The Proton Blog

Data classification for businesses: how to organize and protect company information

Ben Wolford — Tue, 28 Jul 2026 13:44:10 GMT

Data classification helps businesses stop treating every piece of information as if it carries the same risk. A supplier email, an internal process note, a customer payment record, and an admin recovery code should not move through the business under the same rules.

Sensitive data is stored throughout your business network: It moves through CRMs, inboxes, cloud storage, spreadsheets, HR systems, support platforms, finance software, and vendor tools. Without a shared system for classifying it, teams often rely on instinct: if something looks safe to share, or probably needs approval, they’ll take the quicker, easier route.

This may work for a while, but it doesn’t scale. A clear data classification policy gives your business a common language for deciding which information can be public, which should stay internal, which needs tighter controls, and which should only be available to specific roles.

What is data classification?

Why data classification matters

A simple data classification framework

Data classification examples for business teams

How classification drives access control

Sharing classified data safely

Start with a data audit

How to create a data classification policy

How Proton Pass for Business supports data classification

Make classification part of everyday data protection

What is data classification?

Data classification is the process of labeling business data by how sensitive it is and how much harm it could cause if it is exposed, changed, lost, or misused. In practice, it means grouping information into clear levels so people know how to store it, share it, protect it, and eventually delete it.

A useful classification system fits into daily work. It gives employees a quick way to understand when information can move freely, when it needs approval, and when access should be limited to a small group. The goal is to make the safer decision obvious before data is copied, shared, exported, or stored somewhere it should not be.

The UK National Cyber Security Centre’s guidance on asset management treats information as an asset that needs visibility, ownership, and protection. This is a useful way to frame classification: before deciding who can access sensitive data, you need to know what that data is and where it lives.

Why data classification matters

You can’t protect what your business hasn’t identified. This is especially true for SMBs, which usually do not have the resources to protect every system and every type of information with the same level of control. Before a business can decide who should access sensitive data, which systems need stronger protections, or where MFA and secure sharing are most urgent, it needs to know what information it holds and which data matters most.

Data classification is the first step in a practical data breach protection strategy. It separates routine business information from data that could create real harm if exposed, changed, lost, or shared with the wrong person.

This is especially useful as information spreads across CRMs, inboxes, cloud storage, HR systems, support tools, finance software, exports, and vendor platforms. Classification gives employees a clear signal: what can be handled normally, what needs approval, and what should only be available to specific roles.

It also supports compliance. The UK’s Information Commissioner’s Office (ICO), the authority responsible for data protection enforcement and UK GDPR guidance, expects organizations to apply appropriate technical and organizational measures. Classification helps make that practical by matching protection to the sensitivity of the data.

For breach prevention, the principle is simple: sensitive data should not be accessible to more people than necessary. Proton’s guide to data loss prevention for businesses explains how reducing unnecessary exposure before an incident can limit the damage afterward.

A simple data classification framework

A classification framework doesn’t need to be complicated. Four levels are usually enough for small and midsize businesses:

Public
Internal
Confidential
Restricted

Public

Public data is information approved for external use. A published version of this article you are reading, for example, would be Public data: it can be read, safe to share openly, and indexed without creating meaningful security or privacy risk.

Other examples include:

Website copy
Press releases
Public job descriptions
Approved sales materials
Product pages
Public company descriptions.

Public information still needs accuracy and brand review, but it doesn’t usually need strict access control once it has been approved.

Internal

Internal data is meant for employees and approved collaborators only, but not for public distribution. Exposure may not cause severe damage, but it can create confusion, reputational risk, or operational issues.

Examples include:

Internal process documents
Team notes
Standard operating procedures
Training materials
Non-sensitive project plans
Internal calendars
General vendor contact lists.

Internal data should stay in approved business systems. For example, a draft campaign brief, an onboarding checklist, or notes from a team planning meeting may not be highly sensitive, but they still belong in the company’s approved workspace, not in a personal folder, private inbox, or unmanaged download.

Confidential

Confidential data is sensitive business or personally identifiable information (PII) that could harm the company, customers, employees, or partners if exposed. Access should be restricted to approved roles with a clear business need.

Examples include:

Customer records
Employee files
Contracts
Commercial terms
Financial reports
Sales pipeline details
Support tickets containing personal data
Unpublished business plans
Non-public vendor agreements

Confidential data should only be accessible to approved roles. It shouldn’t live in personal drives, open shared folders, unmanaged spreadsheets, or inboxes where nobody reviews access. If it needs to be shared externally, the business should use end-to-end encrypted (E2EE) business cloud storage and limit sharing to authorized recipients with a clear business purpose.

Restricted

Restricted data is the most sensitive category. If it is exposed, misused, or changed, the business could face serious financial, legal, operational, or security consequences.

Examples include:

Admin credentials
Recovery codes
Authentication secrets
Customer payment details
Highly sensitive HR records
Legal dispute files
Security incident reports
Privileged access logs
Encryption keys
Backup access details

Restricted data needs the strongest controls: limited access, strong authentication and credential management, end-to-end encrypted cloud storage, secure sharing, and auditability.

Classification level	Sensitivity	Examples	Access level	Sharing rules
Public	Low	Published articles, website copy, press releases, public job posts, approved sales materials	Approved for external use	Can be shared publicly once reviewed and approved
Internal	Moderate	Team notes, draft campaign briefs, onboarding checklists, internal process documents	Employees and approved collaborators	Keep inside approved business systems
Confidential	High	Customer records, employee files, contracts, financial reports, support tickets with personal data	Approved roles only	Share only with authorized recipients and a clear business purpose
Restricted	Highest	Admin credentials, recovery codes, payment details, security incident reports, privileged access logs	Named users or tightly controlled groups	Do not share through email, chat, screenshots, or unmanaged documents

Data classification examples for business teams

Classification becomes easier when teams can recognize it in their own work. Finance teams may treat a public pricing page as public, while invoices, payroll files, tax documents, and payment records are usually confidential. Banking credentials and payment platform admin access should be restricted because they can expose information, change settings, or move money.

In practice, that access should be controlled through role-based permissions, strong authentication, regular access reviews, and a business password manager that helps teams manage and control the credentials behind sensitive systems.

HR data follows a similar pattern. A job posting can be public, while employment contracts, salary information, sickness records, benefits details, and candidate data are usually confidential. Sensitive investigations, HR admin credentials, and broad access to employee records should be restricted.

This is not a historical anomaly: the 2022 ICO fine against Interserve, totaling £4.4 million, is a stark warning that employee data should be classified and protected as sensitive business information, not treated like ordinary internal documentation.

Sales, customer success, marketing, and IT teams also need clear boundaries. Customer records and support tickets that contain personal or account-level information are often confidential. Internal segmentation work, campaign planning, and performance reports may be internal or confidential depending on whether they include customer-level data, commercial sensitivity, or non-public business strategy.

Vendor documentation should be classified based on what it contains, especially if it includes access details, commercial terms, or security information. Exported customer datasets, CRM admin access, admin access to advertising platforms such as Google Ads or Meta Business Manager, backup credentials, recovery codes, privileged access logs, and security tooling credentials should be restricted because one exposed file or account can affect far more than one person.

How classification drives access control

Once data is classified, access stops being a generic permission setting and becomes a business decision. The question is no longer only whether someone can open a system, but whether their role justifies access to the information inside it.

A support team may need customer conversations, but not every exported customer file. Finance may need payment and accounting records, but not HR investigations. A contractor may need access to one project workspace, not the company’s full archive of client files.

For confidential and restricted data, access must leave an audit trail. The business should know who accessed what, why access exists, and whether permissions are revoked immediately after a role change or offboarding.

A password manager for IT teams supports centralized management, secure sharing, policies, admin reporting and logs, SCIM provisioning, and SSO integrations. This helps teams scope access to the credentials that unlock sensitive systems, instead of leaving passwords in browsers, spreadsheets, or chat threads.

Sharing rules should follow the sensitivity of the information. A published asset can circulate freely once approved, but a contract, customer file, payment record, or recovery code needs more control. The more sensitive the data, the fewer people should receive it, and the more deliberate the sharing method should be.

This is especially important for email. Many businesses still send sensitive information through attachments, screenshots, or copied text, then lose track of where that information goes. Proton’s guide on how to securely send sensitive information via email explains safer ways to handle sensitive information when email is necessary.

Credentials and secrets need stricter rules than ordinary documents. Passwords, recovery codes, passkeys, and admin access details shouldn’t be sent through email, chat, screenshots, or shared documents. They should be stored and shared through a business password manager such as Proton Pass for Business⁠ where access can be controlled, reviewed, and revoked more safely.

Start with a data audit

Before writing a data classification policy, map where business data already lives. The first audit doesn’t need to be perfect. It just needs to show which systems hold sensitive information, who can access them, and where uncontrolled copies may exist.

Start with everyday locations such as CRMs, HR platforms, finance software, cloud storage, email inboxes, shared drives, support tools, password managers, vendor portals, downloads, exports, and backups.

Field	What to record
Location	Where the data lives
Data type	Customer, employee, financial, credential, or operational data
Classification level	Public, internal, confidential, or restricted
Owner	Person or team responsible
Access	Who can view, edit, export, or share it
MFA	Whether multi-factor authentication is enabled
Vendor sharing	Whether third parties can access it
Retention status	Keep, review, delete, or anonymize

How to create a data classification policy

A data classification policy should be short enough for employees to use and specific enough to guide real decisions. It should define the classification levels, explain who owns sensitive data, and connect each level to access, storage, sharing, retention, and review.

A simple policy can include:

Purpose and scope: What the policy covers and who it applies to.
Classification levels: Public, internal, confidential, and restricted, with examples.
Ownership: Who approves access and handles review for sensitive data categories.
Access rules: Who can access each level and how access is approved or removed.
Sharing rules: Which channels are approved for each classification level.
Storage and retention: Where each type of data should live and how long it should be kept.
Review cadence: How often the policy and access rules are reviewed.
Legal hold process: When deletion or retention rules must be paused during active investigations, disputes, or litigation.

The policy should also make room for judgment. Not every document will fit neatly into a category. When in doubt, employees should know who to ask and what default to follow. For sensitive data, the safer default is usually to restrict access until the right owner confirms otherwise.

How Proton Pass for Business supports data classification

Data classification tells your business which information needs stronger protection. Access control turns that decision into daily practice.

Credentials are part of that access layer. If a password gives access to restricted data, such as admin settings, customer exports, finance systems, recovery codes, or security logs, that credential needs stricter handling than a login for a low-risk internal service.

A secure business password manager like Proton Pass for Business helps teams apply those access decisions in practice. Credentials can be stored in encrypted vaults, organized by team or function, and shared only with the people who need them.

Admins also get better visibility into credential access through reporting and logs, while policies, SSO integrations, and SCIM provisioning help IT teams manage onboarding and offboarding more consistently.

This makes classification easier to enforce in daily work. Finance credentials can stay with finance. HR admin access can stay with authorized HR leads. Backup recovery codes and privileged admin logins can be limited to the people responsible for recovery and security.

Make classification part of everyday data protection

Data classification is not paperwork for its own sake. It is a way to make data breach protection easier to follow in daily work.

Once your business knows which data is most sensitive, the next step is controlling who can reach it. A password manager can help teams control and monitor the credentials that unlock sensitive systems and restricted data.

Control access to classified data across your organization with a business password manager.

IT disaster recovery plan: how to build one for your SMB

Kate Menzies — Tue, 28 Jul 2026 13:10:57 GMT

When a key system within your business goes down, the hardest parts are knowing what to restore first, who has the access to do it, which backup can be trusted, and how long your business can keep working without that system.

That is where many small and midsize businesses (SMBs) discover the gap between having backups and having an actual recovery plan. A backup may contain the data you need, but it doesn’t decide the recovery order, assign responsibilities, validate whether the restore works, or solve the problem of missing admin credentials during an outage.

An IT disaster recovery plan gives this process structure before a disruption happens. It defines which systems matter most, how quickly they need to be restored, how much data loss the business can tolerate, what data loss prevention strategies to implement, who owns each recovery step, and how critical credentials are protected. This clarity can prevent an IT incident from turning into prolonged downtime, lost revenue, or a wider operational crisis.

What is an IT disaster recovery plan?

Business continuity vs. IT disaster recovery

What your IT disaster recovery plan must cover

What your IT disaster recovery plan needs to define

Credential recovery: the overlooked disaster recovery scenario

Disaster recovery plan template

How to test your IT disaster recovery plan

Build recovery around systems, data, and access

What is an IT disaster recovery plan?

An IT disaster recovery plan is a documented process for restoring technology systems after a disruption. It focuses on the IT layer of the business: data, applications, devices, infrastructure, cloud services, admin access, backups, and the people responsible for recovery.

A practical IT recovery plan should answer questions like:

Which systems must come back first?
How much downtime can the business tolerate?
How much data loss is acceptable?
Where are backups stored?
Who can restore systems?
Which admin credentials are needed?
How will the team confirm that restored systems are safe and usable?
How will the business communicate with staff and customers if primary channels are down?

A disaster recovery plan should go beyond dealing with cyberattacks: it needs to cover everyday issues like hardware failure, lost credentials, and accidental deletion. It also needs to cover external service interruptions such as cloud platform or SaaS tool disruptions, misconfigurations, and key employees leaving without transferring critical access.

Recovery is not something to design during an outage. It needs to be planned, owned, communicated, and tested before your business needs to depend on it.

Business continuity vs. IT disaster recovery

Business continuity and IT disaster recovery often get treated as the same thing, but they solve different problems.

Business continuity is about keeping the company operating during a disruption. It covers client communication, temporary workflows, staff responsibilities, supplier coordination, and decisions about which services need to continue even if normal systems are unavailable.

IT disaster recovery focuses on the technology behind that work. It defines how systems, data, applications, backups, and admin access will be restored so the business can return to normal operations safely.

As an example, consider a CRM outage. A business continuity plan may explain how sales or support teams keep serving customers while the CRM is down. The IT recovery plan explains who contacts the vendor, which data needs to be restored, which backup or export is available, which credentials are required, and how the team confirms the system is safe to use again.

For many SMBs, the gap appears only during an incident. People know who would contact clients, but not who can restore the billing system. They know backups exist, but not whether a restore has ever been tested. They know one employee usually handles IT, but not what happens if that person is unavailable or where the admin passwords are stored if that person is out of contact.

What your IT disaster recovery plan must cover

A strong IT disaster recovery plan doesn’t have to be overly long, but it needs to be specific enough to run during a stressful situation.

Recovery time objective

Recovery time objective, or RTO, defines how quickly a system needs to be restored. A payment system may need to be back within hours, while an internal reporting dashboard may tolerate a longer outage.

Set RTOs by business impact, not by technical preference, because the cost of downtime is both a business and a technical problem. Ask which systems affect revenue, customer commitments, legal obligations, security, and employee productivity.

Recovery point objective

Recovery point objective, or RPO, defines how much data loss is acceptable, which then helps set the right data loss prevention (DLP) strategies. If a system has an RPO of one hour, backups or replication need to support recovery to roughly that point.

If the RPO is one day, the business is accepting a larger gap. RPO also helps determine backup frequency, because the shorter your RPO, the more frequent your backups need to be. Critical systems therefore need more frequent backups than low-priority systems.

System priority tiers

Not every system should be restored at the same time. A small business disaster recovery plan should divide systems into priority tiers.

Tier 1: Systems required for core operations, security, communication, or revenue.
Tier 2: Important systems that can tolerate short downtime.
Tier 3: Lower-priority systems that can be restored after the business is stable.

Typical tier 1 systems may include email, identity provider, password manager, finance systems, customer database, cloud storage, and communication platforms.

Backup strategy

Your backup strategy should define:

What is backed up and how often
Where backups are stored
Who can access them
How restoration is tested

The NCSC has also published ransomware-resistant backup principles for cloud and on-premises backup solutions, noting that backed-up data is not resistant to ransomware by default and should be assessed against the ransomware threat.

A strong backup strategy usually includes offline or immutable backups for critical data, regular testing, documented restore steps, and separate credentials for backup administration.

Roles and responsibilities

A disaster recovery plan should name owners, not just tasks. If one person holds all recovery knowledge, the business has a people risk as well as an IT risk. Define who:

Leads recovery
Restores systems
Contacts vendors
Approves emergency access
Communicates internally
Documents decisions

What your IT disaster recovery plan needs to define

Component	What it answers
RTO	How quickly does each system need to be restored?
RPO	How much data can the business afford to lose?
Priority tiers	Which systems come back first, and which can wait?
Backup strategy	What is backed up, where is it stored, and has restoration been tested?
Roles and responsibilities	Who leads recovery, restores systems, contacts vendors, and approves emergency changes?

Credential recovery: the overlooked disaster recovery scenario

Disaster recovery often focuses on data, servers, and backups. But in practice, recovery can fail because the team cannot access the systems needed to restore operations.

Credential recovery asks:

Who has access to admin accounts?
Where are backup credentials stored?
Which accounts can restore critical systems?
What happens if a password is lost, compromised, or held by someone unavailable?
Are emergency credentials protected and reviewed?
Can access be revoked and reassigned quickly?

If backup credentials are stored in one employee’s browser, recovery codes are kept in a private note, or shared admin passwords circulate through chat, the business may not be able to recover cleanly during an incident.

A business password manager helps reduce that risk by centralizing critical credentials in encrypted vaults, assigning access by role, and making it easier to revoke or reassign access when someone leaves or responsibilities change. Proton Pass for Business helps teams generate strong passwords, store credentials securely, use secure sharing, and keep sensitive access out of chats and spreadsheets.

As a password manager for IT teams, Proton Pass supports centralized credential management, password policies, secure sharing, reporting and logs, SCIM provisioning, and SSO integrations. That makes credential recovery more manageable because access to critical systems is not dependent on one person, one browser profile, or one undocumented password.

Disaster recovery plan template

A disaster recovery plan works best when it is specific enough to guide action during an outage, but simple enough for the team to use under pressure. For SMBs, the template should focus on the essentials: what needs to be restored, how quickly, from which backup, by whom, and with which credentials.

1. Scope

Define which systems, services, locations, devices, and data the plan covers.

Template copy: This IT disaster recovery plan covers the systems, data, services, credentials, and vendors required to restore [Company Name]’s critical operations after a technology disruption.

2. Critical systems inventory

List the systems your business relies on and assign priority tiers.

Template copy: Critical systems will be grouped into Tier 1, Tier 2, and Tier 3 based on business impact, recovery time objective, recovery point objective, and dependency on other systems.

3. Recovery objectives

Define RTO and RPO for each priority system.

Template copy: Each system must have a documented recovery time objective and recovery point objective. These targets should be reviewed at least annually and after major system changes.

4. Backup and restore process

Document where backups are stored, how often they run, who can access them, and how restore testing works.

Template copy: Backups must be protected from unauthorized access, stored separately from primary systems where appropriate, and tested on a regular schedule. Restore procedures must be documented for Tier 1 systems.

5. Credential and access recovery

Define where critical credentials are stored and who can access them during recovery.

Template copy: Admin credentials, backup credentials, recovery codes, and vendor access required for disaster recovery must be stored in an approved encrypted vault. Access must be limited to authorized roles and reviewed after role changes, offboarding, and recovery exercises.

6. Roles and escalation

Define recovery owners, alternates, and escalation paths.

Template copy: Each recovery role must have a primary owner and a backup owner. The plan must identify who leads recovery, who restores systems, who contacts vendors, who communicates updates, and who approves emergency changes.

7. Communication plan

Define how the business communicates internally and externally during an IT outage.

Template copy: During a recovery event, internal updates will be shared through [approved channel]. External communications to customers, vendors, insurers, or regulators must be approved by [role/team].

8. Testing and review cadence

Define how often the plan is tested and updated.

Template copy: This disaster recovery plan will be tested at least [annually/twice a year] and reviewed after major incidents, system changes, vendor changes, or failed recovery exercises.

How to test your IT disaster recovery plan

A disaster recovery plan only becomes useful when it has been tested under conditions that resemble real disruption. A backup that exists but has never been restored is still an assumption. A recovery role that only one person understands is still a dependency. An admin credential that no one can find during an outage is still a blocker.

Testing does not need to be complex at first. For most SMBs, the goal is to prove that the business can restore the right systems, with the right people, using the right credentials, within a realistic timeframe.

1. Tabletop exercise

Choose a likely scenario, such as ransomware affecting shared files, a cloud storage outage, accidental deletion of customer data, or the sudden loss of access to an admin account. Walk through what the team would do in the first hour, who would lead, which vendors would be contacted, which systems would be prioritized, and what information would be missing.

2. Test restoration

Select a critical file, database, mailbox, or system export and confirm that it can be restored to a usable state. Check whether the restored data is recent enough, whether permissions still work, and whether the team knows where the backup lives.

3. Test regularly

As a practical baseline, SMBs should test the plan at least once a year, in line with NIST guidance in Special Publication 800-34 Revision 1⁠, and more often after major system or vendor changes.

4. Test credential recovery

Confirm that authorized people can access backup admin accounts, cloud admin accounts, vendor portals, recovery codes, and emergency credentials without relying on one employee’s browser, private notes, or memory. The goal is not to expose sensitive passwords unnecessarily. It is to confirm that the access model still works when the business is under pressure.

After every test, document what failed, what took too long, and assign a specific person and deadline for each fix. A good test is not one where everything goes perfectly. It is one that reveals the gaps while the business still has time to fix them.

Build recovery around systems, data, and access

A useful IT disaster recovery plan gives the business a recovery order, a set of owners, a realistic view of acceptable downtime, and a way to maintain business continuity and regain access to the systems that keep work moving.

For SMBs, this might make the difference between a short disruption and a prolonged outage. If email, finance software, cloud storage, customer systems, or admin accounts are unavailable, the team needs to know what comes first, who can act, and which credentials are required to restore access safely.

This is why recovery planning should cover systems, data, and access together. Backups may restore files, but credentials are what let the team regain control of the systems needed to recover. Admin logins, vendor portals, backup accounts, recovery codes, and shared operational credentials all need to be protected, organized, and available to the right people when something goes wrong.

A business password manager helps strengthen that part of the plan. With critical credentials stored in encrypted password vaults and shared only with authorized people, the business is less dependent on one employee’s browser, private notes, or memory during a recovery event.

How to create a data retention policy that keeps your business compliant

Kate Menzies — Fri, 24 Jul 2026 16:20:48 GMT

Businesses collect an unbelievable amount of data during their operations, but rarely stop to review and even delete data.

A data retention policy defines how long your business keeps different types of information, why it keeps them, who can access them, and how they should be deleted when they are no longer needed. For small and midsize businesses, it’s one of the most practical ways to reduce compliance risk without overcomplicating day-to-day operations.

Many companies keep data for longer than necessary because deletion feels risky. Old customer records stay in a CRM. Former employee files remain in shared drives. Contracts sit in inboxes for years. Exported spreadsheets are saved “just in case.” Over time, the business ends up storing more personally identifiable information (PII), financial records, and internal information than it can properly govern.

That creates a problem under GDPR. The storage limitation principle means personal data should not be kept for longer than necessary for the purpose it was collected. A retention policy helps turn that principle into a working system: what you keep, for how long, where it lives, who owns it, how it is removed, and how access to retained data is protected.

That matters because weak passwords remain one of the most common vulnerabilities for businesses of all sizes, and retained data is still exposed if access controls are weak.

What is a data retention policy?

Why is a data retention policy important?

What kind of data needs a retention schedule?

UK data retention requirements: what SMBs should know

Data retention policy template for SMBs

Access control and retained data

Common data retention policy mistakes

Turn retention rules into everyday practice

What is a data retention policy?

A data retention policy is a set of rules that defines how long different categories of data should be kept within a business, and what happens when the retention period ends. It usually covers personal data, customer records, employee files, financial documents, contracts, communications, operational records, and business-critical documents.

A useful policy should answer these four questions:

What type of data do we hold?
Why do we need to keep it?
How long should we keep it?
How will we delete, anonymize, or archive it securely?

The GDPR does not set specific time limits for every type of data, so organizations need to decide what is necessary for their own purposes, document that reasoning, and be prepared to justify it.

A data retention policy is more than a list of dates. It’s a record of the decisions behind those dates. If someone asks why customer data was kept for three years or applicant records were deleted after six months, a business must be able to point to a clear reason.

Why is a data retention policy important?

A retention policy helps with compliance, security, and operational clarity. It protects a business in three ways:

It reduces the amount of data that could be exposed in a breach
It lowers legal and compliance risk from keeping information longer than necessary
It cuts storage costs tied to outdated records.

From a compliance perspective, it supports GDPR data retention obligations by showing that your business doesn’t keep personal data indefinitely without a reason. In the UK, the ICO is clear that personal data should not be retained on a “just in case” basis, but only for as long as it is necessary for the relevant purpose.

From a security perspective, less unnecessary data means less exposure. If your business suffers a breach, every outdated customer record, old payroll file, unused export, or forgotten inbox attachment may increase the amount of information affected.

That is why retention should be part of your broader approach to data breach prevention. How long you keep data directly affects exposure: the longer unnecessary records stay in your systems, the more there is for an attacker to access, steal, or expose.

From an operational perspective, retention rules reduce guesswork. Employees should know what to keep, where to store it, when to delete it, and who owns the decision. That is especially important for growing teams where data may be spread across email, cloud storage, HR systems, finance software, CRMs, shared drives, and vendor platforms.

What kind of data needs a retention schedule?

A data retention schedule is the working part of a data retention policy. It maps each data category to a retention period, owner, storage location, deletion method, data breach protection measures, and reason for keeping it.

SMBs should start with the data categories they use every day.

Employee records

Employee records don’t all follow the same retention logic. Some need to be kept because of statutory requirements, some because they may be needed to resolve disputes, and others only while there is a clear business reason.

For example, ACAS says employers must keep holiday records for at least six years from the date they were made, while GOV.UK guidance on staff records says employee information should only be kept for as long as the business has a clear need for it, then disposed of securely.

Customer and prospect data

Customer data may include contact details, purchase history, support tickets, billing information, contracts, account records, and communication history. Prospect data may include marketing leads, event signups, newsletter subscriptions, and sales notes.

Keep customer data for as long as you need it to provide the service, meet contractual obligations, handle disputes, comply with accounting rules, or meet legal requirements. Marketing data needs particular care because consent, legitimate interest, unsubscribe requests, and purpose limitations all affect how long it should be retained.

Financial and tax records

Financial records include invoices, receipts, payroll records, bank statements, expense claims, VAT records, accounting records, tax documentation, contracts and purchase orders, audit reports, credit card and loan records, and employee benefit or pension records where relevant.

In many jurisdictions, company and tax law sets a minimum period for keeping accounting and financial records, though the exact length varies by country and by company type.

Contracts and legal documents

Contracts, statements of work, vendor agreements, client agreements, leases, and legal correspondence may need to be retained for the contract term and for a period afterward in case of disputes.

The exact period depends on the contract, limitation periods, sector requirements, and legal advice. The policy should define an owner for these records, usually legal, finance, operations, or leadership.

Email communications and internal documents

Business email is often where retention policies are tested. Inboxes can hold contracts, personal data, attachments, customer complaints, invoices, candidate information, passwords, and confidential business decisions.

A retention schedule should define what belongs in email, what should be moved to an approved system, and when old messages should be deleted or archived. The same logic applies to internal documents, exported reports, spreadsheets, shared folders, and chat attachments. But the policy also needs an enforcement mechanism.

Retention rules should be tied to approved systems, automated deletion settings where feasible, archive rules, and ownership checks so data doesn’t remain indefinitely just because nobody acted when the retention period ended.

Credentials, access records, and security logs

Retention also applies to security records. This may include access logs, audit trails, password records, recovery codes, admin activity, incident reports, and authentication records.

Some security records need to be kept for investigation, compliance, or operational review. Others should only be retained for a defined purpose and a documented period, then deleted or archived according to the policy, especially when they reveal how your systems work or expose sensitive access details.

Data retention, credential management, and access control overlap: retained security records need strong access controls because they can reveal how your business systems work.

UK data retention requirements: what SMBs should know

UK data retention requirements vary. They depend on the type of data, the reason for keeping it, and the legal, tax, contractual, or business obligation behind it.

For GDPR data retention, the starting point is storage limitation: personal data should only be kept for as long as necessary for the purpose. UK GDPR doesn’t have one fixed period for every category, so businesses need to set their own retention periods and justify them.

Some records have clearer rules. Limited companies generally need to keep accounting records for six years from the end of the financial year they relate to, and sometimes longer in specific circumstances. Staff records vary by record type, so sensitive employment data should be categorized carefully and reviewed with legal or HR advice where needed.

Ultimately, it isn’t possible to apply one retention period to everything. Data should be separated by category, reason for keeping it defined, and document why each period is appropriate.

Data retention policy template for SMBs

Use this structure as a simple data retention policy template. Adapt the wording to your business, sector, and legal requirements.

1. Purpose and scope

Template copy: This data retention policy explains how [Company Name] stores, retains, archives, deletes, and protects business and personal data. It applies to employees, contractors, vendors, systems, and services that collect, process, store, or access company data.

2. Data categories

Template copy: [Company Name] groups data into categories, including customer data, prospect data, employee records, financial records, contracts, operational records, security logs, and internal communications. Each category must have an owner, storage location, retention period, and deletion method.

3. Retention schedule

Template copy: Data must only be kept for as long as required for business, legal, regulatory, contractual, or security purposes. Each data category must be listed in the retention schedule with a defined retention period and reason.

Example schedule:

Data category	Example records	Suggested retention approach	Owner	Deletion method
Customer data	Account records, support tickets, service history	Keep while customer relationship is active, then retain only as needed for legal, contractual, or dispute purposes	Operations or customer success	Delete or anonymize from CRM and support systems
Financial records	Invoices, receipts, payroll, tax documents	Generally keep for six years after the relevant financial year, unless longer retention is required	Finance	Archive securely, then delete
Employee records	Contracts, payroll, holiday records, HR files	Retain based on record type, statutory rules, and business need	HR or operations	Delete securely from HR systems and shared storage
Contracts	Client agreements, vendor contracts, statements of work	Keep for contract term plus a defined dispute period	Legal, finance, or leadership	Archive securely, then delete
Security logs	Access logs, admin activity, incident records	Keep for investigation, security, and accountability needs, then delete or archive based on risk	IT or security owner	Delete or archive securely
Marketing data	Leads, newsletter lists, campaign records	Keep while there is a valid purpose and suppression rules are respected	Marketing	Delete, anonymize, or suppress as appropriate

4. Access controls

Template copy: Access to retained data must be limited to people who need it for their role. Sensitive data must be stored in approved systems, protected by strong authentication, and reviewed regularly. Shared credentials must not be used to access retained data unless they are managed through an approved business password manager.

This section is where retention connects directly to credential management. Data that must be kept still needs protection. If old contracts, payroll files, customer records, or security logs remain accessible to people who no longer need them, the retention policy is only solving half the problem.

A business password manager supports access control by helping teams create strong credentials, store them securely, and share access only with authorized people. Proton Pass for Business helps teams manage credentials in encrypted vaults and use secure sharing, so retained data is less likely to be exposed through reused passwords or informal access.

5. Deletion and disposal

Template copy: When the retention period ends, data must be securely deleted, anonymized, or archived according to the retention schedule. Paper records must be shredded or disposed of securely. Digital records must be deleted from approved systems, shared drives, backups where appropriate, and any unmanaged storage locations. Deletion should be documented for sensitive data. Employees should also know where not to store information, such as personal drives, unapproved spreadsheets, or chat threads. If a data category becomes subject to a legal hold, dispute, audit, or investigation, deletion must be paused until legal or leadership authorizes the next step.

6. Responsibilities

Template copy: Each data category must have an owner responsible for retention decisions, access reviews, deletion, and policy updates. Employees are responsible for storing data in approved systems and reporting data they believe is outdated, duplicated, or stored in the wrong place.

7. Review cadence

Template copy: This policy and retention schedule will be reviewed at least annually, and sooner if [Company Name] introduces new systems, changes legal obligations, experiences a security incident, or changes how it collects or processes personal data.

Access control and retained data

A retention policy should never be separated from access control. Keeping data for a valid reason does not mean everyone should be able to reach it.

Retained data often includes sensitive information: employee files, customer records, tax documents, contracts, security logs, and incident reports. If access is unmanaged, older data can become an easy target during an account compromise. It can also create internal risk if employees can open records unrelated to their role.

Access controls should answer:

Who can access each retained data category?
Which systems store it?
Which credentials protect it?
Is MFA enabled?
Are shared credentials controlled?
When was access last reviewed?
What happens when someone leaves or changes roles?
Are third-party vendors and suppliers granted access, and is it controlled?

Data retention is connected to credential management. For breach prevention, access control also reduces blast radius. If an attacker compromises one account, they should not automatically reach years of archived customer data, old contracts, or employee records. Creating a password policy⁠ can help teams define rules for password creation, sharing, access management, and authentication.

For breach prevention, access control also reduces blast radius. If an attacker compromises one account, they should not automatically reach years of archived customer data, old contracts, or employee records. Proton’s guide to data breach protection for businesses⁠ explains why limiting access and reducing unnecessary exposure are important before an incident happens.

A business password manager such as Proton Pass for Business⁠ can also help teams control and review access to the credentials that unlock retained data, with centralized management, secure sharing, and clearer ownership through the admin panel.

Common data retention policy mistakes

Many SMBs already have informal retention habits, but not a reliable policy. The most common mistakes are easy to make: keeping too much data, applying one rule to every record, forgetting copies in everyday systems, deleting without checking legal holds, or keeping retained data accessible to too many people.

Mistake	Why it creates risk	What to do instead
Keeping everything forever	Storing data “just in case” can increase compliance risk and breach exposure.	Keep data only while there is a clear legal, contractual, security, or business reason.
Using one retention period for everything	Financial records, employee files, marketing leads, contracts, and logs serve different purposes.	Define retention periods by data category.
Forgetting email, spreadsheets, and exports	Copies may remain in inboxes, downloads folders, shared drives, or unmanaged files.	Include secondary storage locations in the policy.
Deleting without checking legal holds	Some data may need to be preserved for disputes, audits, investigations, or regulatory obligations.	Add a review step before deletion.
Ignoring access to retained data	Kept data can still be exposed if too many people can access it.	Assign owners, restrict permissions, and review access regularly.

Turn retention rules into everyday practice

A practical policy starts with the data your business already holds and turns it into a schedule people can follow. Each category should have a reason for being kept, an owner, a review cadence, and a clear deletion process. While that data remains in your systems, access should stay limited to the people who genuinely need it.

For many SMBs, credential management is one of the easiest places to make improvements. Strong passwords, secure sharing, and controlled access help make sure retained data is only available to the people who need it.

Control who can access retained data in your business with a secure business password manager.

Is Malwarebytes safe? All you need to know

Kate Menzies — Fri, 24 Jul 2026 15:36:21 GMT

Free security software should make you a little suspicious. After all, fake anti-malware apps are one of the most common malware disguises out there. So is Malwarebytes safe to use?

Rest assured: Malwarebytes is highly rated by trusted outlets like PC Mag and CNET, with a 4.2 rating on Trustpilot, and is safe to download and install, provided you follow official download links.

But just because Malwarebytes is legitimate doesn’t mean it’s all you need to keep malware at bay. In its free form, Malwarebytes is a scanner, not a shield. And a scan only protects you from what’s already on your device, not whatever comes next.

Keep reading to find out what Malwarebytes is, what the free version doesn’t help with, and the best practices you should follow to keep your device protected in ways Malwarebytes can’t.

What is Malwarebytes?

Malwarebytes is cybersecurity software designed to detect, block, and remove malicious threats from Windows, Mac, Android, and iOS devices.

Most people looking for a quick malware removal tool will only ever use the free version of Malwarebytes, which is far more limited than the paid tiers.

Plan	Entry-level price	Devices covered	Key Features
Free	$0	1	On-demand scan and removal, browser/web protection, ad and tracking blocker, data breach notifications
Standard	$44.99/yr	1	Same as Free, plus advanced, real-time antivirus protection, personalized security assessments, Browser Guard (in-browser scam and web protection, ad and tracking blocker, data breach notifications)
Plus	$79.98/yr	3	Same as Standard, plus Privacy VPN
Total	$89.99/yr	3	Same as Plus, plus Identity Protection ($1 million identity insurance, identity recovery specialists, advanced social media monitoring)

Is Malwarebytes safe? Why a scan isn’t the same as malware protection

As with any cybersecurity tool, there are limits to what Malwarebytes can and can’t do. Here’s a clear explanation of exactly what it can do for your device.

What a malware scan does (and what it doesn’t catch)

The free version of Malwarebytes is essentially a scan-on-demand tool with a handful of protective tools bundled in. It’s effective at checking the files already on your device, identifying malware and viruses, and removing them.

However, this is only retrospective protection: any malware that was on your device before the scan could already have done damage: ransomware could have encrypted your files to be held hostage, or spyware could have harvested your data and sold it to data brokers.

What antivirus protection does (but can’t account for)

Instead of waiting for you to run a scan, full antivirus protection continuously monitors and blocks threats in real time. It catches most malware as it tries to install or run — before it has the chance to do damage.

This is a stronger layer of defense, which is why Malwarebytes charges you for it. The good news is you don’t have to pay for real-time protection, since you probably already have a real-time layer running on your device.

Microsoft devices: Microsoft Defender and its firewall are built into Windows
Apple devices: XProtect is built into macOS
Android devices (with Google Play services): Google Play Protect is baked into every Android device and switched on by default

But whether free or paid for, real-time protection doesn’t guarantee against malware infection, because no antivirus tool catches everything. There are two reasons for this:

New threats are always emerging: Before services like Malwarebytes can detect them, they’re able to slip past the defenses of even the most sophisticated tools
Human error: If you download a malicious app from a sketchy site, or accidentally grant permission to an untrustworthy service or app, your antivirus won’t always save you

To be fully protected, you need to back up your antivirus protection and malware scans with smarter behavior. Use our guides to check if your phone has a virus and find out more about Android vs iOS security.

Five free habits that close the security gaps left by Malwarebytes

Here are five simple rules to follow that will provide an extra layer of protection no antivirus app can.

1. Keep your OS and apps up to date

Updates patch known vulnerabilities in operating systems and apps. Neglecting to update can present cybercriminals with a backdoor into your device that they already have the key to.

Turn on automatic updates for your OS and apps, right now. That way you don’t have to rely on remembering.

2. Do your due diligence before you install

On desktop, only download apps from the developer’s own official site, never a third-party download aggregator.

On mobile, only install apps from official stores. But be careful: there’s an abundance of disguised malware on both the Play Store and App Store. If you’re unsure, check the developer’s name in the app store to see what else they’ve published and find their personal website.

For a guide to protecting yourself against malicious apps on official stores, read our article on avoiding malware on Play Store. (Most of the advice applies to the Apple App Store, too.)

3. Use strong passwords (and don’t reuse them across accounts)

Most of us have a bad habit of using passwords that are easy to remember: short, predictable, and easy for cybercriminals to crack.

That habit’s even more damaging if you’re using that same, weak password across multiple accounts. One password is exposed, and every account that shares that password is compromised.

To avoid falling into these traps, you need a password manager to generate unique, strong credentials for every one of your accounts.

4. Use email aliases

Your inbox is a valuable target for cybercriminals, full of the personal information they need to build a clearer picture of you in order to scam you.

An email alias gives you a unique, disposable email address to use for each service, with all mail feeding into a single, “real” email address. As well as helping to get rid of spam email, aliases help hide your real inbox from cybercriminals when companies get breached.

5. Use a VPN

When you use unencrypted public networks, anyone else on that network can see what websites you’re visiting. They might not be able to see what you’re doing on a banking website, but they’ll be able to find out which bank you use.

Using a virtual private network (VPN) protects your privacy by encrypting your connection, so anyone else on the network who tries to look at your traffic sees only a scrambled, unexploitable mess.

Prevention starts with a secure VPN and password manager

When your device is already infected with malware, a Malwarebytes scan provides a handy cure. Ideally, though, you want to prevent malware getting on there in the first place.

Malwarebytes cleans up what’s already there. Proton VPN and Proton Pass make sure there’s less to clean up. Here’s how.

Proton VPN

Malwarebytes has its own VPN: Privacy VPN. It has some downsides:

It can only be used with a $79.98/yr subscription to Malwarebytes Plus
Malwarebytes operates under US jurisdiction, which makes it subject to the CLOUD Act, meaning your data can be disclosed under compulsion
It’s only passed one independent audit, in 2026, which flagged a critical vulnerability

The Independent Swiss VPN, Proton VPN, by contrast:

Is free to use
Is under Swiss jurisdiction, not subject to any mandatory data retention laws
Has passed five consecutive annual independent audits

Discover Proton VPN

Proton Pass

If malware or a data breach does compromise one of your accounts, our end-to-end encrypted password manager Proton Pass can contain the damage.

Proton Pass makes it easy to create, store, and use strong credentials. It lets you:

Generate strong passwords for every account
Autofill credentials across sites and apps, so you only need to remember one password
Use up to 10 email aliases (with the free version), and unlimited aliases with Pass Plus

Your vault is kept private by zero-knowledge encryption: not even Proton can access your credentials.

Ultimately, Malwarebytes is a helpful tool that can help you secure a compromised device. But staying safe online requires a more proactive strategy, which Proton’s easy-to-use tools can help anyone create.

Is Venmo safe? Here’s how to protect yourself

Kate Menzies — Fri, 24 Jul 2026 15:09:14 GMT

Need to send your friend some money for a group vacation, or your grandchild a cashless transfer for their birthday? If you’re in the US, you might be thinking of using the Venmo app.

It’s a popular option for a reason: Venmo makes sending money to family and friends easy and even fun with a social feed that lets you follow transactions between your friends. But is it safe?

Firstly, Venmo isn’t a scam app: it’s a legitimate business, with a 4.9/5 rating on the Apple App Store from over 15 million ratings and a 4.4 star rating on Google Play Store from over 900,000 reviews (with over 50 million downloads).

And it’s safe to use, too, provided you’re making payments to people you know. But you should be aware that paying strangers is riskier, and that scammers can impersonate both Venmo itself and your friends on the platform.

Here’s how to use it safely, and spot the scams that put your money at risk.

What is Venmo and how does it work?

Venmo is a US-only peer-to-peer payment app owned by PayPal. Using Venmo, you can instantly and directly send other Venmo users money.

You can also:

Send gift cards from brands including Amazon, Starbucks, and Doordash
Split group payments by creating groups with your peers, adding expenses, and settling up
Pay online and in-person
Move money from and to your bank account
Get your paycheck sent right to your Venmo account (up to 2 days early)

Venmo tries to make all this fun: you can attach messages (including emojis) to payments, and a social feed, which enables you to see what payments your peers are making (and vice versa).

Is Venmo safe to use with strangers?

The Venmo app is built for moving money between people who already know each other, not for strangers. In practice, though, many people use it to pay strangers selling items online.

Sellers on Facebook Marketplace will often ask buyers to pay via Venmo. It isn’t a built-in option like Meta Pay, so you’ll have to agree to it off-platform, usually in a Facebook Messenger thread.

This isn’t necessarily a red-flag request: plenty of legitimate sellers prefer Venmo for its lack of fees. But when a seller refuses to use a protected option (Meta Pay, PayPal Goods & Services) when one’s available, you could have cause for concern.

The problem is that Venmo personal payments carry no buyer protection by default and can’t be reversed once accepted. If you pay a stranger without buyer protection and receive the wrong item, a damaged item, or nothing at all, you won’t be able to get your money back.

How to protect personal payments on Venmo

Payments to approved business accounts are automatically protected. To confirm they’re approved, look for “Eligible items covered by Purchase Protection” under the pay button.

If you’re paying a personal Venmo account page, however, your payment won’t be covered by Venmo’s Purchase Protection Program unless you tag it as a purchase. (Note: this makes the coverage possible, not automatic: see Venmo’s Purchase Protection Eligibility guidelines.)

To tag your transaction: tap the toggle shown below the payment method to confirm it’s a purchase.

This incurs a 2.99% fee for the recipient, which won’t be refunded to them if they have to refund the sender. Some sellers may use this as an excuse to discourage you from adding this fee.

Be wary if they do: Purchase Protection protects sellers from being scammed by buyers too, provided the seller can produce proof of shipment and delivery.

How to spot scams on Venmo

Once you’ve signed up to Venmo, you might be targeted by scams, as Venmo itself acknowledges. Here are three scams Venmo flags, and how to protect yourself.

An email or text saying you’ve won money through Venmo

This message will include a phishing link, which you shouldn’t click.

Never enter Venmo login information outside of Venmo.com and the Venmo app, and never share account information on social media, except through Venmo’s official accounts: @Venmo and @VenmoSupport on X/Twitter, @Venmo on Instagram, and @Venmo on Facebook.

A call from Venmo (which isn’t from Venmo)

Under some pretext, the caller asks you to make a payment, or share a two-factor authentication code that’s been sent to your phone.

Never share your Venmo verification code. Venmo states that they will never ask for your verification code on a call, ask to access your device remotely, or to send money to another account.

A scammer impersonates a friend on Venmo

You get an unusual (often time-sensitive) payment or request for money from someone who looks like your friend.

Double-check that it’s actually them. A scammer can copy a username, profile picture, and social feed details to seem credible. Check their profile’s public transaction history, and, if still in doubt, reach out to your friend outside Venmo to verify.

How to use Venmo safely

Follow these guidelines to make sure Venmo is a safe place to buy, sell, and transfer money.

Tag any purchases made via personal Venmo accounts as purchases to ensure you’re covered by Purchase Protection
Set transaction visibility to private so that not even friends, including potential scammers posing as your friends, can see them on their feed. Following privacy issues reported by The Verge in May 2026, new users are set to see only friends’ activities by default, but this doesn’t guard against impersonators.
Verify identities through a second channel before paying, including anyone who’s unfamiliar, and anyone who is familiar but acting unusually

Beyond your behavior, you can close remaining gaps and minimize any potential damage by installing these tools on your devices:

A password manager to generate and store a strong, unique password for your account, so a breach on another site doesn’t hand attackers a working password to all of your online accounts
An email alias generator to create an individual email address to register with Venmo. It forwards Venmo mail to your main inbox, and protects your real address if Venmo gets breached
A VPN to encrypt your connection when you’re sending money over public WiFi, keeping your session private from prying eyes

Secure your passwords and privacy with Proton

Proton was founded to make the internet safer. Our products make it harder for scammers to steal your credentials and personal information.They also make it easier to use the internet safely and protect your online accounts.

With our free password manager Proton Pass you can:

Generate a strong, unique password for every account you use (including Venmo): if one of your passwords leaks, they won’t all leak
Set up an email alias for Venmo: if they ever get breached, the attackers won’t have the keys to your primary inbox
Ensure your login credentials aren’t autofilled on fake Venmo pages: Proton Pass autofills logins only on the websites it recognizes, so it won’t hand your password to a domain that isn’t venmo.com

Proton VPN won’t stop the scams listed by Venmo, but it keeps you safer online, encrypting your connection whenever you’re using Venmo or any other app, blocking ads and malware trackers.

Both Proton Pass and Proton VPN are protected by zero-access encryption that means not even Proton can access your passwords.

Venmo can be as safe as you make it. Pair smart habits with tools that protect your credentials and your connection, and you can send payments without paying an undue price.

EU fines Google $1 billion over its search and Play Store

Edward Komenda — Thu, 23 Jul 2026 17:20:29 GMT

European Union regulators fined Google €890 million on Thursday, saying the company broke the bloc’s digital competition law by steering users toward its own services in search results and restricting what app developers are allowed to tell their customers.

The penalty, worth about $1 billion, closes two investigations the European Commission opened in March 2024 and makes Google the third company sanctioned under the Digital Markets Act. Alphabet, Google’s parent company, takes in roughly that much revenue in a day.

What regulators found

The European Commission split the fine in two. It attributed €460 million to self-preferencing in search, finding that Google gave its own shopping, hotel, transport and sports results better placement than it gave competitors.

The remaining €430 million covers the Play Store, where regulators said Google barred developers from telling users about cheaper offers available elsewhere and charged steering fees beyond what the law permits.

Teresa Ribera, the Commission’s executive vice president for competition, said the best products should succeed on merit rather than on who owns the search engine. Google has 60 days to comply or face daily penalties of up to 5% of Alphabet’s worldwide turnover.

Kent Walker, Google’s president of global affairs, called the decision “product degradation driven by a small group of self-serving complainants.” The company said it is weighing an appeal. Politico reported that the Commission reached its decision internally in March and announced it a day before temporary US tariffs on trading partners are due to expire.

A day of revenue

Alphabet reported $403 billion in revenue in 2025, roughly $1.1 billion a day, meaning Thursday’s penalty is worth less than 24 hours of business.

Proton tracks what Big Tech pays in fines each year. In 2025, regulators worldwide levied about $7.8 billion against Alphabet, Apple, Meta and Amazon, the largest annual total we have recorded.

Measured against free cash flow, those four companies could have cleared the entire year of penalties in 28 days. Alphabet drew about $4.24 billion of it, more than any of them, and could have covered its share in about three weeks.

The pattern holds going back further. EU regulators have fined Google more than €10 billion since 2017, and Europe’s highest court upheld the largest of those, a €4.1 billion Android penalty, on July 2.

None of it changed how the company operates, however, because none of it cost more than operating that way earns.

What the fine does not reach

Self-preferencing is a competition finding, but what it protects is an advertising business. Results that keep users on Google surfaces keep them measurable. Privacy-first services rarely lose on quality. They lose on placement.

For the first time in a long while, governments are taking their duty to citizens seriously and fighting the monopolies that corrupted the internet’s early promise. But make no mistake: the fines are still too small to make Big Tech sit up. Unwinding Big Tech’s structural advantages, rather than the checks it writes, is what holds real promise for restoring freedom and fairness online. A fairer internet would let services that protect personal data instead of exploiting it succeed on merit.

Building that better internet will take years. Until then, the burden falls on you, and the choice carries much further than it may seem: Keeping your data out of Big Tech’s hands protects your information and cuts into the ad revenue that pays for the conduct regulators keep fining.

The simplest defense is end-to-end encryption. Proton is funded by the people who use it rather than by advertisers, so it has no reason to collect your data. Sign up free and take control of your email, calendar, photos and files, browsing, and passwords and online identity.

Why your business needs document version control

Alanna Alexander — Thu, 23 Jul 2026 14:18:17 GMT

An email from a client pops up on your laptop: “This contract is rife with errors.”

You pull up the file and realize — you sent them a version from 36 hours ago, before legal had reviewed it, before that key clause was approved. Nobody can tell you with certainty which version left your hands, or why.

That’s a version control failure. And in a moment of exposure — an audit, a near-miss, a client complaint, an internal dispute — it can mean more than a lost deal. It can mean a compliance violation you can’t defend, a dispute you can’t prove, or a client relationship that doesn’t recover.

Document version control helps you answer who changed what, when, and which version left your hands. If you’re responsible for how documents move through your organization — contracts, compliance records, internal policies — this is what you need to understand about it.

What is document version control?

Document version control is also known as revision control or file version control. It’s the system that tracks every change to an ongoing file or project. It doesn’t overwrite what was there before. It preserves every change as a new entry in the document’s history, so you can see every decision that different collaborators made and return to a previous version if you need to.

Version control can be done manually — saving and renaming files as “v1,” “v2,” “FINAL” — but that depends on everyone following the same convention consistently, which is how records get gaps.

The more reliable approach is using business cloud storage software that does it automatically, logging every change in the background without anyone having to remember. You won’t have to manually save and name files with version numbers, it does it automatically, giving you a complete record of changes without anyone having to maintain it.

You’ll find more tips on finding the right software further down this blog.

Find out more about the best practices of document management.

Why does version control matter for compliance?

In regulated industries like healthcare, law, or finance, process failures like document problems have a serious consequence: They leave gaps in your record that you may one day have to explain.

What changed?

When something goes wrong with a document — a clause that shouldn’t have been there, a figure that doesn’t match what was agreed, terms that contradict an earlier version — the first question anyone asks is: what changed, and when?

In a regulated environment, that question isn’t just internal. A financial regulator may want to know exactly what was amended in a client agreement and when. A court may want to see whether a clause was present in the original draft or added later. A compliance officer may need to demonstrate that a policy document wasn’t altered after it was approved.

Without a complete version history, none of those questions have a reliable answer.

Who had access?

Knowing what changed is only part of the record. Regulators and auditors will also want to know who had access to a document, and at what stage.

A contractor whose access wasn’t revoked after a project ended. A team member who opened a file outside their authorization. An external party who saw a draft before it was finalized. None of these events alter the document — but all of them are exposure events, and in a compliance context, exposure events need to be logged.

A SaaS company handling customer PII data will face this question directly every time an enterprise client asks: “who has seen our data, and can you prove it?” SOC 2 auditors will ask the same thing. If you can’t produce that access history, you don’t pass.

Which version is final?

In a contract dispute, a regulatory submission, or an internal investigation, there can only be one answer to this question.

If multiple versions of a document exist across shared drives, email threads, and downloaded copies, nobody can say with certainty which one is authoritative. Ambiguity is a liability.

A proper version control system designates a single, timestamped record as final — and keeps the full history of everything that came before it, so the answer to this question is never in doubt.

7 ways to maintain version control for your business

Always work in shared files — if anyone is working on a local copy, the compliance record has a gap
Be logged in when you edit — anonymous edits aren’t attributable, and attribution is what auditors require
Never edit outside the system — changes made in a downloaded copy or an email attachment are invisible to the version history. If it didn’t happen in the shared document, it didn’t happen on the record
Only share access with people who need it — every unnecessary collaborator is an unlogged exposure risk
Revoke access when it is no longer necessary — access that outlives its purpose is a liability, not just an oversight
Designate and protect the final version — once a document is approved, it should be clearly identifiable as final and protected from further edits. A version history full of post-approval changes is not a clean compliance record
Never delete a document to start over — deleting a file destroys its compliance record permanently

What to look for in a document tool

For business uses, here is what matters:

Automatic versioning: Version history should not need manual work. If team members need to keep track of versions, they will most likely get confused and create friction. They will need a real-time collaborative document that actually saves the edits automatically.
Long retention: A 30-day edit log will not be enough for audits or disputes. Business document version control should keep the records for months — or even years — and make sure you keep all compliance checks in place.
Safe restore options: Restoring a previous version should not overwrite or delete what came after it. Look for tools that let you make a copy of a past version or roll back fully while keeping the complete history intact. This is crucial to safeguarding client data and keeping teams aligned.
Attribution and controls: Timestamps are not enough. You need to tie each change to a person. That is what makes file revision control useful for accountability. Also, permissions or link-expiration features should not be managed through separate tools. Version control and secure file sharing for teams should be part of the same workflow.
End-to-end encryption: Version history can contain sensitive information. If the service provider can access all draft versions, then your information is also accessible to them. Look for tools that provide full end-to-end encryption for increased security.

Protect your documents from the get-go

At Proton, we built Proton Docs and Proton Sheets, online software for collaborative documents and secure spreadsheets, to give remote teams full control over their documents, with automatic versioning and end-to-end encryption across every file and every revision. So your document history stays secure by default.

Version control is only as reliable as the tools behind it. Proton Drive automatically saves your version history, with no need for manual checkpoints. It retains document history for up to 10 years — long enough to meet most data retention requirements — and allows you to safely roll back to any version you need.

Start with a free Proton account or explore our business cloud storage, Drive for Business.

What to look for in a secure cloud workspace (before you commit)

Alanna Alexander — Thu, 23 Jul 2026 13:23:37 GMT

Choosing a cloud workspace is probably the most consequential infrastructure decision you can make.

Many teams default to Google Workspace or Microsoft 365 because they seem like the obvious choice: familiar, feature-rich, deeply integrated cloud collaboration platforms that are easy to adopt and already embedded in many modern workflows.

But that’s precisely why they’re worth scrutinizing before you commit. Here are four key things you need to consider when evaluating a cloud workspace, plus a checklist of questions to help guide you.

1. Integrations can free you up now — but lock you in later

Integrations are a major selling point for most cloud workspaces. Many companies (especially fast-moving start-ups) want a platform with lots of integrations that slots seamlessly into existing workflows with minimal disruption.

However, over the long term using integrations can mean embedding your workflows inside a single ecosystem. And once you’ve tied yourself into a cloud workspace ecosystem, switching providers becomes a data admin’s worst six months at the office — we’re talking siloed data, identity and access disruption, denied permissions, inaccessible files, and a dip in productivity your CEO will definitely notice.

This certainly applies to go-to platforms like Google Workspace and Microsoft 365, which are strategically designed to hook businesses on a wider ecosystem of co-dependent tools — Meet, Teams, Drive, and SharePoint — that become progressively harder to detach from.

The question you need to ask before picking a cloud workspace isn’t “how easy is this to adopt?” It’s “how hard will this be to get out of?”

2. ‘Security’ means different things to different providers

Most enterprise workspace providers market their platforms as boasting ‘enterprise-grade security’, with certifications, perimeter protections, and encryption of data in transit and at rest.

What many providers are less keen to advertise is that they retain server-side access to your data. This enables their most useful features: indexing, analytics, cloud-side processing and AI assistance provided by tools like Google’s Gemini and Microsoft Copilot, both of which rely on visibility into your business emails, documents, calendars, and collaboration data to function.

For many businesses shopping for a cloud workspace, that’s an entirely acceptable tradeoff: Strict cloud data security sacrificed for the sake of convenience and functionality. But if your business handles sensitive information, such as confidential client data, business continuity documents, or financial records, you might want to think twice about it.

If you’re an SMB, you might want to think more than twice. According to Proton’s SMB Cybersecurity Report 2026, nearly one in four SMBs fell victim to a data breach in 2025. Hackers view SMBs as vulnerable targets. The wrong cloud workspace could expose you even more.

The right cloud workspace will offer end-to-end encryption and zero-knowledge cloud storage. This means your provider can’t access your data, even if compelled.

3. Data sovereignty is important (but not all providers respect it)

Where data is collected, processed, and stored determines which laws and jurisdictions apply to it, and therefore its potential exposure.

Many cloud providers operate across jurisdictions, including countries where governments may compel access under local legal frameworks, either now or in the future. Your provider’s terms of service may not protect you from that.

To stop jurisdictional authorities from exposing your data, privacy-first providers like Proton promote data sovereignty: the concept that the laws that govern data should be the laws of where it was generated and collected — no matter where it’s stored.

For companies operating in regulated industries and handling sensitive customer information and/or managing intellectual property, data sovereignty should be a significant strategic consideration.

Overlooking data sovereignty can be costly. In 2023, Meta was fined €1.2 billion (the largest GDPR fine ever issued) not for a hack or a breach, but for storing European user data in the US. The data was secure. The jurisdiction wasn’t.

If you’re concerned about your data security and sovereignty, seek out providers that host data in privacy-first jurisdictions, such as Iceland or Switzerland.

4. Remember: your governance burden grows with your business

A common cybersecurity mistake made by scaling SMBs when choosing a cloud workspace is underestimating how quickly data governance and access control becomes complicated by growth.

A workspace that enables you to manage permissions for a workforce of 10 might not be suited to doing the same for a workforce of 60, particularly when that expanded workforce includes contractors, external collaborators, and people spanning multiple departments with different access requirements.

As you scale, your data governance will evolve from a simple setup task to a full-time job, involving a host of challenges, including permission sprawl, higher risk offboarding, unreliable manual tracking, and decreasing visibility into who has access to what.

Some cloud ecosystems compound this challenge by distributing permissions and workflows across multiple integrated systems, which makes centralized oversight difficult.

Others, however, provide a single admin layer where admins can monitor, manage, and adjust access as the organization grows and evolves.

Pick the right type now, and you’ll avoid the headaches of the future that come with retrofitting access controls into a workspace you’ve already scaled into.

9 questions to ask yourself before you commit to a cloud workspace

Before committing to a provider, ask:

Who controls the encryption keys?
Can your provider’s employees access your data?
What metadata remains visible to the provider?
Is your data processed by the platform’s AI systems?
Where is data stored and processed, and which jurisdictions apply?
Can admins enforce multi-factor authentication and permissions centrally?
How difficult would it be to migrate to a different workspace down the line?
Can data be exported cleanly and completely?
Will your governance tooling scale with your headcount?

A cloud workspace for the next five years, not the next 12 months

The right cloud workspace isn’t the easiest to adopt today. It’s the one you’ll still be using, and trusting, in five years. A platform that gives you long term security, control, and flexibility, and without locking you into an ecosystem forever.

Sounds like Proton Workspace to us. A secure cloud workspace, built on end-to-end encryption, zero-knowledge business cloud storage, and Swiss privacy law — with centralized admin controls designed to scale with your organization.

Start free trial of Proton Workspace

How to set up secure document collaboration for your team — without leaking your IP

Alanna Alexander — Thu, 23 Jul 2026 12:14:51 GMT

Right now, there’s a file in your shared drive named something like v3_final_FINAL_FINAL.docx. You don’t know who edited it last. You don’t know if it’s the version your CTO signed off on. You’re not entirely sure who has access to it.

This is ‘version chaos’: an all too common problem for teams scaling remotely. Feels bad, doesn’t it? Possibly not bad enough. Because it isn’t just a messy irritant: it’s a serious security liability.

Uncontrolled access means ex-employees and contractors retain permissions that were never revoked. Untracked versions mean sensitive information ends up in the wrong places at the wrong times. And the document collaboration tools you’re using are quietly and constantly processing the contents of your documents to power their AI features and search indexing.

But it doesn’t have to be this way. Here’s a step-by-step guide to using document collaboration tools without opening yourself up to an IP leak.

How most teams get document collaboration wrong

Online document collaboration is an essential part of doing business. It’s fast, efficient, and it doesn’t matter where your workforce is (as long as they’ve got WiFi).

The problem is, many early-stage teams tend to reach for whatever’s fastest to implement — Google Docs, Notion, Dropbox — and immediately start using them without stopping to build a system around them. No folder architecture, access conventions, or version control protocol.

For a startup team moving fast, this can feel fine. But it really isn’t fine, especially for a team whose documents contain IP worth protecting. In fact, cybersecurity for startups should start a lot earlier than you think.

The resulting issues tend to cluster around three things:

Version chaos: With no system in place, documents multiply and there’s no single source of truth to hang onto. People work from outdated files. Changes get lost in the mix. There are five slightly different versions of the same roadmap on your drive without any way to confirm which one’s current.
Access sprawl: Managing permissions is time-consuming, so files get broadly shared instead of specifically managed. Contractors, ex-employees, and external collaborators accumulate access. You soon lose track of who can see what.
Unnoticed data exposure: Consumer-grade collaboration tools commonly scan documents to power their search indexing, AI suggestions, and personalized advertising. Nothing just sits securely in your cloud folder — it’s being read by a robot.

What good document collaboration looks like

Before you’ve even looked at document collaboration tools, be clear about what you’re trying to achieve first.

A good document collaboration setup gives you five things:

Real-time co-editing: Instead of having to play email tennis with documents, multiple people can edit the same document at the same time, with changes visible as they happen
Version history: A reliable, timestamped record of who changed what and when that prevents you having to rely on your sticky notes or less sticky memory
Granular access controls: You can set permissions at folder, document, and user level (the opposite of an “anyone with the link” policy)
Secure external sharing: You can share documents outside your organization without opening the floodgates to everything else in your drive
True data privacy: You’re confident that your document-based data isn’t being scanned, mined, or processed by a third party (and that includes your business cloud storage provider)

With most popular collaboration tools (those tools teams reach for without a second thought) you might get two of these. The right platform can give you all five.

But whatever you use, you’ll still need a system to make them work.

How to set up document collaboration for your team: a step-by-step framework

Step 1: Audit what you have

You can’t build a clean, secure system for document collaboration on top of a messy, insecure one. So start with an honest audit of what you’ve already got.

List every tool where your documents currently live (Google Drive, Notion, Dropbox, email attachments, Slack). Then find out who has access to these tools, who controls access to them, and what happens to a document once it’s left your system.

Scour your drives for ‘problem files’ that will need special attention: documents that exist in multiple versions with no clear owner, folders shared with people who no longer need access, and commercially sensitive files (e.g. roadmaps, financial models, technical specs) sitting in tools with weak or non-existent access controls.

Step 2: Design a folder architecture that makes sense (and isn’t too complex)

Whatever you do next, don’t migrate first and organize later. That’s just compounding chaos: moving the same mess to a new and less familiar location.

Instead, take a breath… then design your folder structure. To guide you, here’s a simple, scalable folder architecture that will suit most start-ups:

Company: board meeting minutes, shareholder agreements, fundraising materials, legal contracts
Product: roadmaps, feature specs, design files, research
Engineering: technical documentation, architecture decisions, internal tooling guides, technical specs
Operations: HR policies, finance, supplier contracts
Clients: one subfolder per client, containing everything related to that relationship.

Remember: keep things simple and shallow. Complex file structures tend to get ignored — people dump files at the top level and chaos ensues. As a general rule: three levels of nesting, and no more. If you find yourself creating a fourth, the structure needs simplifying.

Step 3: Match your access levels to data sensitivity

Not everybody needs access to everything. Business data protection starts with setting three tiers of access before you invite your team in.

Company-wide: non-sensitive operational documents such as team handbooks, general meeting notes, process guides
Team-level access: departmental work that’s accessible to the relevant team only
Restricted access: anything commercially sensitive, legally protected, or covered by client confidentiality. This is the most important tier to secure: if (say) fundraising documents, roadmaps, technical specs, customer data, or client contracts are seen or shared by the wrong person, it spells competitive or legal liability

Our Workspace app handles all of this from a single admin dashboard. You can control members, permissions, and app access in one place, however big the team gets.

Step 4: Establish the four golden rules of version control

Now your folder architecture is in place, you need to establish four simple conventions to ensure that you never see a file in one of those folders named v3_final_FINAL_FINAL2_FINAL3.docx again. And won’t that be nicer for everyone?

These four rules apply to everyone on your team (make sure they know it):

All live documents exist in one place: No local copies, no email attachments
No version numbers in file names: Your tool should provide a proper version history and track every change. Share documents via link rather than attachment to avoid confusion. If you need to share a static export, put the date in the covering note, not the file name.
Version history is the single source of truth: If you want to know who changed what, when, just look in the version history.
Don’t delete — archive: Move superseded documents to a clearly labeled archive folder. You don’t want to delete a document that you (or a regulator) needs later.

Step 5: Define your protocol around external sharing

External sharing is where access control most commonly breaks down. A contractor gets linked to an entire project folder rather than just what’s relevant (with no expiration date on that access). A potential investor retains access to your fundraising data room long after deciding not to invest. It’s a dangerous world outside your perimeter.

To minimize that danger, set a protocol before you share anything externally. Three rules:

Grant minimum access for specific documents or folders only (not entire workspaces or drives)
Set expiration dates on all links
Revoke access at project end as a standard offboarding step

The right productivity and collaboration tools automatically enforce rules like this for you. Proton Drive sets expiration dates on shared links by default — so access expires without anyone having to remember to revoke it.

Step 6: Choose a platform that can enforce your security requirements

Most teams evaluate collaboration platforms on usability alone. Usability matters, of course. But security cannot be an afterthought.

Intellectual property is now the most expensive data type to lose in a data breach (at $178 per compromised record, according to IBM). If your documents contain IP worth protecting, your collaboration platform needs to be secure by default, not configuration.

When selecting a collaboration tool, you need to know:

Can the provider access your document content?
Where is your data stored and which jurisdictions apply? Is your data sovereign?
Is encryption end-to-end or only in transit?
Are admin controls centralized and granular enough to enforce access policy?

Here’s how four online document collaboration tools compare:

	Google Docs	Notion	Microsoft 365	Proton Docs
Real-time co-editing	✓	✓	✓	✓
Version history	✓	Limited	✓	✓
End-to-end encryption	✗	✗	✗	✓
Zero-knowledge storage	✗	✗	✗	✓
Centralized admin controls	Partial	Limited	✓	✓
No data processing for AI/ads	✗	✗	✗	✓
Privacy-first jurisdiction*	✗	✗	✗	✓

*Google Docs, Notion, and Confluence are headquartered in the US and subject to US jurisdiction, including the CLOUD Act. Proton is headquartered in Switzerland, outside US and EU jurisdiction.

For teams handling sensitive IP, Proton Docs lets your team perform real-time collaborative editing without risking data exposure.

It’s part of Proton Workspace, a secure collaboration suite which adds encrypted business cloud storage, secure video conferencing, and centralized admin controls to document collaboration. All built on end-to-end encryption and protected by Switzerland’s stringent privacy laws.

Meet your efficient and secure collaboration stack

To have true control over your documents — and peace of mind about their security — you need to have the right system in place and the right platform.

We’ve shown you how to build the right system. The platform to enforce it is Proton Workspace.

Over 100,000 organizations (including government agencies, healthcare providers, and law firms) trust Proton to secure their most sensitive data. Your documents deserve the same standard of protection.

Start free trial of Proton Workspace

The best office suites in 2026 (free and paid)

Alanna Alexander — Thu, 23 Jul 2026 11:42:48 GMT

For the better part of 20 years, there have been a big two dominating the office suite space, and only one choice for many businesses: the desktop power of Microsoft 365, or the online collaboration ease of Google Workspace.

Now prices are rising, and not everyone (least of all SMBs) can afford them. Microsoft is hiking its prices again in July 2026. There are also questions, increasingly hard to ignore, over what these providers are doing with your data, and what that means from a privacy and security perspective.

Historically, the alternative for those not using one of the big two has been a self-assembled stack sourced from multiple providers. This approach, however, can leave you with something more expensive, fragmented, and vulnerable than a single integrated platform.

The market has changed, and in 2026 your choices are less restricted.

Here’s a comparison of the main office suites in 2026: what each costs, what each includes, and what each does with your data.

How the main office suites compare

Four suites cover most of the office suite market in 2026: the two established leaders, a budget option, and a suite built on a fundamentally different architecture to any other.

That suite is Proton Workspace. Built on open source, independently audited zero-knowledge architecture which encrypts your data before it reaches Proton’s servers, Proton Workspace makes it impossible for Proton to access your data.

Whether you need a full online office suite or a desktop replacement, here’s how the four best options stack up.

N.B. Prices shown are for Business Standard tiers (annual billing) unless otherwise noted. Prices are accurate as of time of writing.

	Microsoft 365	Google Workspace	Zoho Workplace	Proton Workspace
Core apps	Word, Excel, PowerPoint, Teams, Outlook, OneDrive	Docs, Sheets, Slides, Meet, Gmail, Drive	Writer, Sheet, Show, Cliq, Mail, WorkDrive	Docs, Sheets, Meet, Mail, Drive, Calendar
Desktop apps	Business Standard+	Web only	Web only	Web only
AI assistant	Copilot (basic included; full Copilot adds $30/user/month)	Gemini (included)	Limited	Lumo (Premium only)
Data is protected from being used by AI for functionality and training	No	No	Yes (limited AI features)	Yes
Encryption	Server-side, Microsoft holds encryption keys	Server-side, Google holds encryption keys	Server-side, Zoho holds encryption keys	Zero-knowledge architecture, Proton holds no keys
VPN included	No	No	No	Yes
Password manager included	No	No	No	Yes
ISO 27001 and SOC 2 Type II certified	Yes	Yes	Yes	Yes
Jurisdiction	US (CLOUD Act applies)	US (CLOUD Act applies)	India/US (CLOUD Act applies)	Switzerland (not subject to CLOUD Act)
Base price/user/month	$14 (from July 2026)	$14 (Standard)	$6 (Professional)	~$14.25 (€12.99)
True cost/user/month	$44 with full Copilot add-on	$14+ with security add-ons	$6	~$14.25 all-inclusive
Best for	Microsoft ecosystem, desktop apps	Collaboration, UX	Budget-conscious SMBs	Privacy-first SMBs

The real cost of each office suite

This comparison table includes a ‘real cost’ row because headline prices can be misleading.

Microsoft 365 Business Standard and Google Workspace Standard both list at $14/user/month. Proton Workspace Standard costs €12.99/user/month. The differences only appear when you look at what each platform charges extra for.

Microsoft is promoting Copilot as a reason to stay on its platform. But for the full Copilot experience, you’ll need to pay an additional $30/user/month on top of the Business Standard subscription. For a 25 person team that’s $9,000 more per year.

Google won’t charge you extra for its AI. Google Workspace Business Standard includes Gemini. But if you want additional security features beyond the baseline, you’ll need Google Workspace Business Plus ($22/user), or to purchase add-ons separately.

Zoho Workplace Professional really is only $6/user/month. The trade-off is a less polished ecosystem and no zero-knowledge architecture.

Proton’s pricing is similarly transparent, but Proton Workspace Standard includes a lot more than Zoho Workplace. You get all the main office apps for €12.99/user/month, plus apps Microsoft and Google don’t include: business VPN and a password manager — all protected by zero-knowledge encryption and Swiss jurisdiction.

The privacy question most office suite comparisons skip

Who holds the encryption keys?

In other words, does your office suite provider have technical access to your documents, emails, and files?

Google, Microsoft, and Zoho all hold the keys.

Here’s why this matters: if your provider has the keys, they can access your data, whatever their stated privacy policy says — policies change. And if your provider gets breached, your data is exposed, too.

Google and Microsoft’s AI compounds the problem: Copilot and Gemini both depend on having access to your document contents to function. (In fact, Google raised its prices in 2025 to incorporate Gemini in Business and Enterprise packages.)

Data sovereignty is a third concern. Microsoft, Google and Zoho store data in jurisdictions subject to the US CLOUD Act. That means the US government can demand access to your data at any time.

Proton doesn’t hold the keys, and can never access your data, even if compelled by a court order. With Proton Workspace, you get the structural guarantee of zero-knowledge architecture, not a changeable privacy policy. Your data is encrypted on your device before it reaches Proton’s servers, and it’s stored in Switzerland, outside US CLOUD Act jurisdiction.

Proton Workspace Premium users get Lumo AI, a business AI assistant that doesn’t require access to your document contents and never trains on your data. (Zoho Workplace offers only limited AI features.)

Find out more about European businesses’ dependence on US tech and why the stakes are now higher than ever.

Proton Workspace: the only office suite with privacy by design

With Proton Workspace, teams get to use all the major office apps you’ll find in Microsoft 365 and Google Workspace: business email, calendar, enterprise cloud storage, documents, spreadsheets, video conferencing and (for Premium users) an AI assistant.

Proton’s office suite also includes two security features that the big two don’t: a business VPN that keeps your team’s connections private wherever they’re working, and a team password manage r that closes one of the most vulnerable vectors.

Finally, unlike the big two, zero-knowledge encryption applies across every Proton product by default.

For now, Proton Workspace doesn’t have a presentation app equivalent or deep legacy ERP integrations (worth knowing upfront if your business depends on complex third-party connections).

But for businesses that value data sovereignty, Proton is the straightforward choice. That’s why Proton is trusted by 100M+ users and 100,000+ businesses, including UN agencies and Fortune 500 companies.

Which office suite is right for you?

The office suite market has changed. You can now have both privacy and productivity in a single, full-stack platform that covers everything a growing SMB needs — without asking you to accept vendor access and uncertain jurisdiction as part of the deal.

Proton Workspace is the only suite in this comparison built on zero-knowledge architecture, which ensures only you can access your data. It’s about the same price as market leaders, with more essential security capabilities bundled in.

And it’s easy to get started. Migration from Microsoft 365 and Google Workspace can be self-service, or fully supported by Proton if it’s more complex, and the UX is familiar enough for your team to get started without training.

Start free trial of Proton Workspace