Proton Mail alternative: custody, not just encryption

If your objection to Proton Mail is custody rather than encryption, you are looking for a provider that writes your mail into storage you own. Proton’s cryptography is not the weak point — Proton genuinely cannot read your stored messages. The structural limit is that Proton holds the ciphertext, on Proton’s servers, under Swiss law, behind a Proton account. Nisdos Mail is built around the other arrangement: routing and encryption from a service, storage in your own S3 bucket, R2 bucket, WebDAV server or Git repository.

What is Proton Mail good at?

More than a comparison page usually admits. Zero-access encryption means mail arriving for you is encrypted with your public key before it is stored, and the private key that opens it is itself encrypted with your password — Proton holds the box and not the combination. Between two Proton accounts, messages are end-to-end encrypted by default with no key exchange and no thought required from either person.

The ecosystem is the other half of Proton’s value: Calendar, Drive, VPN and Pass on one account and one bill, with maintained first-party apps on iOS, Android, macOS and Windows, plus Bridge for anyone who wants Thunderbird or Outlook. Proton Mail has been public since 2014, its clients are open source, the apps get independently audited, and since 2024 Proton AG has been majority-owned by the non-profit Proton Foundation. That is a track record, and track record is most of what “trustworthy” means in this market.

If someone asks me for encrypted email their parents can use on a phone, I still say Proton.

Where does the Proton model stop?

At custody. Three consequences follow from the fact that Proton stores the bytes.

Access and encryption fail independently. A suspended account, a failed payment, a lost recovery phrase or a dispute costs you the interface, and encryption does nothing for a mailbox you cannot log into. The mail is safe and unavailable at the same time.

Jurisdiction is fixed at Switzerland. That is a good default by most standards, and Swiss privacy law is genuinely stricter than the US baseline. It is still one jurisdiction, chosen by the vendor. In 2021 Proton complied with a legally binding Swiss order and logged the IP address of an account under investigation, then clarified its policy language afterwards. Nothing dishonest happened — that is precisely the point. A company that holds your data answers to its own courts, and you inherit that court along with the service.

Export is a process rather than a state. Getting your archive out means running Proton’s Export Tool or Bridge against a live account and producing a copy after the fact. It works, and it is one more thing that must work at the moment you need it.

Proton Mail vs bring-your-own-storage email: what actually differs

	Proton Mail	BYOS email (Nisdos Mail)
Custody of stored mail	Ciphertext on Proton-operated servers	Ciphertext in a bucket on your own cloud account
Jurisdiction	Switzerland, set by the vendor	Whatever your storage region and operator’s country of incorporation are
Export	Export Tool or Bridge, against a live account	Nothing to export — the archive is already in your storage
Encryption keys	Your private key is stored by Proton, encrypted with your password	Per-mailbox keys; the device-custody tier generates keys in your browser and erases the provider’s copy
Own domain	Supported on paid plans	Supported; unlimited domains
Addresses	A fixed allowance per plan, more at higher tiers	Unlimited addresses and aliases
Ecosystem	Mail, Calendar, Drive, VPN, Pass; first-party mobile and desktop apps	Mail only

The last row is not a footnote. Proton is a suite; BYOS email is one component that happens to be the component you can least afford to lose.

What does bring-your-own-storage not fix?

The same things Proton doesn’t fix. Envelope metadata — who wrote to whom, when, from which relay — travels in the open between mail servers and is visible to every hop, whoever stores the result. Spam and malware filtering has to read a message, so it runs in the routing service before anything is encrypted at rest; a provider that filters your mail has seen your mail. Nisdos Mail encrypts each message with a per-mailbox key before it touches storage, which is a claim about storage, not about the moment of delivery.

Custody also hands you the failure modes. A wrong bucket policy publishes an archive. A deleted bucket deletes it. Proton’s operations team is, for most people, better at storage than they are.

Who should not switch away from Proton Mail?

Anyone whose reason for paying Proton is the bundle, and anyone buying email for people who don’t want to think about it. If Calendar and Drive in the same subscription is the value, no bring-your-own-storage product replaces that today. If you rely on default end-to-end encryption to other humans, Proton-to-Proton is where that happens without either side doing key management. And if nobody involved knows what an access key is, the honest recommendation is Proton plus a real backup habit.

The switch makes sense when a written requirement — residency, jurisdiction, or “the data stays in an account we own” — is the thing you cannot satisfy with a vendor promise.

How do you move from Proton Mail without losing anything?

Run both for a month. Set up the new mailbox on your own domain, point Proton’s forwarding at it, and leave Proton receiving in parallel so nothing depends on your DNS being right the first time. Export the Proton archive with the official tool and drop it into your storage — that copy is now sitting next to the new mail rather than in an app. When outbound sending and DMARC look clean, move your domain’s MX records over. Keep the free Proton account for the correspondents you exchange end-to-end encrypted mail with; there is no rule that says you get one provider.

Better encryption beats custody against most threats people actually face. Custody beats encryption against the one nobody plans for, which is losing the account.