The Proton Blog

How to create a data retention policy that keeps your business compliant

Kate Menzies — Fri, 24 Jul 2026 16:20:48 GMT

Businesses collect an unbelievable amount of data during their operations, but rarely stop to review and even delete data.

A data retention policy defines how long your business keeps different types of information, why it keeps them, who can access them, and how they should be deleted when they are no longer needed. For small and midsize businesses, it’s one of the most practical ways to reduce compliance risk without overcomplicating day-to-day operations.

Many companies keep data for longer than necessary because deletion feels risky. Old customer records stay in a CRM. Former employee files remain in shared drives. Contracts sit in inboxes for years. Exported spreadsheets are saved “just in case.” Over time, the business ends up storing more personally identifiable information (PII), financial records, and internal information than it can properly govern.

That creates a problem under GDPR. The storage limitation principle means personal data should not be kept for longer than necessary for the purpose it was collected. A retention policy helps turn that principle into a working system: what you keep, for how long, where it lives, who owns it, how it is removed, and how access to retained data is protected.

That matters because weak passwords remain one of the most common vulnerabilities for businesses of all sizes, and retained data is still exposed if access controls are weak.

What is a data retention policy?

Why is a data retention policy important?

What kind of data needs a retention schedule?

UK data retention requirements: what SMBs should know

Data retention policy template for SMBs

Access control and retained data

Common data retention policy mistakes

Turn retention rules into everyday practice

What is a data retention policy?

A data retention policy is a set of rules that defines how long different categories of data should be kept within a business, and what happens when the retention period ends. It usually covers personal data, customer records, employee files, financial documents, contracts, communications, operational records, and business-critical documents.

A useful policy should answer these four questions:

What type of data do we hold?
Why do we need to keep it?
How long should we keep it?
How will we delete, anonymize, or archive it securely?

The GDPR does not set specific time limits for every type of data, so organizations need to decide what is necessary for their own purposes, document that reasoning, and be prepared to justify it.

A data retention policy is more than a list of dates. It’s a record of the decisions behind those dates. If someone asks why customer data was kept for three years or applicant records were deleted after six months, a business must be able to point to a clear reason.

Why is a data retention policy important?

A retention policy helps with compliance, security, and operational clarity. It protects a business in three ways:

It reduces the amount of data that could be exposed in a breach
It lowers legal and compliance risk from keeping information longer than necessary
It cuts storage costs tied to outdated records.

From a compliance perspective, it supports GDPR data retention obligations by showing that your business doesn’t keep personal data indefinitely without a reason. In the UK, the ICO is clear that personal data should not be retained on a “just in case” basis, but only for as long as it is necessary for the relevant purpose.

From a security perspective, less unnecessary data means less exposure. If your business suffers a breach, every outdated customer record, old payroll file, unused export, or forgotten inbox attachment may increase the amount of information affected.

That is why retention should be part of your broader approach to data breach prevention. How long you keep data directly affects exposure: the longer unnecessary records stay in your systems, the more there is for an attacker to access, steal, or expose.

From an operational perspective, retention rules reduce guesswork. Employees should know what to keep, where to store it, when to delete it, and who owns the decision. That is especially important for growing teams where data may be spread across email, cloud storage, HR systems, finance software, CRMs, shared drives, and vendor platforms.

What kind of data needs a retention schedule?

A data retention schedule is the working part of a data retention policy. It maps each data category to a retention period, owner, storage location, deletion method, data breach protection measures, and reason for keeping it.

SMBs should start with the data categories they use every day.

Employee records

Employee records don’t all follow the same retention logic. Some need to be kept because of statutory requirements, some because they may be needed to resolve disputes, and others only while there is a clear business reason.

For example, ACAS says employers must keep holiday records for at least six years from the date they were made, while GOV.UK guidance on staff records says employee information should only be kept for as long as the business has a clear need for it, then disposed of securely.

Customer and prospect data

Customer data may include contact details, purchase history, support tickets, billing information, contracts, account records, and communication history. Prospect data may include marketing leads, event signups, newsletter subscriptions, and sales notes.

Keep customer data for as long as you need it to provide the service, meet contractual obligations, handle disputes, comply with accounting rules, or meet legal requirements. Marketing data needs particular care because consent, legitimate interest, unsubscribe requests, and purpose limitations all affect how long it should be retained.

Financial and tax records

Financial records include invoices, receipts, payroll records, bank statements, expense claims, VAT records, accounting records, tax documentation, contracts and purchase orders, audit reports, credit card and loan records, and employee benefit or pension records where relevant.

In many jurisdictions, company and tax law sets a minimum period for keeping accounting and financial records, though the exact length varies by country and by company type.

Contracts and legal documents

Contracts, statements of work, vendor agreements, client agreements, leases, and legal correspondence may need to be retained for the contract term and for a period afterward in case of disputes.

The exact period depends on the contract, limitation periods, sector requirements, and legal advice. The policy should define an owner for these records, usually legal, finance, operations, or leadership.

Email communications and internal documents

Business email is often where retention policies are tested. Inboxes can hold contracts, personal data, attachments, customer complaints, invoices, candidate information, passwords, and confidential business decisions.

A retention schedule should define what belongs in email, what should be moved to an approved system, and when old messages should be deleted or archived. The same logic applies to internal documents, exported reports, spreadsheets, shared folders, and chat attachments. But the policy also needs an enforcement mechanism.

Retention rules should be tied to approved systems, automated deletion settings where feasible, archive rules, and ownership checks so data doesn’t remain indefinitely just because nobody acted when the retention period ended.

Credentials, access records, and security logs

Retention also applies to security records. This may include access logs, audit trails, password records, recovery codes, admin activity, incident reports, and authentication records.

Some security records need to be kept for investigation, compliance, or operational review. Others should only be retained for a defined purpose and a documented period, then deleted or archived according to the policy, especially when they reveal how your systems work or expose sensitive access details.

Data retention, credential management, and access control overlap: retained security records need strong access controls because they can reveal how your business systems work.

UK data retention requirements: what SMBs should know

UK data retention requirements vary. They depend on the type of data, the reason for keeping it, and the legal, tax, contractual, or business obligation behind it.

For GDPR data retention, the starting point is storage limitation: personal data should only be kept for as long as necessary for the purpose. UK GDPR doesn’t have one fixed period for every category, so businesses need to set their own retention periods and justify them.

Some records have clearer rules. Limited companies generally need to keep accounting records for six years from the end of the financial year they relate to, and sometimes longer in specific circumstances. Staff records vary by record type, so sensitive employment data should be categorized carefully and reviewed with legal or HR advice where needed.

Ultimately, it isn’t possible to apply one retention period to everything. Data should be separated by category, reason for keeping it defined, and document why each period is appropriate.

Data retention policy template for SMBs

Use this structure as a simple data retention policy template. Adapt the wording to your business, sector, and legal requirements.

1. Purpose and scope

Template copy: This data retention policy explains how [Company Name] stores, retains, archives, deletes, and protects business and personal data. It applies to employees, contractors, vendors, systems, and services that collect, process, store, or access company data.

2. Data categories

Template copy: [Company Name] groups data into categories, including customer data, prospect data, employee records, financial records, contracts, operational records, security logs, and internal communications. Each category must have an owner, storage location, retention period, and deletion method.

3. Retention schedule

Template copy: Data must only be kept for as long as required for business, legal, regulatory, contractual, or security purposes. Each data category must be listed in the retention schedule with a defined retention period and reason.

Example schedule:

Data category	Example records	Suggested retention approach	Owner	Deletion method
Customer data	Account records, support tickets, service history	Keep while customer relationship is active, then retain only as needed for legal, contractual, or dispute purposes	Operations or customer success	Delete or anonymize from CRM and support systems
Financial records	Invoices, receipts, payroll, tax documents	Generally keep for six years after the relevant financial year, unless longer retention is required	Finance	Archive securely, then delete
Employee records	Contracts, payroll, holiday records, HR files	Retain based on record type, statutory rules, and business need	HR or operations	Delete securely from HR systems and shared storage
Contracts	Client agreements, vendor contracts, statements of work	Keep for contract term plus a defined dispute period	Legal, finance, or leadership	Archive securely, then delete
Security logs	Access logs, admin activity, incident records	Keep for investigation, security, and accountability needs, then delete or archive based on risk	IT or security owner	Delete or archive securely
Marketing data	Leads, newsletter lists, campaign records	Keep while there is a valid purpose and suppression rules are respected	Marketing	Delete, anonymize, or suppress as appropriate

4. Access controls

Template copy: Access to retained data must be limited to people who need it for their role. Sensitive data must be stored in approved systems, protected by strong authentication, and reviewed regularly. Shared credentials must not be used to access retained data unless they are managed through an approved business password manager.

This section is where retention connects directly to credential management. Data that must be kept still needs protection. If old contracts, payroll files, customer records, or security logs remain accessible to people who no longer need them, the retention policy is only solving half the problem.

A business password manager supports access control by helping teams create strong credentials, store them securely, and share access only with authorized people. Proton Pass for Business helps teams manage credentials in encrypted vaults and use secure sharing, so retained data is less likely to be exposed through reused passwords or informal access.

5. Deletion and disposal

Template copy: When the retention period ends, data must be securely deleted, anonymized, or archived according to the retention schedule. Paper records must be shredded or disposed of securely. Digital records must be deleted from approved systems, shared drives, backups where appropriate, and any unmanaged storage locations. Deletion should be documented for sensitive data. Employees should also know where not to store information, such as personal drives, unapproved spreadsheets, or chat threads. If a data category becomes subject to a legal hold, dispute, audit, or investigation, deletion must be paused until legal or leadership authorizes the next step.

6. Responsibilities

Template copy: Each data category must have an owner responsible for retention decisions, access reviews, deletion, and policy updates. Employees are responsible for storing data in approved systems and reporting data they believe is outdated, duplicated, or stored in the wrong place.

7. Review cadence

Template copy: This policy and retention schedule will be reviewed at least annually, and sooner if [Company Name] introduces new systems, changes legal obligations, experiences a security incident, or changes how it collects or processes personal data.

Access control and retained data

A retention policy should never be separated from access control. Keeping data for a valid reason does not mean everyone should be able to reach it.

Retained data often includes sensitive information: employee files, customer records, tax documents, contracts, security logs, and incident reports. If access is unmanaged, older data can become an easy target during an account compromise. It can also create internal risk if employees can open records unrelated to their role.

Access controls should answer:

Who can access each retained data category?
Which systems store it?
Which credentials protect it?
Is MFA enabled?
Are shared credentials controlled?
When was access last reviewed?
What happens when someone leaves or changes roles?
Are third-party vendors and suppliers granted access, and is it controlled?

Data retention is connected to credential management. For breach prevention, access control also reduces blast radius. If an attacker compromises one account, they should not automatically reach years of archived customer data, old contracts, or employee records. Creating a password policy⁠ can help teams define rules for password creation, sharing, access management, and authentication.

For breach prevention, access control also reduces blast radius. If an attacker compromises one account, they should not automatically reach years of archived customer data, old contracts, or employee records. Proton’s guide to data breach protection for businesses⁠ explains why limiting access and reducing unnecessary exposure are important before an incident happens.

A business password manager such as Proton Pass for Business⁠ can also help teams control and review access to the credentials that unlock retained data, with centralized management, secure sharing, and clearer ownership through the admin panel.

Common data retention policy mistakes

Many SMBs already have informal retention habits, but not a reliable policy. The most common mistakes are easy to make: keeping too much data, applying one rule to every record, forgetting copies in everyday systems, deleting without checking legal holds, or keeping retained data accessible to too many people.

Mistake	Why it creates risk	What to do instead
Keeping everything forever	Storing data “just in case” can increase compliance risk and breach exposure.	Keep data only while there is a clear legal, contractual, security, or business reason.
Using one retention period for everything	Financial records, employee files, marketing leads, contracts, and logs serve different purposes.	Define retention periods by data category.
Forgetting email, spreadsheets, and exports	Copies may remain in inboxes, downloads folders, shared drives, or unmanaged files.	Include secondary storage locations in the policy.
Deleting without checking legal holds	Some data may need to be preserved for disputes, audits, investigations, or regulatory obligations.	Add a review step before deletion.
Ignoring access to retained data	Kept data can still be exposed if too many people can access it.	Assign owners, restrict permissions, and review access regularly.

Turn retention rules into everyday practice

A practical policy starts with the data your business already holds and turns it into a schedule people can follow. Each category should have a reason for being kept, an owner, a review cadence, and a clear deletion process. While that data remains in your systems, access should stay limited to the people who genuinely need it.

For many SMBs, credential management is one of the easiest places to make improvements. Strong passwords, secure sharing, and controlled access help make sure retained data is only available to the people who need it.

Control who can access retained data in your business with a secure business password manager.

Is Malwarebytes safe? All you need to know

Kate Menzies — Fri, 24 Jul 2026 15:36:21 GMT

Free security software should make you a little suspicious. After all, fake anti-malware apps are one of the most common malware disguises out there. So is Malwarebytes safe to use?

Rest assured: Malwarebytes is highly rated by trusted outlets like PC Mag and CNET, with a 4.2 rating on Trustpilot, and is safe to download and install, provided you follow official download links.

But just because Malwarebytes is legitimate doesn’t mean it’s all you need to keep malware at bay. In its free form, Malwarebytes is a scanner, not a shield. And a scan only protects you from what’s already on your device, not whatever comes next.

Keep reading to find out what Malwarebytes is, what the free version doesn’t help with, and the best practices you should follow to keep your device protected in ways Malwarebytes can’t.

What is Malwarebytes?

Malwarebytes is cybersecurity software designed to detect, block, and remove malicious threats from Windows, Mac, Android, and iOS devices.

Most people looking for a quick malware removal tool will only ever use the free version of Malwarebytes, which is far more limited than the paid tiers.

Plan	Entry-level price	Devices covered	Key Features
Free	$0	1	On-demand scan and removal, browser/web protection, ad and tracking blocker, data breach notifications
Standard	$44.99/yr	1	Same as Free, plus advanced, real-time antivirus protection, personalized security assessments, Browser Guard (in-browser scam and web protection, ad and tracking blocker, data breach notifications)
Plus	$79.98/yr	3	Same as Standard, plus Privacy VPN
Total	$89.99/yr	3	Same as Plus, plus Identity Protection ($1 million identity insurance, identity recovery specialists, advanced social media monitoring)

Is Malwarebytes safe? Why a scan isn’t the same as malware protection

As with any cybersecurity tool, there are limits to what Malwarebytes can and can’t do. Here’s a clear explanation of exactly what it can do for your device.

What a malware scan does (and what it doesn’t catch)

The free version of Malwarebytes is essentially a scan-on-demand tool with a handful of protective tools bundled in. It’s effective at checking the files already on your device, identifying malware and viruses, and removing them.

However, this is only retrospective protection: any malware that was on your device before the scan could already have done damage: ransomware could have encrypted your files to be held hostage, or spyware could have harvested your data and sold it to data brokers.

What antivirus protection does (but can’t account for)

Instead of waiting for you to run a scan, full antivirus protection continuously monitors and blocks threats in real time. It catches most malware as it tries to install or run — before it has the chance to do damage.

This is a stronger layer of defense, which is why Malwarebytes charges you for it. The good news is you don’t have to pay for real-time protection, since you probably already have a real-time layer running on your device.

Microsoft devices: Microsoft Defender and its firewall are built into Windows
Apple devices: XProtect is built into macOS
Android devices (with Google Play services): Google Play Protect is baked into every Android device and switched on by default

But whether free or paid for, real-time protection doesn’t guarantee against malware infection, because no antivirus tool catches everything. There are two reasons for this:

New threats are always emerging: Before services like Malwarebytes can detect them, they’re able to slip past the defenses of even the most sophisticated tools
Human error: If you download a malicious app from a sketchy site, or accidentally grant permission to an untrustworthy service or app, your antivirus won’t always save you

To be fully protected, you need to back up your antivirus protection and malware scans with smarter behavior. Use our guides to check if your phone has a virus and find out more about Android vs iOS security.

Five free habits that close the security gaps left by Malwarebytes

Here are five simple rules to follow that will provide an extra layer of protection no antivirus app can.

1. Keep your OS and apps up to date

Updates patch known vulnerabilities in operating systems and apps. Neglecting to update can present cybercriminals with a backdoor into your device that they already have the key to.

Turn on automatic updates for your OS and apps, right now. That way you don’t have to rely on remembering.

2. Do your due diligence before you install

On desktop, only download apps from the developer’s own official site, never a third-party download aggregator.

On mobile, only install apps from official stores. But be careful: there’s an abundance of disguised malware on both the Play Store and App Store. If you’re unsure, check the developer’s name in the app store to see what else they’ve published and find their personal website.

For a guide to protecting yourself against malicious apps on official stores, read our article on avoiding malware on Play Store. (Most of the advice applies to the Apple App Store, too.)

3. Use strong passwords (and don’t reuse them across accounts)

Most of us have a bad habit of using passwords that are easy to remember: short, predictable, and easy for cybercriminals to crack.

That habit’s even more damaging if you’re using that same, weak password across multiple accounts. One password is exposed, and every account that shares that password is compromised.

To avoid falling into these traps, you need a password manager to generate unique, strong credentials for every one of your accounts.

4. Use email aliases

Your inbox is a valuable target for cybercriminals, full of the personal information they need to build a clearer picture of you in order to scam you.

An email alias gives you a unique, disposable email address to use for each service, with all mail feeding into a single, “real” email address. As well as helping to get rid of spam email, aliases help hide your real inbox from cybercriminals when companies get breached.

5. Use a VPN

When you use unencrypted public networks, anyone else on that network can see what websites you’re visiting. They might not be able to see what you’re doing on a banking website, but they’ll be able to find out which bank you use.

Using a virtual private network (VPN) protects your privacy by encrypting your connection, so anyone else on the network who tries to look at your traffic sees only a scrambled, unexploitable mess.

Prevention starts with a secure VPN and password manager

When your device is already infected with malware, a Malwarebytes scan provides a handy cure. Ideally, though, you want to prevent malware getting on there in the first place.

Malwarebytes cleans up what’s already there. Proton VPN and Proton Pass make sure there’s less to clean up. Here’s how.

Proton VPN

Malwarebytes has its own VPN: Privacy VPN. It has some downsides:

It can only be used with a $79.98/yr subscription to Malwarebytes Plus
Malwarebytes operates under US jurisdiction, which makes it subject to the CLOUD Act, meaning your data can be disclosed under compulsion
It’s only passed one independent audit, in 2026, which flagged a critical vulnerability

The Independent Swiss VPN, Proton VPN, by contrast:

Is free to use
Is under Swiss jurisdiction, not subject to any mandatory data retention laws
Has passed five consecutive annual independent audits

Discover Proton VPN

Proton Pass

If malware or a data breach does compromise one of your accounts, our end-to-end encrypted password manager Proton Pass can contain the damage.

Proton Pass makes it easy to create, store, and use strong credentials. It lets you:

Generate strong passwords for every account
Autofill credentials across sites and apps, so you only need to remember one password
Use up to 10 email aliases (with the free version), and unlimited aliases with Pass Plus

Your vault is kept private by zero-knowledge encryption: not even Proton can access your credentials.

Ultimately, Malwarebytes is a helpful tool that can help you secure a compromised device. But staying safe online requires a more proactive strategy, which Proton’s easy-to-use tools can help anyone create.

Is Venmo safe? Here’s how to protect yourself

Kate Menzies — Fri, 24 Jul 2026 15:09:14 GMT

Need to send your friend some money for a group vacation, or your grandchild a cashless transfer for their birthday? If you’re in the US, you might be thinking of using the Venmo app.

It’s a popular option for a reason: Venmo makes sending money to family and friends easy and even fun with a social feed that lets you follow transactions between your friends. But is it safe?

Firstly, Venmo isn’t a scam app: it’s a legitimate business, with a 4.9/5 rating on the Apple App Store from over 15 million ratings and a 4.4 star rating on Google Play Store from over 900,000 reviews (with over 50 million downloads).

And it’s safe to use, too, provided you’re making payments to people you know. But you should be aware that paying strangers is riskier, and that scammers can impersonate both Venmo itself and your friends on the platform.

Here’s how to use it safely, and spot the scams that put your money at risk.

What is Venmo and how does it work?

Venmo is a US-only peer-to-peer payment app owned by PayPal. Using Venmo, you can instantly and directly send other Venmo users money.

You can also:

Send gift cards from brands including Amazon, Starbucks, and Doordash
Split group payments by creating groups with your peers, adding expenses, and settling up
Pay online and in-person
Move money from and to your bank account
Get your paycheck sent right to your Venmo account (up to 2 days early)

Venmo tries to make all this fun: you can attach messages (including emojis) to payments, and a social feed, which enables you to see what payments your peers are making (and vice versa).

Is Venmo safe to use with strangers?

The Venmo app is built for moving money between people who already know each other, not for strangers. In practice, though, many people use it to pay strangers selling items online.

Sellers on Facebook Marketplace will often ask buyers to pay via Venmo. It isn’t a built-in option like Meta Pay, so you’ll have to agree to it off-platform, usually in a Facebook Messenger thread.

This isn’t necessarily a red-flag request: plenty of legitimate sellers prefer Venmo for its lack of fees. But when a seller refuses to use a protected option (Meta Pay, PayPal Goods & Services) when one’s available, you could have cause for concern.

The problem is that Venmo personal payments carry no buyer protection by default and can’t be reversed once accepted. If you pay a stranger without buyer protection and receive the wrong item, a damaged item, or nothing at all, you won’t be able to get your money back.

How to protect personal payments on Venmo

Payments to approved business accounts are automatically protected. To confirm they’re approved, look for “Eligible items covered by Purchase Protection” under the pay button.

If you’re paying a personal Venmo account page, however, your payment won’t be covered by Venmo’s Purchase Protection Program unless you tag it as a purchase. (Note: this makes the coverage possible, not automatic: see Venmo’s Purchase Protection Eligibility guidelines.)

To tag your transaction: tap the toggle shown below the payment method to confirm it’s a purchase.

This incurs a 2.99% fee for the recipient, which won’t be refunded to them if they have to refund the sender. Some sellers may use this as an excuse to discourage you from adding this fee.

Be wary if they do: Purchase Protection protects sellers from being scammed by buyers too, provided the seller can produce proof of shipment and delivery.

How to spot scams on Venmo

Once you’ve signed up to Venmo, you might be targeted by scams, as Venmo itself acknowledges. Here are three scams Venmo flags, and how to protect yourself.

An email or text saying you’ve won money through Venmo

This message will include a phishing link, which you shouldn’t click.

Never enter Venmo login information outside of Venmo.com and the Venmo app, and never share account information on social media, except through Venmo’s official accounts: @Venmo and @VenmoSupport on X/Twitter, @Venmo on Instagram, and @Venmo on Facebook.

A call from Venmo (which isn’t from Venmo)

Under some pretext, the caller asks you to make a payment, or share a two-factor authentication code that’s been sent to your phone.

Never share your Venmo verification code. Venmo states that they will never ask for your verification code on a call, ask to access your device remotely, or to send money to another account.

A scammer impersonates a friend on Venmo

You get an unusual (often time-sensitive) payment or request for money from someone who looks like your friend.

Double-check that it’s actually them. A scammer can copy a username, profile picture, and social feed details to seem credible. Check their profile’s public transaction history, and, if still in doubt, reach out to your friend outside Venmo to verify.

How to use Venmo safely

Follow these guidelines to make sure Venmo is a safe place to buy, sell, and transfer money.

Tag any purchases made via personal Venmo accounts as purchases to ensure you’re covered by Purchase Protection
Set transaction visibility to private so that not even friends, including potential scammers posing as your friends, can see them on their feed. Following privacy issues reported by The Verge in May 2026, new users are set to see only friends’ activities by default, but this doesn’t guard against impersonators.
Verify identities through a second channel before paying, including anyone who’s unfamiliar, and anyone who is familiar but acting unusually

Beyond your behavior, you can close remaining gaps and minimize any potential damage by installing these tools on your devices:

A password manager to generate and store a strong, unique password for your account, so a breach on another site doesn’t hand attackers a working password to all of your online accounts
An email alias generator to create an individual email address to register with Venmo. It forwards Venmo mail to your main inbox, and protects your real address if Venmo gets breached
A VPN to encrypt your connection when you’re sending money over public WiFi, keeping your session private from prying eyes

Secure your passwords and privacy with Proton

Proton was founded to make the internet safer. Our products make it harder for scammers to steal your credentials and personal information.They also make it easier to use the internet safely and protect your online accounts.

With our free password manager Proton Pass you can:

Generate a strong, unique password for every account you use (including Venmo): if one of your passwords leaks, they won’t all leak
Set up an email alias for Venmo: if they ever get breached, the attackers won’t have the keys to your primary inbox
Ensure your login credentials aren’t autofilled on fake Venmo pages: Proton Pass autofills logins only on the websites it recognizes, so it won’t hand your password to a domain that isn’t venmo.com

Proton VPN won’t stop the scams listed by Venmo, but it keeps you safer online, encrypting your connection whenever you’re using Venmo or any other app, blocking ads and malware trackers.

Both Proton Pass and Proton VPN are protected by zero-access encryption that means not even Proton can access your passwords.

Venmo can be as safe as you make it. Pair smart habits with tools that protect your credentials and your connection, and you can send payments without paying an undue price.

EU fines Google $1 billion over its search and Play Store

Edward Komenda — Thu, 23 Jul 2026 17:20:29 GMT

European Union regulators fined Google €890 million on Thursday, saying the company broke the bloc’s digital competition law by steering users toward its own services in search results and restricting what app developers are allowed to tell their customers.

The penalty, worth about $1 billion, closes two investigations the European Commission opened in March 2024 and makes Google the third company sanctioned under the Digital Markets Act. Alphabet, Google’s parent company, takes in roughly that much revenue in a day.

What regulators found

The European Commission split the fine in two. It attributed €460 million to self-preferencing in search, finding that Google gave its own shopping, hotel, transport and sports results better placement than it gave competitors.

The remaining €430 million covers the Play Store, where regulators said Google barred developers from telling users about cheaper offers available elsewhere and charged steering fees beyond what the law permits.

Teresa Ribera, the Commission’s executive vice president for competition, said the best products should succeed on merit rather than on who owns the search engine. Google has 60 days to comply or face daily penalties of up to 5% of Alphabet’s worldwide turnover.

Kent Walker, Google’s president of global affairs, called the decision “product degradation driven by a small group of self-serving complainants.” The company said it is weighing an appeal. Politico reported that the Commission reached its decision internally in March and announced it a day before temporary US tariffs on trading partners are due to expire.

A day of revenue

Alphabet reported $403 billion in revenue in 2025, roughly $1.1 billion a day, meaning Thursday’s penalty is worth less than 24 hours of business.

Proton tracks what Big Tech pays in fines each year. In 2025, regulators worldwide levied about $7.8 billion against Alphabet, Apple, Meta and Amazon, the largest annual total we have recorded.

Measured against free cash flow, those four companies could have cleared the entire year of penalties in 28 days. Alphabet drew about $4.24 billion of it, more than any of them, and could have covered its share in about three weeks.

The pattern holds going back further. EU regulators have fined Google more than €10 billion since 2017, and Europe’s highest court upheld the largest of those, a €4.1 billion Android penalty, on July 2.

None of it changed how the company operates, however, because none of it cost more than operating that way earns.

What the fine does not reach

Self-preferencing is a competition finding, but what it protects is an advertising business. Results that keep users on Google surfaces keep them measurable. Privacy-first services rarely lose on quality. They lose on placement.

For the first time in a long while, governments are taking their duty to citizens seriously and fighting the monopolies that corrupted the internet’s early promise. But make no mistake: the fines are still too small to make Big Tech sit up. Unwinding Big Tech’s structural advantages, rather than the checks it writes, is what holds real promise for restoring freedom and fairness online. A fairer internet would let services that protect personal data instead of exploiting it succeed on merit.

Building that better internet will take years. Until then, the burden falls on you, and the choice carries much further than it may seem: Keeping your data out of Big Tech’s hands protects your information and cuts into the ad revenue that pays for the conduct regulators keep fining.

The simplest defense is end-to-end encryption. Proton is funded by the people who use it rather than by advertisers, so it has no reason to collect your data. Sign up free and take control of your email, calendar, photos and files, browsing, and passwords and online identity.

Why your business needs document version control

Alanna Alexander — Thu, 23 Jul 2026 14:18:17 GMT

An email from a client pops up on your laptop: “This contract is rife with errors.”

You pull up the file and realize — you sent them a version from 36 hours ago, before legal had reviewed it, before that key clause was approved. Nobody can tell you with certainty which version left your hands, or why.

That’s a version control failure. And in a moment of exposure — an audit, a near-miss, a client complaint, an internal dispute — it can mean more than a lost deal. It can mean a compliance violation you can’t defend, a dispute you can’t prove, or a client relationship that doesn’t recover.

Document version control helps you answer who changed what, when, and which version left your hands. If you’re responsible for how documents move through your organization — contracts, compliance records, internal policies — this is what you need to understand about it.

What is document version control?

Document version control is also known as revision control or file version control. It’s the system that tracks every change to an ongoing file or project. It doesn’t overwrite what was there before. It preserves every change as a new entry in the document’s history, so you can see every decision that different collaborators made and return to a previous version if you need to.

Version control can be done manually — saving and renaming files as “v1,” “v2,” “FINAL” — but that depends on everyone following the same convention consistently, which is how records get gaps.

The more reliable approach is using business cloud storage software that does it automatically, logging every change in the background without anyone having to remember. You won’t have to manually save and name files with version numbers, it does it automatically, giving you a complete record of changes without anyone having to maintain it.

You’ll find more tips on finding the right software further down this blog.

Find out more about the best practices of document management.

Why does version control matter for compliance?

In regulated industries like healthcare, law, or finance, process failures like document problems have a serious consequence: They leave gaps in your record that you may one day have to explain.

What changed?

When something goes wrong with a document — a clause that shouldn’t have been there, a figure that doesn’t match what was agreed, terms that contradict an earlier version — the first question anyone asks is: what changed, and when?

In a regulated environment, that question isn’t just internal. A financial regulator may want to know exactly what was amended in a client agreement and when. A court may want to see whether a clause was present in the original draft or added later. A compliance officer may need to demonstrate that a policy document wasn’t altered after it was approved.

Without a complete version history, none of those questions have a reliable answer.

Who had access?

Knowing what changed is only part of the record. Regulators and auditors will also want to know who had access to a document, and at what stage.

A contractor whose access wasn’t revoked after a project ended. A team member who opened a file outside their authorization. An external party who saw a draft before it was finalized. None of these events alter the document — but all of them are exposure events, and in a compliance context, exposure events need to be logged.

A SaaS company handling customer PII data will face this question directly every time an enterprise client asks: “who has seen our data, and can you prove it?” SOC 2 auditors will ask the same thing. If you can’t produce that access history, you don’t pass.

Which version is final?

In a contract dispute, a regulatory submission, or an internal investigation, there can only be one answer to this question.

If multiple versions of a document exist across shared drives, email threads, and downloaded copies, nobody can say with certainty which one is authoritative. Ambiguity is a liability.

A proper version control system designates a single, timestamped record as final — and keeps the full history of everything that came before it, so the answer to this question is never in doubt.

7 ways to maintain version control for your business

Always work in shared files — if anyone is working on a local copy, the compliance record has a gap
Be logged in when you edit — anonymous edits aren’t attributable, and attribution is what auditors require
Never edit outside the system — changes made in a downloaded copy or an email attachment are invisible to the version history. If it didn’t happen in the shared document, it didn’t happen on the record
Only share access with people who need it — every unnecessary collaborator is an unlogged exposure risk
Revoke access when it is no longer necessary — access that outlives its purpose is a liability, not just an oversight
Designate and protect the final version — once a document is approved, it should be clearly identifiable as final and protected from further edits. A version history full of post-approval changes is not a clean compliance record
Never delete a document to start over — deleting a file destroys its compliance record permanently

What to look for in a document tool

For business uses, here is what matters:

Automatic versioning: Version history should not need manual work. If team members need to keep track of versions, they will most likely get confused and create friction. They will need a real-time collaborative document that actually saves the edits automatically.
Long retention: A 30-day edit log will not be enough for audits or disputes. Business document version control should keep the records for months — or even years — and make sure you keep all compliance checks in place.
Safe restore options: Restoring a previous version should not overwrite or delete what came after it. Look for tools that let you make a copy of a past version or roll back fully while keeping the complete history intact. This is crucial to safeguarding client data and keeping teams aligned.
Attribution and controls: Timestamps are not enough. You need to tie each change to a person. That is what makes file revision control useful for accountability. Also, permissions or link-expiration features should not be managed through separate tools. Version control and secure file sharing for teams should be part of the same workflow.
End-to-end encryption: Version history can contain sensitive information. If the service provider can access all draft versions, then your information is also accessible to them. Look for tools that provide full end-to-end encryption for increased security.

Protect your documents from the get-go

At Proton, we built Proton Docs and Proton Sheets, online software for collaborative documents and secure spreadsheets, to give remote teams full control over their documents, with automatic versioning and end-to-end encryption across every file and every revision. So your document history stays secure by default.

Version control is only as reliable as the tools behind it. Proton Drive automatically saves your version history, with no need for manual checkpoints. It retains document history for up to 10 years — long enough to meet most data retention requirements — and allows you to safely roll back to any version you need.

Start with a free Proton account or explore our business cloud storage, Drive for Business.

What to look for in a secure cloud workspace (before you commit)

Alanna Alexander — Thu, 23 Jul 2026 13:23:37 GMT

Choosing a cloud workspace is probably the most consequential infrastructure decision you can make.

Many teams default to Google Workspace or Microsoft 365 because they seem like the obvious choice: familiar, feature-rich, deeply integrated cloud collaboration platforms that are easy to adopt and already embedded in many modern workflows.

But that’s precisely why they’re worth scrutinizing before you commit. Here are four key things you need to consider when evaluating a cloud workspace, plus a checklist of questions to help guide you.

1. Integrations can free you up now — but lock you in later

Integrations are a major selling point for most cloud workspaces. Many companies (especially fast-moving start-ups) want a platform with lots of integrations that slots seamlessly into existing workflows with minimal disruption.

However, over the long term using integrations can mean embedding your workflows inside a single ecosystem. And once you’ve tied yourself into a cloud workspace ecosystem, switching providers becomes a data admin’s worst six months at the office — we’re talking siloed data, identity and access disruption, denied permissions, inaccessible files, and a dip in productivity your CEO will definitely notice.

This certainly applies to go-to platforms like Google Workspace and Microsoft 365, which are strategically designed to hook businesses on a wider ecosystem of co-dependent tools — Meet, Teams, Drive, and SharePoint — that become progressively harder to detach from.

The question you need to ask before picking a cloud workspace isn’t “how easy is this to adopt?” It’s “how hard will this be to get out of?”

2. ‘Security’ means different things to different providers

Most enterprise workspace providers market their platforms as boasting ‘enterprise-grade security’, with certifications, perimeter protections, and encryption of data in transit and at rest.

What many providers are less keen to advertise is that they retain server-side access to your data. This enables their most useful features: indexing, analytics, cloud-side processing and AI assistance provided by tools like Google’s Gemini and Microsoft Copilot, both of which rely on visibility into your business emails, documents, calendars, and collaboration data to function.

For many businesses shopping for a cloud workspace, that’s an entirely acceptable tradeoff: Strict cloud data security sacrificed for the sake of convenience and functionality. But if your business handles sensitive information, such as confidential client data, business continuity documents, or financial records, you might want to think twice about it.

If you’re an SMB, you might want to think more than twice. According to Proton’s SMB Cybersecurity Report 2026, nearly one in four SMBs fell victim to a data breach in 2025. Hackers view SMBs as vulnerable targets. The wrong cloud workspace could expose you even more.

The right cloud workspace will offer end-to-end encryption and zero-knowledge cloud storage. This means your provider can’t access your data, even if compelled.

3. Data sovereignty is important (but not all providers respect it)

Where data is collected, processed, and stored determines which laws and jurisdictions apply to it, and therefore its potential exposure.

Many cloud providers operate across jurisdictions, including countries where governments may compel access under local legal frameworks, either now or in the future. Your provider’s terms of service may not protect you from that.

To stop jurisdictional authorities from exposing your data, privacy-first providers like Proton promote data sovereignty: the concept that the laws that govern data should be the laws of where it was generated and collected — no matter where it’s stored.

For companies operating in regulated industries and handling sensitive customer information and/or managing intellectual property, data sovereignty should be a significant strategic consideration.

Overlooking data sovereignty can be costly. In 2023, Meta was fined €1.2 billion (the largest GDPR fine ever issued) not for a hack or a breach, but for storing European user data in the US. The data was secure. The jurisdiction wasn’t.

If you’re concerned about your data security and sovereignty, seek out providers that host data in privacy-first jurisdictions, such as Iceland or Switzerland.

4. Remember: your governance burden grows with your business

A common cybersecurity mistake made by scaling SMBs when choosing a cloud workspace is underestimating how quickly data governance and access control becomes complicated by growth.

A workspace that enables you to manage permissions for a workforce of 10 might not be suited to doing the same for a workforce of 60, particularly when that expanded workforce includes contractors, external collaborators, and people spanning multiple departments with different access requirements.

As you scale, your data governance will evolve from a simple setup task to a full-time job, involving a host of challenges, including permission sprawl, higher risk offboarding, unreliable manual tracking, and decreasing visibility into who has access to what.

Some cloud ecosystems compound this challenge by distributing permissions and workflows across multiple integrated systems, which makes centralized oversight difficult.

Others, however, provide a single admin layer where admins can monitor, manage, and adjust access as the organization grows and evolves.

Pick the right type now, and you’ll avoid the headaches of the future that come with retrofitting access controls into a workspace you’ve already scaled into.

9 questions to ask yourself before you commit to a cloud workspace

Before committing to a provider, ask:

Who controls the encryption keys?
Can your provider’s employees access your data?
What metadata remains visible to the provider?
Is your data processed by the platform’s AI systems?
Where is data stored and processed, and which jurisdictions apply?
Can admins enforce multi-factor authentication and permissions centrally?
How difficult would it be to migrate to a different workspace down the line?
Can data be exported cleanly and completely?
Will your governance tooling scale with your headcount?

A cloud workspace for the next five years, not the next 12 months

The right cloud workspace isn’t the easiest to adopt today. It’s the one you’ll still be using, and trusting, in five years. A platform that gives you long term security, control, and flexibility, and without locking you into an ecosystem forever.

Sounds like Proton Workspace to us. A secure cloud workspace, built on end-to-end encryption, zero-knowledge business cloud storage, and Swiss privacy law — with centralized admin controls designed to scale with your organization.

Start free trial of Proton Workspace

How to set up secure document collaboration for your team — without leaking your IP

Alanna Alexander — Thu, 23 Jul 2026 12:14:51 GMT

Right now, there’s a file in your shared drive named something like v3_final_FINAL_FINAL.docx. You don’t know who edited it last. You don’t know if it’s the version your CTO signed off on. You’re not entirely sure who has access to it.

This is ‘version chaos’: an all too common problem for teams scaling remotely. Feels bad, doesn’t it? Possibly not bad enough. Because it isn’t just a messy irritant: it’s a serious security liability.

Uncontrolled access means ex-employees and contractors retain permissions that were never revoked. Untracked versions mean sensitive information ends up in the wrong places at the wrong times. And the document collaboration tools you’re using are quietly and constantly processing the contents of your documents to power their AI features and search indexing.

But it doesn’t have to be this way. Here’s a step-by-step guide to using document collaboration tools without opening yourself up to an IP leak.

How most teams get document collaboration wrong

Online document collaboration is an essential part of doing business. It’s fast, efficient, and it doesn’t matter where your workforce is (as long as they’ve got WiFi).

The problem is, many early-stage teams tend to reach for whatever’s fastest to implement — Google Docs, Notion, Dropbox — and immediately start using them without stopping to build a system around them. No folder architecture, access conventions, or version control protocol.

For a startup team moving fast, this can feel fine. But it really isn’t fine, especially for a team whose documents contain IP worth protecting. In fact, cybersecurity for startups should start a lot earlier than you think.

The resulting issues tend to cluster around three things:

Version chaos: With no system in place, documents multiply and there’s no single source of truth to hang onto. People work from outdated files. Changes get lost in the mix. There are five slightly different versions of the same roadmap on your drive without any way to confirm which one’s current.
Access sprawl: Managing permissions is time-consuming, so files get broadly shared instead of specifically managed. Contractors, ex-employees, and external collaborators accumulate access. You soon lose track of who can see what.
Unnoticed data exposure: Consumer-grade collaboration tools commonly scan documents to power their search indexing, AI suggestions, and personalized advertising. Nothing just sits securely in your cloud folder — it’s being read by a robot.

What good document collaboration looks like

Before you’ve even looked at document collaboration tools, be clear about what you’re trying to achieve first.

A good document collaboration setup gives you five things:

Real-time co-editing: Instead of having to play email tennis with documents, multiple people can edit the same document at the same time, with changes visible as they happen
Version history: A reliable, timestamped record of who changed what and when that prevents you having to rely on your sticky notes or less sticky memory
Granular access controls: You can set permissions at folder, document, and user level (the opposite of an “anyone with the link” policy)
Secure external sharing: You can share documents outside your organization without opening the floodgates to everything else in your drive
True data privacy: You’re confident that your document-based data isn’t being scanned, mined, or processed by a third party (and that includes your business cloud storage provider)

With most popular collaboration tools (those tools teams reach for without a second thought) you might get two of these. The right platform can give you all five.

But whatever you use, you’ll still need a system to make them work.

How to set up document collaboration for your team: a step-by-step framework

Step 1: Audit what you have

You can’t build a clean, secure system for document collaboration on top of a messy, insecure one. So start with an honest audit of what you’ve already got.

List every tool where your documents currently live (Google Drive, Notion, Dropbox, email attachments, Slack). Then find out who has access to these tools, who controls access to them, and what happens to a document once it’s left your system.

Scour your drives for ‘problem files’ that will need special attention: documents that exist in multiple versions with no clear owner, folders shared with people who no longer need access, and commercially sensitive files (e.g. roadmaps, financial models, technical specs) sitting in tools with weak or non-existent access controls.

Step 2: Design a folder architecture that makes sense (and isn’t too complex)

Whatever you do next, don’t migrate first and organize later. That’s just compounding chaos: moving the same mess to a new and less familiar location.

Instead, take a breath… then design your folder structure. To guide you, here’s a simple, scalable folder architecture that will suit most start-ups:

Company: board meeting minutes, shareholder agreements, fundraising materials, legal contracts
Product: roadmaps, feature specs, design files, research
Engineering: technical documentation, architecture decisions, internal tooling guides, technical specs
Operations: HR policies, finance, supplier contracts
Clients: one subfolder per client, containing everything related to that relationship.

Remember: keep things simple and shallow. Complex file structures tend to get ignored — people dump files at the top level and chaos ensues. As a general rule: three levels of nesting, and no more. If you find yourself creating a fourth, the structure needs simplifying.

Step 3: Match your access levels to data sensitivity

Not everybody needs access to everything. Business data protection starts with setting three tiers of access before you invite your team in.

Company-wide: non-sensitive operational documents such as team handbooks, general meeting notes, process guides
Team-level access: departmental work that’s accessible to the relevant team only
Restricted access: anything commercially sensitive, legally protected, or covered by client confidentiality. This is the most important tier to secure: if (say) fundraising documents, roadmaps, technical specs, customer data, or client contracts are seen or shared by the wrong person, it spells competitive or legal liability

Our Workspace app handles all of this from a single admin dashboard. You can control members, permissions, and app access in one place, however big the team gets.

Step 4: Establish the four golden rules of version control

Now your folder architecture is in place, you need to establish four simple conventions to ensure that you never see a file in one of those folders named v3_final_FINAL_FINAL2_FINAL3.docx again. And won’t that be nicer for everyone?

These four rules apply to everyone on your team (make sure they know it):

All live documents exist in one place: No local copies, no email attachments
No version numbers in file names: Your tool should provide a proper version history and track every change. Share documents via link rather than attachment to avoid confusion. If you need to share a static export, put the date in the covering note, not the file name.
Version history is the single source of truth: If you want to know who changed what, when, just look in the version history.
Don’t delete — archive: Move superseded documents to a clearly labeled archive folder. You don’t want to delete a document that you (or a regulator) needs later.

Step 5: Define your protocol around external sharing

External sharing is where access control most commonly breaks down. A contractor gets linked to an entire project folder rather than just what’s relevant (with no expiration date on that access). A potential investor retains access to your fundraising data room long after deciding not to invest. It’s a dangerous world outside your perimeter.

To minimize that danger, set a protocol before you share anything externally. Three rules:

Grant minimum access for specific documents or folders only (not entire workspaces or drives)
Set expiration dates on all links
Revoke access at project end as a standard offboarding step

The right productivity and collaboration tools automatically enforce rules like this for you. Proton Drive sets expiration dates on shared links by default — so access expires without anyone having to remember to revoke it.

Step 6: Choose a platform that can enforce your security requirements

Most teams evaluate collaboration platforms on usability alone. Usability matters, of course. But security cannot be an afterthought.

Intellectual property is now the most expensive data type to lose in a data breach (at $178 per compromised record, according to IBM). If your documents contain IP worth protecting, your collaboration platform needs to be secure by default, not configuration.

When selecting a collaboration tool, you need to know:

Can the provider access your document content?
Where is your data stored and which jurisdictions apply? Is your data sovereign?
Is encryption end-to-end or only in transit?
Are admin controls centralized and granular enough to enforce access policy?

Here’s how four online document collaboration tools compare:

	Google Docs	Notion	Microsoft 365	Proton Docs
Real-time co-editing	✓	✓	✓	✓
Version history	✓	Limited	✓	✓
End-to-end encryption	✗	✗	✗	✓
Zero-knowledge storage	✗	✗	✗	✓
Centralized admin controls	Partial	Limited	✓	✓
No data processing for AI/ads	✗	✗	✗	✓
Privacy-first jurisdiction*	✗	✗	✗	✓

*Google Docs, Notion, and Confluence are headquartered in the US and subject to US jurisdiction, including the CLOUD Act. Proton is headquartered in Switzerland, outside US and EU jurisdiction.

For teams handling sensitive IP, Proton Docs lets your team perform real-time collaborative editing without risking data exposure.

It’s part of Proton Workspace, a secure collaboration suite which adds encrypted business cloud storage, secure video conferencing, and centralized admin controls to document collaboration. All built on end-to-end encryption and protected by Switzerland’s stringent privacy laws.

Meet your efficient and secure collaboration stack

To have true control over your documents — and peace of mind about their security — you need to have the right system in place and the right platform.

We’ve shown you how to build the right system. The platform to enforce it is Proton Workspace.

Over 100,000 organizations (including government agencies, healthcare providers, and law firms) trust Proton to secure their most sensitive data. Your documents deserve the same standard of protection.

Start free trial of Proton Workspace

The best office suites in 2026 (free and paid)

Alanna Alexander — Thu, 23 Jul 2026 11:42:48 GMT

For the better part of 20 years, there have been a big two dominating the office suite space, and only one choice for many businesses: the desktop power of Microsoft 365, or the online collaboration ease of Google Workspace.

Now prices are rising, and not everyone (least of all SMBs) can afford them. Microsoft is hiking its prices again in July 2026. There are also questions, increasingly hard to ignore, over what these providers are doing with your data, and what that means from a privacy and security perspective.

Historically, the alternative for those not using one of the big two has been a self-assembled stack sourced from multiple providers. This approach, however, can leave you with something more expensive, fragmented, and vulnerable than a single integrated platform.

The market has changed, and in 2026 your choices are less restricted.

Here’s a comparison of the main office suites in 2026: what each costs, what each includes, and what each does with your data.

How the main office suites compare

Four suites cover most of the office suite market in 2026: the two established leaders, a budget option, and a suite built on a fundamentally different architecture to any other.

That suite is Proton Workspace. Built on open source, independently audited zero-knowledge architecture which encrypts your data before it reaches Proton’s servers, Proton Workspace makes it impossible for Proton to access your data.

Whether you need a full online office suite or a desktop replacement, here’s how the four best options stack up.

N.B. Prices shown are for Business Standard tiers (annual billing) unless otherwise noted. Prices are accurate as of time of writing.

	Microsoft 365	Google Workspace	Zoho Workplace	Proton Workspace
Core apps	Word, Excel, PowerPoint, Teams, Outlook, OneDrive	Docs, Sheets, Slides, Meet, Gmail, Drive	Writer, Sheet, Show, Cliq, Mail, WorkDrive	Docs, Sheets, Meet, Mail, Drive, Calendar
Desktop apps	Business Standard+	Web only	Web only	Web only
AI assistant	Copilot (basic included; full Copilot adds $30/user/month)	Gemini (included)	Limited	Lumo (Premium only)
Data is protected from being used by AI for functionality and training	No	No	Yes (limited AI features)	Yes
Encryption	Server-side, Microsoft holds encryption keys	Server-side, Google holds encryption keys	Server-side, Zoho holds encryption keys	Zero-knowledge architecture, Proton holds no keys
VPN included	No	No	No	Yes
Password manager included	No	No	No	Yes
ISO 27001 and SOC 2 Type II certified	Yes	Yes	Yes	Yes
Jurisdiction	US (CLOUD Act applies)	US (CLOUD Act applies)	India/US (CLOUD Act applies)	Switzerland (not subject to CLOUD Act)
Base price/user/month	$14 (from July 2026)	$14 (Standard)	$6 (Professional)	~$14.25 (€12.99)
True cost/user/month	$44 with full Copilot add-on	$14+ with security add-ons	$6	~$14.25 all-inclusive
Best for	Microsoft ecosystem, desktop apps	Collaboration, UX	Budget-conscious SMBs	Privacy-first SMBs

The real cost of each office suite

This comparison table includes a ‘real cost’ row because headline prices can be misleading.

Microsoft 365 Business Standard and Google Workspace Standard both list at $14/user/month. Proton Workspace Standard costs €12.99/user/month. The differences only appear when you look at what each platform charges extra for.

Microsoft is promoting Copilot as a reason to stay on its platform. But for the full Copilot experience, you’ll need to pay an additional $30/user/month on top of the Business Standard subscription. For a 25 person team that’s $9,000 more per year.

Google won’t charge you extra for its AI. Google Workspace Business Standard includes Gemini. But if you want additional security features beyond the baseline, you’ll need Google Workspace Business Plus ($22/user), or to purchase add-ons separately.

Zoho Workplace Professional really is only $6/user/month. The trade-off is a less polished ecosystem and no zero-knowledge architecture.

Proton’s pricing is similarly transparent, but Proton Workspace Standard includes a lot more than Zoho Workplace. You get all the main office apps for €12.99/user/month, plus apps Microsoft and Google don’t include: business VPN and a password manager — all protected by zero-knowledge encryption and Swiss jurisdiction.

The privacy question most office suite comparisons skip

Who holds the encryption keys?

In other words, does your office suite provider have technical access to your documents, emails, and files?

Google, Microsoft, and Zoho all hold the keys.

Here’s why this matters: if your provider has the keys, they can access your data, whatever their stated privacy policy says — policies change. And if your provider gets breached, your data is exposed, too.

Google and Microsoft’s AI compounds the problem: Copilot and Gemini both depend on having access to your document contents to function. (In fact, Google raised its prices in 2025 to incorporate Gemini in Business and Enterprise packages.)

Data sovereignty is a third concern. Microsoft, Google and Zoho store data in jurisdictions subject to the US CLOUD Act. That means the US government can demand access to your data at any time.

Proton doesn’t hold the keys, and can never access your data, even if compelled by a court order. With Proton Workspace, you get the structural guarantee of zero-knowledge architecture, not a changeable privacy policy. Your data is encrypted on your device before it reaches Proton’s servers, and it’s stored in Switzerland, outside US CLOUD Act jurisdiction.

Proton Workspace Premium users get Lumo AI, a business AI assistant that doesn’t require access to your document contents and never trains on your data. (Zoho Workplace offers only limited AI features.)

Find out more about European businesses’ dependence on US tech and why the stakes are now higher than ever.

Proton Workspace: the only office suite with privacy by design

With Proton Workspace, teams get to use all the major office apps you’ll find in Microsoft 365 and Google Workspace: business email, calendar, enterprise cloud storage, documents, spreadsheets, video conferencing and (for Premium users) an AI assistant.

Proton’s office suite also includes two security features that the big two don’t: a business VPN that keeps your team’s connections private wherever they’re working, and a team password manage r that closes one of the most vulnerable vectors.

Finally, unlike the big two, zero-knowledge encryption applies across every Proton product by default.

For now, Proton Workspace doesn’t have a presentation app equivalent or deep legacy ERP integrations (worth knowing upfront if your business depends on complex third-party connections).

But for businesses that value data sovereignty, Proton is the straightforward choice. That’s why Proton is trusted by 100M+ users and 100,000+ businesses, including UN agencies and Fortune 500 companies.

Which office suite is right for you?

The office suite market has changed. You can now have both privacy and productivity in a single, full-stack platform that covers everything a growing SMB needs — without asking you to accept vendor access and uncertain jurisdiction as part of the deal.

Proton Workspace is the only suite in this comparison built on zero-knowledge architecture, which ensures only you can access your data. It’s about the same price as market leaders, with more essential security capabilities bundled in.

And it’s easy to get started. Migration from Microsoft 365 and Google Workspace can be self-service, or fully supported by Proton if it’s more complex, and the UX is familiar enough for your team to get started without training.

Start free trial of Proton Workspace

Gmail attachment size limit: How to send large files via email

Tom Odlin — Thu, 23 Jul 2026 11:24:25 GMT

Few things are more annoying than getting ready to send an important file only to realize Gmail won’t let it go through. Now you’re stuck troubleshooting when you should be moving on with your day.

Gmail’s size limit isn’t a dead end, though. In this guide, we’ll explain Gmail’s attachment limit, what happens when you go over it, and how to send large files more smoothly.

What is the Gmail attachment size limit?

For most people, the Gmail file size limit caps attachments at 25 MB per email. This limit applies to everything you attach, not just a single file.

If you’re on a Google Workspace account, your limit depends on your plan and what your admin has configured. Most Workspace users have the same 25 MB cap, but Enterprise Plus accounts can send attachments up to 50 MB.

What happens when you exceed the limit?

If your attachment is too big, Gmail automatically uploads the file to Google Drive and inserts the shareable link into your email. This is fine for everyday files, but if you’re sharing something sensitive like contracts or personal documents, you may want more control over where your files end up.

Most of the time, this process works without you having to do anything. However, if you’re on an older version of the Gmail app, using a mobile browser, or your Google storage is full, the upload can fail. Gmail also blocks certain file types entirely, such as .exe files, so they won’t make it through regardless of size. Luckily, there are a few other approaches to rely on.

How to send large files via email

Here are some reliable options for sending large files over email.

Compress your files

If you’re sending a batch of documents for review or a folder of images from an event, zipping them into one file keeps things organized and can reduce overall size. ZIP is the most widely supported compressed file format and works across Windows, Mac, and most mobile devices.

To create a ZIP file, select the files or folders, then:

Windows: Right-click → Compress to… → ZIP file

Mac: Control-click → Compress

It’s a simple process that doesn’t require third-party tools, but it has its limits. A 200 MB video isn’t going to shrink to 25 MB, and already-compressed formats like JPEG or MP4 will barely shrink. And if you’re sharing design files or photos, some compression tools or formats can reduce quality.

Strengths:

Works offline and without third-party tools
Multiple files and folders can be packed into a single .zip file
.zip files can be password-protected using third-party tools

Keep in mind:

You could waste time compressing large files, only to still hit the Gmail attachment limit
Compression can potentially degrade quality, which matters in some industries
Unzipping files isn’t easy on mobile
The privacy of your .zip files is limited by the security model of your email provider

Use a file transfer service

File transfer services are fast and commitment-free; you don’t need to create an account, and your files are auto-deleted after a set window. Free tiers can be generous as well, such as SwissTransfer’s 50 GB.

That said, convenience comes with tradeoffs. Free tiers often lack secure sharing features, and you typically can’t revoke access or see who downloaded your file, which are especially important in business settings.

Security also varies by provider. Many services encrypt files, but because they hold the encryption keys, they can technically access your data. Without end-to-end encryption, files may also be exposed in a server breach or corporate hack. WeTransfer, for example, operates this way and isn’t HIPAA-compliant as a result, making it a poor choice for businesses in healthcare.

For casual, non-sensitive sharing, file transfer services are fine. But if you work in a regulated industry or need to keep files private, limited access controls and oversight can create compliance and security risks. A breach of the provider’s systems could expose your sensitive data, potentially leading to fines, legal liability, or reputational damage.

Even for personal files, privacy varies widely between services. Some providers can access the files you upload and may use that data for purposes such as ad targeting or AI training.

Strengths:

No account required for most services
Quick and simple for occasional transfers
Generous size limits, even on free tiers

Keep in mind:

Limited control and oversight after sending, so you can’t track or revoke access
Provider-controlled encryption means your files may still be exposed in a server breach or unauthorized access incident
Features like password protection are often paywalled, leaving free users with fewer safeguards

Use cloud storage

Cloud storage makes sending large files easy — upload your file, generate a link, and paste it into your email.

This method makes the most sense for ongoing access, such as when sharing an assets folder with a client, or a photo album with family. There are no file size restrictions beyond your storage quota, and recipients can preview files without downloading anything.

Google Drive is the default for Gmail users since it’s already integrated, but its 15 GB of space is shared across Gmail, Drive, and Photos, so it fills up faster than you’d expect. However, there are plenty of cloud storage options available — including business cloud storage providers. Depending on your storage needs and privacy requirements, you can easily find a Google Drive alternative that better suits you.

Cloud storage providers handle privacy and security differently. Some major platforms can access the files you upload, while others use zero-knowledge encryption so only you and the people you share files with can access them. Sharing controls and security features, such as password protection, also vary between providers.

For businesses handling regulated data, choosing a provider that doesn’t meet compliance requirements under frameworks such as HIPAA or GDPR can create legal and reputational risks.

Strengths:

End-to-end encryption and advanced sharing controls from some providers
No file size restrictions within your storage quota on some services
Easy to update files and folders — edit the original, and the link stays current

Keep in mind:

Privacy and security vary greatly between providers
Free tiers tend to come with low storage, requiring constant management
Misconfigured sharing permissions can accidentally expose sensitive files to unintended recipients
Using a provider that isn’t compliant with industry regulations, such as HIPAA or GDPR, can expose businesses to legal and reputational risks

Securely send large files via email with Proton Drive

When Gmail blocks your attachment, Proton Drive lets you upload the file, create a secure sharing link, and send it by email without compromise — no size or format restrictions, no compression, and no hoping the recipient can figure out how to unzip a folder on their phone.

If privacy and control matter to you, whether you’re sharing personal photos or sending sensitive business files, most solutions fall short.

Proton Drive is built differently — all your files are protected with end-to-end encryption, meaning only you and the people you share with can access them, not even Proton has access.

You can password-protect links, set expiry dates, track downloads, and revoke access at any time. And because Proton is based in Switzerland, your data is protected by some of the world’s strictest privacy laws.

For businesses, Proton Drive can help support compliance with regulations like HIPAA and GDPR. For everyone else, it’s simply a more private way to share files online. You can get started with 5 GB of storage for free and send large files via email without worrying about limits.

How to open an Excel file online for free

Tom Odlin — Thu, 23 Jul 2026 11:00:57 GMT

Businesses rely on file sharing to exchange budgets, reports, forecasts, and other sensitive information, much of it stored in Excel spreadsheets.

When you need to open one without paying for Excel or installing Microsoft software, several free online options are available. However, as with so many free products, understanding the trade-off — convenience versus data security — is crucial.

We’ll cover common methods to open an Excel file online, their risks, and the best privacy-focused alternative to Excel.

3 ways to open an Excel file online

Option 1: Microsoft 365 (free tier)

Signing up for the free Microsoft 365 tier to open your Excel file seems like an obvious choice, but it comes with limitations.

Limited functionality: The free tier lacks advanced features, doesn’t offer offline editing, and may struggle with complex formulas or macros found in professional spreadsheets.

Data privacy concerns: Microsoft Excel files aren’t end-to-end encrypted. Microsoft controls the default encryption keys, which means it retains the technical ability to access your data and may disclose it when legally required.

Verdict: Suitable for quick, non-sensitive views, but risky for proprietary business data.

Option 2: Free online XLSX viewers

There are plenty of third-party tools available online, most of which will let you view Excel files instantly. However, relying on these “free” viewers for business data introduces serious compliance risks.

Lack of encryption: Most of these tools don’t offer end-to-end encryption, leaving your files vulnerable to interception, data breaches, and unauthorized third-party access.
Data mining: Many free services monetize their platforms by scanning content and potentially analyzing your data to train AI models or serve targeted ads.
Regulatory exposure: If your organization is subject to regulations like GDPR or HIPAA, uploading sensitive client records to an unverified, non-compliant server could create serious compliance risks.

Verdict: A convenient shortcut for public files, but a compliance nightmare for any confidential business information.

Option 3: Proton Sheets

For businesses that need to open Excel files online without compromising security, Proton Sheets offers a privacy-first approach.

Native compatibility: Proton Sheets supports native .xlsx files, ensuring your existing Excel spreadsheets open with their original formatting, formulas, and structure intact—no conversion required.

Zero-access encryption: Unlike standard cloud tools, Proton encrypts your data on your device before it leaves your computer. Even if a hacker breaches the server, the data is encrypted; not even Proton can access your data.
Secure collaboration: Teams can edit spreadsheets in real-time with the assurance that no one is scanning or mining their data.

Verdict: The only option that balances the convenience of opening Excel files online with the rigorous security required for businesses.

The best secure Excel alternative for business

When selecting business tools, the decision often comes down to a choice between convenience and privacy. While the tech giants offer robust collaboration tools, they do so at the cost of your data privacy.

Proton Sheets delivers collaborative tools without the surveillance, making it the best Excel alternative. Your team can co-author documents in real time, knowing that no one — not even Proton — is watching, listening, or learning from your data.

Compliance and data sovereignty

Proton is based in Switzerland and protects spreadsheet data with end-to-end encryption under Swiss privacy law. These safeguards help your organization maintain control over its data and support compliance with GDPR and other international data protection requirements.

How to get started with Proton Sheets

Transitioning to Proton Sheets is simple.

Create an account: Sign up for a free Proton account
Upload your file: Upload your existing .xlsx files to Proton Sheets
Open and edit: Click on the file to open it directly in Proton Sheets
Share securely: Share the file via a secure link or by inviting them via email

Don’t expose your business to unnecessary risks. Try Proton for Business and experience an end-to-end encrypted, collaborative business suite.