Proton Mail with Scribe and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Proton states Scribe does not use content data or any of the user's data to train its models.

Vendor's wording: “Proton Scribe does not use content data or any of your data to train its models.”

Source: proton.me2.11 Proton ScribeChecked on 19 October 2026

Switzerland, Germany or Norway: Proton Mail servers are wholly owned and operated by Proton and located only in those countries.

Vendor's wording: “Data is always stored in encrypted format on our servers, which are exclusively located in Switzerland, Germany or Norway”

Source: proton.meData securityChecked on 19 October 2026

No EU hosting.

No selectable setting. All servers are in Switzerland, Germany or Norway; Switzerland and Norway are outside the EU, and the pages do not let a customer pick Germany only.

Vendor's wording: “which are exclusively located in Switzerland, Germany or Norway”

Source: proton.meData securityChecked on 19 October 2026

DPA on request.

Yes. A Data Processing Agreement with Proton AG forms part of the contract under Proton's Terms and Conditions.

Vendor's wording: “This Data Processing Agreement ("Agreement") forms part of the Contract for Services under Proton AG’s Terms and Conditions”

Source: proton.mePreambleChecked on 19 October 2026

Published.

Yes, inside the privacy policy (section 4): 7 processors (2 Proton group companies, 5 third parties: Zendesk, Stripe, PayPal, Chargebee, Atlassian). No AI or model providers listed.

Vendor's wording: “To provide the Services, we rely on different data processors, which process different categories of data.”

Source: proton.me4. Data processorsChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (Swiss-based vendor, Proton AG, Plan-les-Ouates, Geneva)

Vendor's wording: “between Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, Company identification number CHE-354.686.492”

Source: proton.mePreamble (parties)Checked on 19 October 2026

Scribe: on Proton servers prompts are deleted immediately after use and no logs or content are stored. Mailbox backups are kept up to 30 days. On ending a service Proton deletes the company's personal data; request a copy before account deletion.

Vendor's wording: “Your prompts are encrypted in transit and deleted immediately after use.”

Source: proton.meDecide where to run ScribeChecked on 19 October 2026

2 named: ISO 27001 certification and SOC 2 Type II audit; the business page also links HIPAA and GDPR compliance information.

Vendor's wording: “Regular third-party audits, including our ISO 27001 certification and SOC 2 Type II audit”

Source: proton.meOpen source and auditsChecked on 19 October 2026

Yes. Admins can toggle the Writing assistant (Scribe) on or off for each user under Users and addresses.

Vendor's wording: “Click Edit next to a user. Toggle Writing assistant on or off.”

Source: proton.meManage user accessChecked on 19 October 2026