annual)	Granular per-file permissions, realtime co-editing, version history
Stackfield	Project & task management	Business €14/user/mo (~$16.20 USD, converted to USD at ~1.157)	End-to-end encrypted chat, tasks, files & docs; EU-only hosting (Germany)
Miro	Visual collaboration	Free; Starter from $8/user/mo (annual)	Infinite canvas, templates for recurring sessions
Notion	Knowledge base	Free; Plus from $10/user/mo (annual)	Pages, databases, wikis (note: no end-to-end encryption)

However, if these tools are all running individually, not consolidated under one platform, you’re opening yourself up to three big problems.

1. The hidden subscription bill

Individually, the tools in our seven-tool stack don’t seem to cost that much. However, add the six subscriptions with public pricing up (Element doesn’t publish a per-seat price), and — at the time of writing — a team of 25 is running up a bill of approximately $17,151 a year. And your team probably isn’t even using every seat.

It’s easy to lose track of what you’re spending on a set of disconnected team collaboration tools. You know they’re automatically renewing, but you’re reluctant to cancel the one you suspect nobody’s using because that means finding the login details. Or you’re worried that someone on your team must need it. (Why else would you have it?)

2. The cost of insecurity

Disconnected tools multiply your attack surface, with each surface a potential misconfiguration waiting to happen. In the long run, that could cost you dearly. Proton research shows that 25% of SMBs experienced a data breach last year, and 57% of breached SMBs lost between $10,000–$100,000.

3. The burden of admin

Time is money, and multiple tools demand that you spend a lot of both. Think of all that time spent adding and revoking permissions across seven tools (assuming you remember to), or reconciling seven separate invoices, or trying to figure out if anybody’s actually using that Miro seat you’ve been paying for since March. All these costs might not show up on one invoice. But they’re there.

What a consolidated collaboration stack gives you

The answer to reducing the cost and waste of a disconnected stack isn’t better tools, and it certainly isn’t more tools. The answer is a team collaboration platform that covers as many of the functions your disconnected tools are currently fulfilling as possible, while also giving you a secure and easily administered foundation for whatever other tools you need.

Pick your platform wisely, and replacing multiple tools with one platform will simplify and secure your team collaboration in a single stroke. When you have one platform handling team communication, file storage, document collaboration, and admin, you’re only dealing with:

One bill, one renewal date, with one owner. Zero autopilot charges for unused tools
One admin dashboard to control onboarding, offboarding, and access permissions. (No contractors hanging around in your Dropbox months after project completion)
One security model, with one permissions system to administer, no gaps between tools, and no seven-tool misconfiguration risk
One audit trail so you can see who accessed what, when, all in one place (and provide proof when investors or regulators come calling)

A consolidated, encrypted stack won’t just save you in subscriptions and security incidents. It sends a signal to your customers that you’re serious about handling their data seriously. It lets investors know that your operations are under control.

The platform to consolidate your stack: Proton Workspace

With our digital workspace platform for businesses Proton Workspace, you get all the Proton products and features we’ve mentioned on one platform: Mail (including Calendar), Meet, and Drive (including Docs and Sheets).

Instead of running those products as separate subscriptions, each with its own admin panel and its own bill, you get all of them under one account and one security model.

The subscription saving: purchasing Mail, Meet, and Drive as separate subscriptions costs more than getting them together, since each one carries its own base fee on top of your per-seat pricing. Proton Workspace consolidates all of them into a single line item instead. Proton Workspace doesn’t replace Element, Stackfield, Miro, or Notion (you’ll still need separate tools for chat, project management, visual collaboration, and wiki-style knowledge sharing) but on the tools it does replace, the saving is meaningful.
The admin relief: Instead of three dashboards, you have one. Instead of three invoices on three different renewal dates, one. You can see exactly who’s using what, so no more paying for seats nobody’s touched since March. And when someone joins or leaves, onboarding and offboarding means one action for each user, not three. (And no more contractors retaining access to folders that are no longer their business.)
The security foundation: You’ve established a secure foundation for collaboration. Proton Workspace is ISO 27001 certified, and GDPR and HIPAA compliant. All its services keep your data protected with end-to-end encryption and Swiss jurisdiction. Not even Proton can access your files.

On top of this, you get extra products bundled in: Workspace Standard subscribers get a business VPN and team password manager bundled in; Premium subscribers get these, plus Lumo, our business AI assistant.

Migrating your email and calendar to Proton is straightforward: Proton’s Easy Switch tool imports your existing emails, contacts, and calendars automatically (including from Gmail).

Few SMBs get their collaboration stack right the first time around. The right team collaboration platform is the one your team uses, your admin controls, and your finance team can see on one invoice.

Try Proton Workspace

AI is making phishing attacks more sophisticated: What can businesses do about it?

Ben Wolford — Thu, 27 Aug 2026 17:46:23 GMT

AI phishing attacks are changing one of the oldest rules in security awareness: bad grammar is no longer a reliable red flag.

For years, employees were taught to look for awkward wording, strange formatting, spelling errors, and generic greetings. These clues are still important, but they can’t detect AI-powered phishing attacks.

Generative AI can help attackers write personalized messages in seconds. It can imitate a company’s tone, summarize public information about an employee, turn a short prompt into a convincing invoice request, or localize a scam to sound native in any target language.

However, this isn’t a completely new threat. It’s leveled up phishing with better writing, faster preparation, and more convincing impersonation. Phishing still aims to make someone click, share credentials, approve a payment, open a file, or move a conversation to a channel the attacker controls. AI simply makes that manipulation more convincing and easier to scale.

Within businesses, teams need to build new habits. We’ll explain what to look for and how to build better phishing and data breach protections within your business network.

How are AI phishing attacks different?

AI-generated phishing emails look like real work

New forms of AI social engineering

Why SMBs are increasingly exposed

How to adapt your phishing training to AI-enabled attacks

What businesses need to do differently

How Proton Pass for Business helps reduce credential risk

How are AI phishing attacks different?

Before generative AI, phishing required more manual effort. Attackers had to research a target, write believable copy, adjust the tone, and sometimes translate messages for different markets. Generative AI lowers these barriers to entry significantly.

The UK National Cyber Security Centre’s report on the impact of AI on cyber threats from now to 2027 notes that AI will almost certainly make parts of cyber intrusion more effective and efficient, increasing the frequency and intensity of cyber threats. It also notes that threat actors are already using AI to improve existing tactics, including social engineering.

Attackers can now produce phishing attack messages that look more natural and more specific. A scam email can refer to a real supplier, a recent LinkedIn post, a job title, a regional event, or an internal project name. Even when the attacker has limited information, AI can fill the gaps with language that sounds plausible.

The warning signs of a phishing attack remain the same. Suspicious links, urgent requests, unexpected attachments, and strange sender domains still matter. But the content itself is no longer enough to give the attack away.

Traditional phishing attacks	AI-powered phishing attacks
Often have typos, awkward grammar, or generic greetings	Can use polished, natural writing with the right tone
Usually rely on broad, generic messages	Can include personal details, company context, or vendor references
Mostly appear as suspicious emails	Can combine email, voice cloning, fake invoices, and deepfake video

AI-generated phishing emails look like real work

Phishing attacks have always ranged from crude to highly sophisticated, but generative AI lowers the skill and time needed to produce messages that are fluent, well-structured, and written in professional-sounding language.

The NCSC’s phishing guidance notes that phishing campaigns may try to steal sensitive information like passwords, or trick people into transferring money. It also explains that more targeted campaigns use information about employees or the company to make messages feel more realistic. AI makes that easier to do at scale.

Defense against modern phishing attacks requires layered controls rather than a single filter: multi-factor authentication (MFA) to make stolen credentials less of a threat, verified communication processes for critical requests, and employee training to recognize social engineering before credentials are surrendered.

Secure credential management is also a key aspect of your defenses. A business password manager like Proton Pass for Business makes it easy to generate a strong, unique password for every account. You can also monitor for exposure within your business network, so even if a team member is convinced by a single message, their credentials can’t unlock more than one account.

For employees, phishing awareness needs to evolve in order to detect these new AI-powered threats. It requires asking yourself three questions:

Does this email look fake?
Does this request make sense?
Have I verified it or can I verify it through a trusted channel?

Going beyond the spelling and formatting of the email and looking at the wider context in which it was sent can go a long way. A polished email can still be a phishing attempt if it asks for credentials, changes payment details, creates unusual urgency, or pushes someone outside the normal process.

New forms of AI social engineering

AI phishing isn’t limited to email. Attackers can now use AI to combine text, voice, images, and video into a single convincing story.

AI-generated spear phishing

Spear phishing works because the message is targeted to the person receiving it. AI makes targeting even easier: An attacker no longer needs to spend as much time writing from scratch or adapting the tone for each target. They can use public information, leaked data, or a compromised inbox to create a message that appears legitimate.

That could be a contract update that arrives at the right moment, a candidate file sent to HR, a vendor request that uses familiar language, or a payment instruction that matches the rhythm of normal finance work. The danger is not perfection, but plausibility. A spear phishing message only needs to feel relevant enough for someone to open the file, approve the request, or enter their credentials before they stop to verify.

Voice cloning and vishing

Vishing, or voice phishing, is becoming more convincing as AI-generated audio improves. The FBI’s Internet Crime Complaint Center warned in 2025 about malicious actors using text messages and AI-generated voice messages to impersonate senior US officials. The alert explains that vishing may incorporate AI-generated voices and recommends verifying callers through independently identified contact details.

Proton’s Data Breach Observatory 2026 also highlights the rise of vishing campaigns, including coordinated attacks that led to large-scale breaches and exposed tens of millions of records. The same report found that passwords appeared in 47% of tracked incidents, showing why social engineering and credential protection are closely connected.

Deepfake phishing in video calls

Deepfake phishing can also happen through video. In 2024, a finance worker in Hong Kong was reportedly tricked into transferring about $25 million after fraudsters used deepfake video to impersonate senior colleagues during a video meeting.

Seeing a familiar face on a call is no longer enough to approve a sensitive request. Large payments, credential sharing, access changes, and unusual requests still need a separate verification step through a trusted channel.

AI-generated fake invoices

Invoice fraud is much easier with AI. A fake invoice can use polished language, realistic payment terms, a familiar supplier name, and a plausible explanation for a bank detail change. If the attacker has access to a breached inbox or leaked vendor information, the request may look even more believable.

A polished invoice should not be enough to move money. If the bank details have been changed, the timing feels unusual, or the message asks someone to skip the normal approval flow, the request needs to be checked through a trusted channel before anyone pays it.

Why SMBs are increasingly exposed

AI has changed the economics of phishing by lowering the cost of targeting. In the past, highly personalized attacks were more likely to focus on large companies because they took more time to prepare. AI makes it easier to create targeted messages for smaller businesses. Attackers can generate more variants, test more angles, and adapt messages quickly without spending the same amount of time or effort.

Smaller businesses are attractive because money, access, and decision-making are often concentrated between fewer people. One person may approve invoices, manage vendor relationships, and hold access to several business tools. When processes are informal, one convincing AI-generated request can reach payment workflows, shared accounts, customer data, or admin systems before anyone has a chance to challenge it.

The risk is visible in breach data too. The same Proton Data Breach Observatory report found that SMBs accounted for 63% of breaches tracked since January 2025 and were disproportionately affected by critical incidents involving sensitive data such as authentication data, personal identifiers, or financial details.

AI helps attackers exploit weaknesses small businesses already have: reused passwords, informal credential sharing, weak approval processes, and training that still assumes scams will look obvious.

How to adapt your phishing training to AI-enabled attacks

To properly combat AI phishing attacks, your security awareness requires more consideration than checking for typos. Employees need to learn how to verify the request, not just judge the message.

The baseline your training needs is simple: If a request is unusual, sensitive, or urgent, verify it before acting:

Stop before replying, don’t respond on the same email thread.
Ignore the contact details in the message, never use the phone number, link, or reply address it provides.
Don’t treat a voice or video call as proof, because a familiar voice on a call or a familiar face on screen can both be generated.
Reach the person through a channel you already trust, an internal directory, a saved vendor record, or a previously verified contact method.
Confirm the request itself, not just the sender, ask whether the payment, access change, or file request is real.

Training should also focus on helping team members spot the moments where AI phishing is most likely to succeed:

Payment detail changes
Requests for passwords, recovery codes, or MFA approvals
Urgent file-sharing requests
Unusual login prompts
Vendor portal changes
Executive requests that bypass normal processes
Invitations to move a conversation to a personal messaging app

Proton’s guide to building a small business cybersecurity culture in the workplace is a useful and timely resource for making security behavior part of daily work.

What businesses need to do differently

AI-powered phishing changes the standard for verification. If the message looks real, the process has to catch what’s no longer immediately obvious.

Use out-of-band verification

When a request involves money, credentials, sensitive files, or privileged access, the reply should not stay inside the same thread that created the risk. The team needs a second path to confirm whether the request is real.

That might mean calling a supplier using a number already saved in the vendor record, checking an executive request through an internal channel, or confirming access changes with the project owner. The key is to use contact details the business already trusts, not the phone number, link, or reply path provided in the suspicious message.

Require multi-person approval

High-risk actions should not depend on one person’s judgment. Payment changes, large transfers, new vendor bank details, privileged access grants, and bulk data exports should require a second approval to reduce vulnerability.

One urgent-looking message doesn’t need to derail normal work. A second approval gives the team a pause point before money is transferred, access is granted, or sensitive data leaves the business.

Protect credentials before they are targeted

AI phishing often ends at the same place as traditional phishing: credentials. The attacker wants a password, a session token, an MFA approval, or access to an account that opens the door to other systems.

IBM’s Cost of a Data Breach Report 2025 recommends strengthening identity security and adopting phishing-resistant authentication methods to reduce the risk of credential abuse. It also reports a global average breach cost of $4.4 million, showing why identity and access controls have financial consequences, not just technical ones.

Containment is key for SMBs. AI may make the first message harder to detect, but the business can still control what happens after a mistake. Strong, unique passwords, MFA, secure sharing, limited admin access, and consistent offboarding reduce the chance that one compromised account turns into access across email, finance tools, enterprise cloud storage, or other business systems.

How Proton Pass for Business helps reduce credential risk

Your organization’s password policy should bring credential habits under control before an employee is targeted. Limit password reuse across business accounts, use encrypted password vaults, keep sensitive access out of browsers, spreadsheets, and chat threads, and provide secure sharing options. Those measures give teams a controlled way to grant or remove access without searching through old messages or documents.

A business password manager like Proton Pass for Business limits how much damage a phishing attack can do. When credentials are unique, encrypted, and centrally managed, a single successful message compromises one account instead of opening a path across email, finance tools, and cloud storage. It works alongside awareness training, email filtering, and payment controls rather than replacing them.

Proton Pass for Business also helps teams generate strong passwords, use autofill, and manage credentials through centralized admin controls. Unique passwords, strong authentication, secure credential sharing, and controlled access make it harder for one successful phishing attempt to spread across the business.

Protect your team from AI-powered phishing with a business password manager.

Data exfiltration: how attackers steal business data and how to stop them

Kate Menzies — Thu, 27 Aug 2026 16:36:47 GMT

Most breach prevention advice, including our own guide to preventing data breaches, is focused on keeping attackers out of your business network. Using stronger credentials, phishing resistance, patched systems, vetted suppliers are all key components of this practice. They’re all essential practices, but they can’t be your only data breach protection tactics: they won’t support you if an attacker manages to breach your network.

Gaining access and data theft are different. An attacker who compromises one inbox, one laptop, or one supplier connection has not yet stolen anything. They’ve gained a foothold, and what happens between that foothold and the moment data leaves the building is a phase most SMB security guidance skips entirely, because it isn’t just about securing your network; it’s also about noticing that data is being moved outside of it.

This phase is called exfiltration, and it typically lasts for days or even stretches across months undetected. It’s possible because of tools and channels that look completely ordinary to anyone not specifically watching for them. Breach notifications frequently arrive late not because organizations were careless about the initial compromise, but because the attacker wasn’t detected inside the business network.

The exfiltration phase: what happens between access and theft

What data exfiltration looks like

Why is exfiltration difficult to spot?

What businesses should monitor for

How early detection can change your legal position

What happens to exfiltrated business data?

Contain what an attacker can reach

The exfiltration phase: what happens between access and theft

Once an attacker gains initial access, whether through a phishing email, a stolen credential, or a compromised supplier connection, they rarely move straight to stealing data. Acting immediately risks triggering an alert before they’ve found anything worth taking, so the more common pattern is patience.

The attacker spends time mapping the environment, including:

Where financial records are stored
Assessing which SaaS tools contain customer data
Locating accounts with the broadest access
Detecting whether activity monitoring, if any, is in place.

This reconnaissance stage can be slow. Some attackers move within hours, particularly in opportunistic ransomware cases where speed matters more than stealth. Others, especially in cases built around long-term data theft or espionage, stay embedded for weeks or months, learning normal patterns of activity well enough to blend into them.

Either way, by the time the attacker starts moving data out, they usually already know exactly what they want and which account or system will let them take it without tripping an alarm.

What data exfiltration looks like

Malicious exfiltration is difficult to spot because it looks like everyday activity. IT admins aren’t looking for slightly larger file transfers than usual or folders synced somewhere they shouldn’t be.

Large or unusual data transfers

This is the most direct form of exfiltration. For example, an account may suddenly pull gigabytes from a file server or database it normally touches only occasionally, or bulk export from a CRM or HR platform.

In SaaS-heavy environments, exfiltration often happens through the platform’s own export features: bulk CSV downloads, PDF exports of customer records, or a sequence of screenshots taken of a dashboard that doesn’t have an export button at all.

A typical case might look like this: a compromised HR account is used, over several weeks, to run small, staggered exports of employee records rather than one obvious bulk download. Each individual export looks unremarkable on its own, well within what an HR platform expects someone in that role to do.

It’s only the pattern across weeks, the same account exporting similar data at odd intervals, that would reveal what’s happening, and that pattern only becomes visible to a business that’s looking for it.

Inbox compromise

An attacker who compromises a business email mailbox can set up a rule that silently copies every message, or every message matching certain keywords, to an external address, giving them an ongoing feed of sensitive correspondence long after the original phishing email is forgotten.

Cloud storage compromise

Personal cloud storage is another common route. An employee’s compromised laptop, or a compromised account with access to company files, can be used to copy documents into a personal Dropbox, Google Drive, or similar service, a transfer that often looks identical to a legitimate file backup unless someone is checking where the data ended up.

Why is exfiltration difficult to spot?

The uncomfortable truth about exfiltration is that it usually doesn’t require any malware at all. An attacker using a compromised account to export a report, forward some emails, or upload files to a cloud drive is using the same tools and permissions a legitimate employee uses every day.

There’s no suspicious executable for antivirus software to flag, or any unusual processes for endpoint detection to catch, because nothing about the activity is technically abnormal. It only looks wrong in context, and context is exactly what most SMB security tooling isn’t built to evaluate.

This is why perimeter-focused defenses, however well implemented, aren’t enough on their own. A business can do everything right at the point of entry, enforce strong credentials, train employees against phishing, patch every system, and still have no way of knowing that a compromised account is steadily moving files to an external destination, because that activity was never designed to look suspicious in the first place.

Security researchers sometimes call this “living off the land”: using the target’s own legitimate software, cloud integrations, and administrative tools rather than using any tools that an antivirus product would recognize as illegitimate.

A file sync client, a built-in export feature, or a standard email rule aren’t malicious tools in themselves. This is why an attacker who relies on them can operate for so long without setting off anything designed to catch malware.

What businesses should monitor for

Catching exfiltration early comes down to watching for a small number of specific signals, rather than scanning broadly for suspicious activity.

Traffic and exports

Unusual data transfer volumes or destinations deserve the closest attention. Your organization should be watching for a spike in outbound traffic, a bulk export from a system that doesn’t normally see them, or any transfer heading to a destination you don’t recognize.

The NCSC’s guidance on data security specifically recommends logging access to sensitive data and monitoring for unusual queries or attempted bulk exports, precisely because that pattern is a sign that something has moved beyond normal use.

Email forwarding rules

Email forwarding rules are worth auditing directly, especially for any account that has been involved in a suspected phishing incident. A rule quietly forwarding messages to an unfamiliar address can sit unnoticed for months, and it’s one of the simplest things to check once you know to look.

Unusual logins

Login activity from unexpected locations or times is a signal worth taking seriously. A login at 3 AM from a country the business has no presence in isn’t proof of anything on its own, but when cross-referenced with a data transfer around the same time, it’s a detail that can confirm an incident.

Admin account activity outside business hours deserves particular scrutiny, since admin accounts typically have the broadest reach into a system and are a preferred target precisely because of that reach.

Activity on these accounts late at night, on weekends, or during a period when the actual administrator is known to be out of office is one of the more reliable indicators that an account, not just a device, has been compromised.

How early detection can change your legal position

Under both EU GDPR and UK GDPR, Article 33 gives organizations 72 hours to notify the relevant supervisory authority once they become aware that a breach affecting personal data has occurred; the ICO in the UK or the national data protection authority in each EU member state.

The requirement is materially the same for all jurisdictions: the clock starts for your organization at the moment of awareness, not from the moment the breach actually happened. This is why thorough exfiltration monitoring matters so much for compliance, not just security.

A business that detects exfiltration early, through forwarding-rule audits, transfer monitoring, or unusual login alerts, can notify proactively, on its own timeline, with a reasonably clear picture of what was taken.

A business that only discovers a breach weeks or months later, often because a customer complained or stolen data surfaced on a criminal forum, is notifying reactively, under pressure, often with an incomplete picture of scope and a regulator asking why it took so long to notice.

The difference goes beyond how your reputation is affected. It shapes how the entire incident is assessed, and how much latitude a regulator is inclined to extend.

What happens to exfiltrated business data?

Proton’s Data Breach Observatory tracks what surfaces on the dark web once a breach has occurred, and the pattern is a useful reality check on what exfiltration is really after.

According to the 2026 Data Breach Observatory update, names and email addresses appear in nearly nine out of ten tracked breaches, contact details such as phone numbers and physical addresses show up in roughly three-quarters of them, and passwords are exposed in close to half.

More sensitive categories, government-issued IDs, health records, and other personally identifiable information, appear in just over a third of breaches, while direct financial information shows up in a smaller share, around one in twenty.

SMBs make up the majority of breaches the Observatory tracks, and they are disproportionately represented among the incidents involving the most sensitive data categories.

This combination, frequent targeting and a high rate of sensitive-data exposure, is consistent with the type of exfiltration this article describes: attacks that occur over a long period of time within a smaller organization’s systems tend to pay more dividends, because nobody knew that data was being leaked and attackers could take everything.

Contain what an attacker can reach

Exfiltration monitoring catches data on its way out, but the size of the problem is decided earlier, by what a compromised account can reach in the first place. An attacker who gains access to an account with broad, unrestricted permissions can pull from far more systems than one who compromises an account scoped tightly to what that specific role needs.

Unique credentials on every account, combined with access limited to what a role genuinely requires, directly shrinks the exfiltration surface. If a compromised marketing account can only reach marketing systems, the worst-case scenario is bounded by design, rather than depending on an attacker’s restraint or a monitoring system catching them in time.

This is the same containment logic that limits blast radius in a credential-based breach generally: the account that gets compromised should only ever be able to leak what it was legitimately allowed to touch.

A business password manager like Proton Pass for Business makes this scoping realistic to maintain, since it removes the temptation to reuse a convenient set of broad credentials across tools simply because managing unique ones by hand doesn’t scale.

When every account has its own credential and access is reviewed against what a role actually needs, a single compromised account stops being a route to the entire organization’s data and becomes, at worst, a contained incident.

Proton Pass for Business can support your business with:

Customizable team policies that help you enforce your password policy with password requirements, mandatory two-factor authentication (2FA) and revoked data sharing rules
Usage logs that allow you to see activity within your network, with additional support from our advanced high security program Proton Sentinel
Groups organized by role, project or access level, simplifying access management and ensuring that every team member only has access to what they need.

Stop credential-based data exfiltration with a business password manager.

Does Chrome track you? Of course, but these steps can help

Proton Team — Wed, 26 Aug 2026 20:06:58 GMT

Chrome is the most used browser on the planet, which gives Google access to a considerable amount of information about how people use the internet. Some of that collection happens even when you’re not signed in.

Google says some of Chrome’s data collection helps improve features, security, and search suggestions. But it can also send information back to Google that contributes to a broader picture of your browsing habits.

If you’re not OK with that, your best course is to ditch Chrome once and for all. Here are the best browsers for privacy, and if you’d like to steer clear of American tech entirely, these are the best private European web browsers.

Unfortunately, there’s no way to eliminate Google’s data collection if you’re determined to keep using Chrome. But you can limit the damage.

Why Chrome tracks your activity

A web browser is a little like your front door to the internet. Everything you do online passes through it. If that door also has cameras and sensors recording who comes and goes, it becomes much easier to understand your habits.

Chrome can collect information even when you aren’t signed in. It can also use identifiers associated with your browser and device, while other settings allow it to share information with Google to improve features and services.

Some of these settings are easy to overlook because they are presented as ways to make Chrome better. Enhanced Safe Browsing, for example, can send information about websites you visit to Google as part of its security features.

That doesn’t mean every privacy-related feature is inherently bad. It does mean you should know what you’re agreeing to before leaving everything enabled.

Chrome sends what you type to Google

One of the more direct forms of data sharing happens while you type into Chrome’s address bar. With search suggestions enabled, Chrome can send what you type to Google before you actually submit a search.

That can be useful if you want faster suggestions, but it also means Google may receive queries you never intended to search.

You can limit this by going to:

Settings > You and Google > Sync and Google services

Next turn off Improve search suggestions.

This prevents Chrome from sending your typing to Google simply to generate predictions and suggestions.

It’s a small setting, but it addresses a particularly revealing type of data: things you started typing but never actually searched for.

Chrome builds a profile of your browsing habits

Chrome can also send information about how you use the browser back to Google. Combined with other data, this can help build a picture of your interests, the devices you use, and even your physical location.

To reduce this collection:

Open You and Google > Sync and Google services > toggle off Help improve Chrome’s features and performance and Make searches and browsing better.

You can also disable Background Sync under Privacy and Security, then Site settings and Additional permissions.

This prevents websites from continuing to exchange data after you have closed a tab.

While you’re reviewing those settings, check your site permissions too. Remove access to your location, camera, or microphone from websites that don’t genuinely need it.

How to reduce Chrome’s ad tracking

Chrome also includes advertising features that use browsing activity to group you into advertising interests. These settings are separate from the basic functions you need to browse the web.

Third-party cookies are one such source of persistent tracking. These cookies can be placed by companies that aren’t related to the website you’re visiting, such as advertising networks and social media companies. Because the same companies can appear across many different websites, their cookies can help connect activity from one site to another.

You can block third-party cookies by: Privacy and Security > Third-Party Cookies.

Chrome also offers a Do Not Track request, although websites don’t always honor it.

For an additional layer of privacy, you can set Chrome to clear cookies whenever you close the browser. The trade-off is that you’ll have to sign in to some websites more often.

Chrome gives you several ways to reduce how much information it collects, and changing a few settings can make a meaningful difference. But if you want to stop Google from collecting data through the browser entirely, Chrome may not be the right tool for you.

A different browser can give you more control over how your browsing data is handled. For Chrome users who want to stay put, though, reviewing these settings is a practical place to start.

The Proton Blog

A Gmail scam is exploiting Google Account recovery emails

How this Google account recovery scam works

The setup

The first real email

The call

The second real email

The vanishing act

The tells, annotated

Why this Gmail scam is so convincing

How to protect yourself from account takeover attempts

A safer inbox starts with better email security

Amazon is tracking you. Here’s how to stop it and what to use instead.

How Amazon tracks your shopping habits

How to protect yourself

How Ring cameras collect and share your data

How to protect yourself

How Fire TV and Kindle track what you watch and read

How to protect yourself

How Alexa collects and uses your voice data

How to protect yourself

Amazon-owned companies you may not realize are collecting your data

How to reduce your data flowing into Amazon

What is Amazon Web Services (AWS), and why does it matter?

How to reduce Amazon’s tracking without giving up convenience

Team password management: How to organize password vaults by department

Why shared password access doesn’t scale

Team-based access supports least privilege

What good vault structure looks like

Password vault structures for different team sizes

Building structure into onboarding

Making offboarding more secure

Better visibility for admins

Key access questions admins should be able to answer

Common mistakes in shared vault management

Keeping one company vault for too long

Depending on one admin’s knowledge

Treating vault access as permanent

Forgetting credential rotation

Mixing everyday logins with privileged access

How Proton Pass for Business supports team password management

Become a Proton Pass managed service provider (MSP) with our new program

What is the Proton Pass MSP pilot?

What to know about the pilot program

Why partner with Proton Pass as an MSP?

Security your clients can rely on

Effective password management for teams

Easy enough for anyone to use

An EU-based alternative for digital sovereignty

August 27 outage: Incident report

Timeline

The decisions

Root cause and next steps

How to choose remote work tools that don’t create security debt

11 of the best remote work tools for your team

1. Slack (Best for team chat)

2. Proton Mail (Best for business mail)

3. Loom (Best for async video)

4. Proton Meet (Best for video conferencing)

5. Jira (Best for project management)

6. Trello (Best for tracking tasks)

7. Miro (Best for visual collaboration)

8. Proton Drive (Best for cloud storage)

9. Proton Pass (Best for password/credential management)

10. Notion (Best for building a knowledge base)

11. Lumo

Why even the best remote work tools can put you in security debt without you knowing it

What a secure remote work stack actually looks like

Your remote work toolkit, built on Proton Workspace

Team collaboration software: 7 tools that won’t waste your money

7 team collaboration tools your stack needs

1. For team chat: Element

2. For business email and calendar: Proton Mail

3. For project and task management: Stackfield

4. For video conferencing: Proton Meet

5. For visual collaboration: Miro

6. For cloud storage and document collaboration: Proton Drive

7. For a knowledge base: Notion

The hidden cost of a disconnected collaboration stack

1. The hidden subscription bill