I asked ProtonVPN support a few questions, and they responded. I’m leaving these messages here for anyone interested in Proton AG.
It’s a shame Proton didn’t start from scratch to create a protocol, since trust comes from the ground up, not by default. Well, if they chose that path, as support told me, it’s the decision of those within the company.
My first message
Hello. I have a few questions since I’m currently using ProtonVPN, and I’d appreciate it if you could answer them honestly:
1. Why are the virtual servers in Latin America located in the United States rather than within Latin America itself? It would be more beneficial and result in lower latency.
2. Do all servers have real, artificial, or merely apparent DDoS protection?
3. Have you considered using a different provider instead of m247 and DataPacket to avoid detection of repeated usage?
4. Do you have plans to develop a completely unique and powerful proprietary protocol that isn’t WireGuard, etc.?
5. What is the main reason behind having so many servers? Why, and what are the benefits for all users?
I look forward to your response.
Best regards.
Support’s response
Hello,
Thank you for reaching out.
-
Virtual servers are sometimes hosted outside the country they represent because of infrastructure, reliability, and security constraints. In some regions, including parts of Latin America, it can be difficult to guarantee the same level of physical security, network quality, or uptime as in more established data center locations. By hosting the infrastructure in more stable environments while still assigning local IP addresses, the service can provide better overall performance and availability. That said, this can sometimes result in higher latency compared to physically local servers. You can find more information about our Smart Routing feature at this link https://protonvpn.com/support/how-smart-routing-works
-
All servers have baseline protection against common network-level attacks, including DDoS mitigation provided at the infrastructure level. This isn’t something that’s marketed as a specialized or “bulletproof” feature on every single server, but rather a standard layer of protection built into the network and hosting providers to maintain service stability.
-
Infrastructure providers are selected based on a mix of performance, reliability, jurisdiction, and security standards. Detection by third-party services is an ongoing challenge across the entire VPN industry, regardless of provider. Changing providers alone doesn’t solve that problem long-term, so the focus is usually on maintaining a diverse and resilient network rather than relying on any single approach. We use a combination. Some of our servers and networks are fully owned and controlled by us while others utilize third parties as we don’t have facilities in every country. When we rent servers and network, we only utilize trusted data centers that meet all of our security criteria and are able to provide us with full access to the server itself, and we only use bare metal servers. All of our servers also utilize full-disk encryption so that no third-party can extract data off of them even if they have physical access to the hardware.
-
Most modern VPN protocols like WireGuard are open-source and widely trusted because they’ve been extensively audited and tested. Building a completely proprietary protocol isn’t necessarily an advantage from a security standpoint, since transparency and peer review are key factors in trust. Improvements are typically made on top of existing protocols (for example, custom implementations or enhancements) rather than replacing them entirely.
-
Having a large number of servers helps distribute user load, which improves speed and stability, especially during peak times. It also gives users more options in terms of locations, which can help with latency, access to region-specific services, and redundancy if certain servers become congested or unavailable. Overall, it contributes to a more consistent experience for a wide range of users.
Let me know if you have additional questions.
My second message in response
Hi Lorenzo.
1. I understand the situation and the points you’ve raised based on your interest. However, whether or not the Proton team is aware of the nature of the United States, including the system known as the “NSA,” were they aware that they contradict their own claims? This isn’t about being paranoid regarding privacy and security, but rather about the reality itself, because not all countries are subservient to the US, or as some say, its backyard. Did they consider any specific, more concrete alternative countries for those of us who depend on latency, even with different carriers?
2. Regarding DDoS protection, do you have a specific article on your website, and if possible, one that is transparent and verifiable for people like me who are looking to increase their confidence based on their situation, but not a fixed amount? In any case, it would be helpful if you could write a specific and easy-to-understand article, especially for non-technical users, that is, one that integrates methods that are easy to understand.
3. Understood. I have some questions: What happens when a trusted provider, based on your terms, betrays you in a specific location, such as the United States or Portugal? Do you break trust universally or only partially in specific locations? For example, if Datacamp goes against Proton’s trust in the United States or the United Kingdom, with or without notification, how would you react in both scenarios? Would you completely abandon the provider in all countries, or only partially? Would you even publicly notify people about the case?
4. While Wireguard certainly has its strengths, haven’t you considered building a unique tool that is not dependent on third parties but is much more reliable, stable, robust, doesn’t require frequent updates, is transparent, and has other advantages? Of course, this requires commitment, time, and more resources, but you could try it. This would avoid the copy-and-paste approach that others in the industry often adopt. The word “unique” reveals more than what it actually is.
5. The official ProtonVPN website mentions a high number of servers and bandwidth, which raises a few questions for me: Is each Bera Metal server unique and does it have 1GB of bandwidth, some with 10GB, or is it destructible between servers to prevent saturation? Are there virtual systems that allow each person to have a server on the same Bera Metal hardware, or is that not possible, or does it depend on the situation? I’ve noticed that some servers have similar bandwidth usage levels to others.
I look forward to your response.
Regards.
Support’s second response
Hello,
Thank you for the follow-up.
Sorry for taking up longer to respond. I wanted to fully address everything that you said in your previous response.
You raise a valid point about the tension between having servers in certain countries and Proton’s privacy commitments. Our team is absolutely aware of this, which is precisely why Secure Core exists. Secure Core routes your traffic through privacy-friendly jurisdictions (Switzerland, Iceland, and Sweden) before it reaches servers in countries with weaker privacy protections, like the US or UK. This way, even if an exit server in the US were somehow compromised, the attacker would only see encrypted traffic coming from a Secure Core server in Switzerland, not your real IP or activity.
Secure Core adds extra hops by design, which can impact speed. That’s a genuine tradeoff between maximum privacy and performance. For users who need lower latency and are comfortable with the risk profile of a particular country, connecting directly to a server in that country (without Secure Core) is always an option. Proton also offers VPN Accelerator, which can boost speeds by up to 400% even on distant connections, and servers with up to 10 Gbps bandwidth. I don’t have specific information about plans for alternative server locations specifically designed for latency-sensitive users in non-US-aligned regions, but I’d recommend checking the Proton VPN server page for the latest available locations.
Proton VPN includes built-in DDoS protection that is automatically applied to all connections. The network is equipped with anti-DDoS hardware and traffic-scrubbing services that detect and filter volumetric attacks before they reach your tunnel, all without logging or inspecting your encrypted traffic.
While we don’t have such an article for Proton VPN, we do have a blog post on DDoS protection related to Proton Mail at this link Guide to DDoS protection | Proton . This article walks through the key considerations (understanding legitimate traffic, infrastructure isolation, collateral damage, and not compromising privacy), explains the technical approach (BGP redirection, GRE tunnels, scrubbing centers), and even shares real attack data. It’s written in a way that should be accessible even for non-technical readers.
If a provider were found to be actively compromising user privacy in one location, Proton would likely remove servers from that specific facility at minimum. As for public notification, we have historically been transparent about security matters (their transparency reports and public disclosures of legal requests demonstrate this), so I would expect them to inform users if a serious trust violation occurred.
The idea that true independence means building from scratch rather than relying on third-party foundations. Interestingly, Proton has already taken a step in this direction with its proprietary Stealth protocol, which builds on WireGuard’s core but adds traffic-obfuscation layers to make VPN packets look like ordinary HTTPS traffic, helping users bypass deep-packet-inspection blocks in censored regions.
However, building an entirely new VPN protocol from the ground up is a massive undertaking that comes with its own risks. WireGuard has been rigorously audited, formally verified, and battle-tested by the broader security community over years. A custom protocol, no matter how well-intentioned, would start without that same level of external scrutiny. There’s a real security advantage in using something that thousands of independent researchers have already tried to break. The history of cryptography is full of custom solutions that turned out to have subtle flaws that only emerged years later.
What we have done instead is take the best of both worlds: use WireGuard as the proven cryptographic foundation, and then innovate on top of it with things like Stealth, Smart Protocol, and VPN Accelerator.
Regarding whether servers are truly “bare metal” or virtualized, Proton has invested heavily in owning and controlling its own server hardware and network infrastructure, particularly for its Secure Core servers and its primary infrastructure in Switzerland and Germany. These data centers use fully encrypted hard disks with multiple password layers, and physical access requires biometric authentication. However, for the broader network of servers across 120+ countries, Proton does work with vetted datacenter providers, and in those cases, the servers are dedicated machines provisioned for Proton’s exclusive use, not shared virtual instances where random customers could coexist on the same hardware.
The similar bandwidth usage patterns you’ve noticed across some servers likely reflects Proton’s load-balancing approach, which distributes users across available servers to prevent any single server from becoming saturated. This is by design and actually works in your favor, as it means no server becomes a bottleneck.
I hope this addresses your questions meaningfully. If any of these topics deserve deeper exploration, or if you’d like me to look into something more specific, please don’t hesitate to follow up.
Kind regards,
Lorenzo
Customer Support
Proton VPN
It appears that Proton is aware of these situations; I will send them another email notifying them of this.
End.
Probable vulnerability: In the privacy policy using the application on Android, it uses tokens to connect to AdGuard servers and the application reveals the tokens in the session called: diagnostic data. Here, two questions arise for me: is it possible to connect to the AdGuard servers with the modified protocol published by the same company using the tokens? What happens if someone malicious manages to infiltrate the system no matter where, how, etc., captures the tokens and makes malicious use on behalf of the account owner?