Proton Lumo Review (August 2026): Private AI for Teams That Can't Send Data to OpenAI

Most AI-assistant reviews argue about which model writes the better email. That is the wrong question for a large slice of professional buyers. If you handle protected health information, EU personal data, or client files covered by a confidentiality clause, the real question is whether you are allowed to paste that text into a chatbot at all. Proton Lumo is built for exactly that reader, and Lumo 2.0, which shipped June 30, made it good enough to actually use for work rather than just admire for its principles (TechCrunch).

Here is the call before the detail. If your data can legally live on OpenAI or Anthropic servers, keep ChatGPT Plus or Claude Pro; Lumo is a hedge, not an upgrade. If it cannot, Lumo is the only mainstream AI assistant that pairs zero-access encryption with HIPAA, GDPR, and ISO 27001 certifications, and that combination has no direct competitor in the category (proton.me/lumo). We rate it 4.0. What holds it back is not the product, which got meaningfully better this summer, but the size of the audience it fits and a couple of hard limits we cover below.

What Lumo 2.0 actually does

Lumo launched in July 2025 as a privacy-first chatbot that early users liked for its stance and criticized for being weak and over-restrictive. One poster on the r/lumo forum summed up the old version as "not bad, but it's also not good," per Cybernews. Version 2.0 is the answer to that complaint, rebuilt on a new architecture rather than tuned.

The headline number is speed. Lumo 2.0 responds to most queries up to 76% faster than the prior version, according to Proton via TechCrunch. Speed is not a rounding detail on a privacy tool, because the usual tax for private inference is latency, and a slow assistant is one you stop opening.

Four capability changes matter for operator work:

A thinking mode that runs multi-step reasoning before answering, for harder questions where the first token out is usually wrong (TechCrunch).
Image recognition and generation. You can upload a screenshot or a chart and ask Lumo to read it, or generate imagery from a prompt (TechCrunch).
Projects with user-controlled persistent memory. A Project is a workspace where you load documents, pull in files from Proton Drive and Proton Mail, and let Lumo remember your preferences across sessions (TechCrunch).
Web search with live source citations, so answers about current events point back to where they came from (Cybernews).

Under the hood, Lumo does not run a proprietary Proton model. It uses a mix of open-source foundation models, currently Qwen 3.5 and GLM 5.2 for text plus Image-Turbo and FireRed-Image-Edit-1.1 for images, all running on servers Proton controls in Europe, per Cybernews. The service is open source, so outside researchers can inspect the code behind the privacy claims rather than take them on faith.

Proton has kept shipping since the 2.0 launch, which is the reason we are reviewing it now rather than in June. On August 5, Lumo gained the ability to turn a dataset into charts and graphs inside the chat, so you can drop in a financial report or a sales pipeline and get visuals back without the data leaving the encrypted session (Releasebot). The wider suite moved too: Proton Pass 1.39.0 added Bitwarden rule imports on August 11, and the Proton VPN browser extension hit 1.3.6 on August 12 (Releasebot). This is an active product, not a banner someone forgot to take down.

How it stacks up against ChatGPT Plus and Claude Pro

For the tasks our readers actually run, drafting, research, and summarizing vendor docs, the honest framing is "close enough on most, behind on the hard stuff." TechCrunch, testing the public version, called Lumo "roughly equivalent to other major chatbots in terms of usefulness," answering in a similar format to Gemini and ChatGPT with about the same level of detail (TechCrunch). Proton CEO Andy Yen goes further, claiming "the gap has closed to the point that for many use cases, users can no longer perceive a qualitative difference between Lumo 2.0 Max and the latest models from OpenAI and Anthropic," per Cybernews. Treat that as a vendor claim, because it is one. There is no independent benchmark backing it, and open-source models like Qwen and GLM, capable as they are, still sit a step behind GPT-5.5 and Claude Opus 4.8 on the reasoning-heavy work where the model gap is the whole point.

Where does that leave a real workflow? Everyday drafting and rewriting is a wash. Summarizing a long vendor contract or a pile of support tickets is a wash, and Projects plus thinking mode make Lumo genuinely useful there. Multi-step technical reasoning, dense code generation, and long-context agentic runs are where you feel the difference, and those go to Claude or GPT.

To try Lumo on your own work, the setup that matters is a Project, not the one-off chat box. Open the Lumo web or mobile app, start a new Project, and use Add files to pull a document in from Proton Drive or upload it directly. Then work against it. Two prompts that show the shape of what it does well:

Summarize the attached vendor MSA in 8 bullets. Flag any clause on
data retention, sub-processors, or auto-renewal, and quote the exact
sentence for each flag so I can find it in the source.

Turn on thinking mode for anything with more than one step:

[thinking mode] We have 5 people and handle EU customer PII. Compare
keeping ChatGPT Plus vs moving to Lumo for Business on privacy exposure
only. List the specific data-flow risks each option removes or adds.
Do not recommend a purchase; just map the risks.

On those two tasks the output lands close to what a strong mainstream chatbot returns, and the contract text never leaves an encrypted session or gets logged. That is the trade you are actually buying.

One structural limit shapes everything: Lumo has no public API or CLI. You cannot script it, drop it into an agent loop, or wire it into a pipeline the way you can with the OpenAI or Anthropic APIs. For a privacy tool that is partly the point, since an API is another surface where data leaks, but it also means Lumo is a place you go to work, not infrastructure you build on. If automation is load-bearing for your team, Lumo is not the answer and no amount of certification changes that.

The pricing decision: which plan fits which buyer

There are three ways to get Lumo, and the right one depends on whether you want the assistant alone, the assistant inside the wider privacy stack, or a team-managed deployment. Prices below are current as of August 14, 2026.

Plan	Price (USD)	What you get	Source
Free Lumo (inside Proton Unlimited)	$9.99/user/mo billed yearly ($119.88/yr)	Full Proton stack: 500 GB storage, Mail, VPN, Drive, Pass, plus Lumo at the free tier's capped usage	proton.me/pricing
Lumo Plus	$12.99/mo, or $9.99/mo billed yearly (about $120/yr)	Lumo only: more Max-model usage, unlimited chats and Projects, unlimited Custom Lumos	proton.me/lumo/pricing
Lumo for Business (Professional)	About $14.99/user/mo	Team seat management, admin controls, and organizational security on top of Lumo Plus features	proton.me/business/lumo/pricing

Read the free tier honestly. Proton Unlimited includes Lumo, but at the free plan's limits: capped Max-model usage, capped messages and chat history, capped image generations, and one Project, per proton.me/lumo/pricing. For light, occasional drafting that ceiling is fine. Lean on it daily and you will hit the wall, at which point Lumo Plus at $12.99/mo unlocks unlimited chats and Projects (proton.me/lumo/pricing).

Now the math for a five-person team, which is where the paths separate:

Everyone on Proton Unlimited: five seats at $9.99/mo billed yearly is $49.95/mo, or roughly $600/yr, and every seat also gets VPN, encrypted mail, 500 GB of Drive, and Proton Pass (proton.me/pricing). Lumo comes along at free-tier limits. This is the best value if the team wants the whole stack and only touches Lumo lightly.
Everyone on Lumo Plus: five seats at $12.99/mo is $64.95/mo for the assistant with no caps and none of the other Proton products (proton.me/lumo/pricing). This only makes sense if you already have your email, VPN, and storage sorted elsewhere and just want private, uncapped AI.
Everyone on Lumo for Business: five seats at about $14.99/user/mo is roughly $74.95/mo, and it adds the admin console, per-seat management, and audit surface a compliance officer will ask for (proton.me/business/lumo/pricing).

Against the alternatives, the comparison is stark on price. ChatGPT Plus runs $20/mo per user (openai.com) and Claude Pro is $20/mo, or $17/mo billed annually (claude.com/pricing). Five seats of either is $100/mo, well above any Lumo path. You are paying more for a stronger general-purpose model and giving up the encryption and certifications. That is the trade in one line.

Certifications get waved around as trust badges. What they do in practice is narrow.

GDPR compliance means Lumo can process the personal data of people in the EU without you personally shouldering the "did I just violate data-residency rules" risk, because conversations run on European servers under Swiss privacy law and are not subject to US data collection requests (Cybernews). HIPAA readiness means a covered entity, a clinic, a billing service, a telehealth startup, can put protected health information through it under a business associate relationship, which is a line you cannot cross with a consumer ChatGPT account. ISO 27001 is the audited proof that Proton runs a real information-security management system, the kind of certificate a procurement team demands before signing (proton.me/lumo).

Underneath all three sits the actual mechanism: zero-access encryption. Data is encrypted in transit and at rest so that only you hold the keys, Proton retains no server-side logs of sessions, and nobody at the company can read your conversations, per TechCrunch. Proton also commits to never training on customer data or sharing it with third parties. A certification tells you a process was audited; zero-access encryption is the architecture that makes the promise enforceable rather than a policy someone can quietly change.

There is a second reason this vendor is worth watching if you run AI agents. In May 2026, Proton Pass added AI access tokens, a way to hand an agent scoped, expiring, and auditable access to specific credentials rather than pasting a permanent password into a prompt, per Help Net Security. Tokens are read-only, can be set to expire from one hour to one year, and require the agent to state a reason for each request. Pass Plus is bundled into Proton Unlimited, so if you are already on that plan the credential-token machinery is sitting there for the day your automations need it.

Who should buy Proton Lumo

Split it by who you are, because Lumo is a clear yes for some readers and a clear no for others.

Solo operator handling sensitive client work: get Proton Unlimited at $9.99/mo billed yearly (proton.me/pricing). You get the whole privacy stack plus a private assistant for drafting and summarizing anything you would not paste into ChatGPT. Move up to Lumo Plus only when the free tier's caps start interrupting you, not before.

Compliance-bound small team, three to fifteen people: go straight to Lumo for Business at about $14.99/user/mo. The seat management and audit trail are the difference between "we use a private AI" and "we can show an auditor how it is governed," and for a team touching HIPAA or GDPR data that documentation is the whole reason you are here (proton.me/business/lumo/pricing).

Team that wants private AI but already runs its email and VPN elsewhere: buy Lumo Plus standalone at $12.99/mo per seat (proton.me/lumo/pricing) and skip the bundle. You are paying for the assistant and nothing you would double up on.

Reader who only needs the network layer private: you do not need Lumo at all. Proton VPN covers the connection, and you can keep whatever assistant you already trust for non-sensitive work.

Everyone else, whose data can legally sit on OpenAI or Anthropic infrastructure: keep ChatGPT Plus or Claude Pro. They are stronger on hard reasoning, they have APIs, and at $20/mo each (openai.com/chatgpt/pricing, claude.com/pricing) they are competitive. Lumo is your fallback for the occasional document you should not upload to them, and the bundled free tier inside Proton Unlimited already covers that case without a second subscription.

The 4.0 rating measures Lumo 2.0 as it stands in August 2026. It is a real product doing a real job that no mainstream competitor does, and the summer's updates closed most of the capability gap for everyday work. The half-point-and-change below the top comes from the narrow audience, the capped free tier, and the missing API, not from anything Proton got wrong. For the reader who cannot legally use ChatGPT, that reader now has a private assistant good enough to actually work in, and that was not true a year ago.