Proton CTO Bart Butler says encryption and user-paid revenue are the real privacy strategy

Proton’s CTO, Bart Butler, makes one point early and keeps hammering it: Proton sells trust, and the only way to earn it is to build it into both the technology and the incentives. He frames encryption and Proton’s business model as structural constraints, not branding. In his words, Proton’s products are architected so that protecting privacy is maintained “not a benevolent CEO or a benevolent board of directors,” but through the way the system is constructed.

That theme matters because privacy is increasingly a policy battleground. Butler connects Proton’s technical posture to real-world pressure: earlier this year, the Swiss government requested payment data that led the FBI to unmask a protester associated with the Stop Cop City movement in Atlanta, Georgia, and Proton complied with that request. He uses this as a springboard to discuss what it means for the US government to apply pressure on foreign governments using terms like “terrorism,” and how Proton decides when and how to take on those fights.

To understand how Proton thinks about “trust,” it helps to see Proton as an ecosystem, not a single app. The interview is set up around Proton’s suite of private and secure productivity products: Proton Mail (encrypted by default), a VPN, Proton Drive for file storage and photos plus collaborative real-time docs, a calendar, Proton Pass (a password manager), and Meet for video conferencing. Butler emphasizes that the products are familiar in function to what Big Tech offers, but the promise is that they’re “privacy-preserving” by design.

He then gets specific about the two primary “structural constraints” that shape Proton’s behavior. The first is technical: Proton encrypts all the data it can. If Proton wanted to sell data, Butler says it would be mathematically not possible. This encryption is also positioned as a security advantage, because it makes it harder for hackers or other interested parties to access sensitive information. There is a nuance: there is some data Proton can respond to for legal requests, and some it cannot, because Proton’s design limits what access it ever has.

The second constraint is business model alignment. Proton does not sell ads. Instead, Butler describes revenue as coming from users paying for the service, meaning users who pay “pay our salaries.” In his framing, that creates incentive alignment: if Proton betrayed users, it would undermine the value of the business itself. He highlights that “temptations are a thing” and argues that Proton has arranged incentives so they stay aligned with the people to whom Proton promised protection.

This is where the interview turns from philosophy into a harder question: do users actually understand what they are buying? Butler’s answer is blunt. He says that if you’ve told users about encryption, “you’ve already failed,” because most people do not understand what encryption means in practical terms. He points to the common perception that phones and devices are “listening,” and he implies that privacy products often struggle against that gap in user understanding, even when the underlying engineering is strong.

Then comes the part executives and boards cannot ignore: structural design choices can become existential under pressure from regulators. Proton is based in Switzerland, in part because of Swiss government geopolitical neutrality. Butler also notes that Proton transitioned two years ago to a nonprofit structure governed by a foundation. That model can be attractive because it signals public interest intent, but he frames it as having “failure modes” of its own. The interviewer directly references a failure mode seen with OpenAI, anchoring the idea that corporate structure alone does not guarantee trust.

Regulatory pressure is not theoretical in this story. Proton is on the record saying it will leave Switzerland, and Butler says Proton would also consider ditching operations in EU countries like Germany and Norway if surveillance laws being worked through European courts continue to threaten Proton’s privacy mission. He tells the interviewer these are not empty threats. Proton is “in the process of figuring out what it would mean to leave Europe” if things get, in his words, more “dystopian.”

There is an additional stress test in the interview, one that connects the privacy mission to some of the internet’s highest-stakes problems: child safety, age verification, and AI. The conversation is described as moving through broad frameworks before reaching those issues, and the subtext is clear. When regulation expands into sensitive categories, companies that sell privacy face a choice between compliance paths and mission preservation, and the tension shows up not just in policy statements, but in product architecture and operational footprint.

The strategic stake for peers in this space is that trust is not only a UX promise. It is a system property. Proton’s approach, as Butler describes it, is to make privacy durable through encryption, make the business model resistant to data-selling incentives, and make corporate and geographic decisions survivable under legal escalation. In a world where governments can request data and courts can reshape compliance expectations, Proton’s bet is that the best time to align engineering, money, and mission is before the pressure arrives.