SCIENCE
Proton Drive Cloud Storage 2025 Review: A Tech Journalist’s Surprising Findings!
Features
Proton Drive has taken a lead from Google Drive, and become more than just a folder that syncs between your PC and the cloud. In fact, in some places it’s very similar to Google’s offering, which means it’s easier to navigate if you’re used to the way that works, though can be less complex.
Proton Docs is a prime example of this: where Google will offer you a choice of a text file, spreadsheet or presentation when you hit the ‘new’ button, with Proton you only get the first option, but when it loads it’s quite familiar, with a formatting bar across the top, a drop-down to switch between editing, viewing and suggesting modes, and a share button at the top. And also like Google Drive, this is all free.
A free tier of Proton Drive access exists, but it’s quite limited. You can get 5GB of encrypted cloud storage and the document editor, along with a single email address and some calendars, for the grand price of £0 a month. If you want more than this – say you want to recover previous versions of files that have been over-written long ago, or need more email addresses – then you’re going to have to pay up. There’s no free trial of the paid plans, so you might want to step up to the 200GB storage option to dip a toe in the waters. The next step up is the ‘unlimited’ level, which sadly isn’t unlimited at all. It gets you 500GB of storage, which doesn’t seem a lot when you consider Google’s 2TB service is cheaper. You can also get 1TB on the Proton ‘duo’ plan, or 3TB on the Proton family plan (up to six users).
The unlimited plan also gives you access to 15 Proton Mail addresses, Proton VPN and password manager, and Proton’s Sentinel high-security program, which aims to prevent suspicious login attempts and make it harder for hackers to take over your account. If you’re a “journalist, activist, executive, or someone who deals with sensitive data and communications”, Proton recommends you use Sentinel, though it’s not on by default. For most people, a strong password and two-factor authorisation will be enough, and while Proton has its own authenticator app you can use Google’s or a different one if you already have it set up on your phone. Get locked out of your account, and you have options to recover it, including a recovery kit you can download in advance and keep safe.
Proton is very big on security, and along with Sentinel offers Dark Web Monitoring to alert you if your personal information is found in places it shouldn’t be. You also get very granular logging, showing you sign-in attempts and changes to things like account recovery, and if you’ve activated Sentinel you can see the IP address and inferred location of these. You can revoke the access of web accounts and apps that have logged in, so if you’re suspicious of an app or browser session you don’t recognise you can cut it off.
Finally there’s version history, which can be fine-tuned to keep older versions of your files for as long as 10 years if you want it to (it’s limited to seven days for the free plan), or turned off completely. These versions count toward your storage limit, so it might pay to be careful here unless you’re sure you need it.
Performance
In use, there’s little to divide Proton Drive from Google or Microsoft’s services apart from the fact it uses a different app. It’s easy to set up, though the Easy Switch system that brings auto-forwarding from Gmail and will import your contacts and calendars from Outlook, Google, Yahoo and more doesn’t extend to your files. Instead, you can quickly set up synced folders on your PC, choosing from a list of common targets such as Documents or Pictures with the ability to add your own, including those you’ve downloaded from Google Takeout. It offers on-demand sync, known here as ‘optimized storage’, which keeps your files in the cloud but visible on your device to save on local storage space, downloading them when you try to access them.
The Proton Drive app runs in the background on Windows, with the option to open at startup if you want it to, and largely won’t bother you once it’s configured unless it needs to send you a notification about someone sharing a file, which is achieved via a system of adding people directly or generating a public link. Proton’s documents have collaboration features, so multiple users can work together to edit a file, with lots of permissions and access levels so you have control over who can do what. There’s change-tracking and version control, but the fact Proton Drive only offers word processing files is a distinct limitation when compared to others – hopefully spreadsheets and graphics will make an appearance in the future.
Apps are available for Windows, macOS, iOS and Android, and you can access your files through a browser too, though the lack of a native Linux app is striking for a service built around rejecting the big tech firms. On mobile, the app can automatically back up your phone photos if you allow it to, with control over which folders get the backup treatment. Otherwise, it allows you to access the files backed up from your PC as well as any text documents you’ve created, though sadly you can’t view your backed-up photos through the PC app, only through a browser.
In use, Proton Drive doesn’t seem to be any slower than Google Drive or OneDrive. It uploaded and synced folders full of small files speedily, making sure to tell us it was encrypting them too, though performance here will be governed by the speed of your internet connection as much as anything else and the app doesn’t tell you the rate at which it’s uploading. It tells you the time since the last sync as well as how much cloud storage space is remaining, and there’s an easily accessible pause button if you want it to stop for any reason. The only annoyance came in the form of a ‘Some items failed to synchronize’ message, which doesn’t do anything when clicked on – in an ideal world it would show you the problem files, explain why they’re not syncing, and suggest ways to fix it.
More than 3,000 passwords belonging to civil servants have been exposed online since the beginning of 2024, according to new research, as experts warn it could pose a “serious risk” to national security.
A report by NordPass, using the threat exposure management platform NordStellar, found 3,014 passwords belonging to British civil servants have been leaked in the deep web – which encompasses parts of the internet that are not typically indexed by search engines– and the dark web, a small, encrypted part of the deep web that requires specific software to access and is often associated with cybercrime.
Four local authorities were named in the report as having passwords exposed online: Aberdeen City Council had 538 in total, while Lancashire County Council had 38, Newham Council had 73 and Southwark Council had 42 leaked on the dark and deep web.
It comes after The Independent revealed that hundreds of passwords and email addresses linked to UK government institutions were posted on the dark web in the last year, highlighting a major threat to UK cyber and national security. Among the most affected government departments are the Ministry of Justice with 195 exposed passwords, the Ministry of Defence (111), and Department of Work and Pensions (122).
A cyber security expert warned that the exposed sensitive data of civil servants was particularly dangerous as it could pose serious risks to the UK’s strategic interests.
Karolis Arbačiauskas, head of product at NordPass, said: “Exposure of sensitive data, including passwords, of civil servants is particularly dangerous. Compromised passwords can affect not only organisations and their employees but also large numbers of citizens. Moreover, such incidents may also pose serious risks to a country’s strategic interests.”
The report added that while the “vast majority of passwords exposed were those of employees working in regional level institutions,” the number of leaked passwords did not necessarily reflect the strength of an organisation’s internal security.
“These figures are often influenced by external factors,” said Mr Arbačiauskas. “Larger organisations, with more employees, naturally have a bigger digital footprint, which statistically increases the likelihood of credentials being exposed in a breach. In many cases, a single malware infection on an employee’s personal device or the compromise of a popular third-party website can expose dozens of accounts. Furthermore, the majority of leaks originate from external sites where employees registered using their work email addresses.”
He encouraged the practice of setting up an organisation-wide password policy, never reusing passwords, and using multi-factor authentication.
“If these passwords were not changed after their appearance on the dark web and multi-factor authentication (MFA) is not enabled, attackers could potentially access the email accounts and other sensitive information of these civil servants,” he said. “Moreover, we found hundreds of thousands of email addresses with other exposed data like names, last names, phone numbers, autofills, and cookies. This data can be exploited for phishing attacks and pose significant risks.”
It comes as the National Cyber Security Centre (NCSC) said on Tuesday that a “significant threat” posed by Chinese and Russian hackers had contributed to a record number of serious online attacks. A number of UK businesses, such as M&S, Jaguar Land Rover and Co-op have been hit by cyber attacks this year, crippling their operations and costing the firms billions.
In the year to the end of August, NCSC provided support in 429 cases, of which 204 were deemed “nationally significant incidents” – an increase from 89 in the previous 12 months. Of those, 18 were categorised as “highly significant”, meaning they had a serious impact on government, essential services, the economy or a large proportion of the UK population.
A spokesperson for Newham Council said: “It is an unfortunate reality that organisations like Newham Council will always be a target for criminals. Newham Council takes cybersecurity extremely seriously and have a number of robust measures in place to reduce risk. We regularly provide training and guidance to our staff making them aware of the risks and effective technical controls to reduce specific cyber risks. We do not comment on specific details of our cyber security controls and policies.”
An Aberdeen City Council spokesperson said: “Aberdeen City Council regularly reviews lists of compromised credentials via the National Cyber Security Centre and other official sources. These email/ password combinations are typically used to sign up on external sites or services rather than being compromised from the council’s tenant. Regardless of this all impacted account holders are contacted, and their passwords are reset as a matter of course.”
The Independent has approached Lancashire County Council, and Southwark Council for comment.
