Proton Lumo: what privacy-friendly AI looks like

What is Lumo?

Lumo is the AI assistant from Proton, the Geneva company behind Proton Mail. Proton runs freely available models such as GLM-5.2 only on its own servers in Europe, and not even Proton can read the chats. Two limits remain (as of July 2026): web search sends queries to external search engines, and there is no API, meaning an interface for other software.

In brief

• You can adopt the pattern behind Lumo for your own AI: open models?Open weightModels whose weights are publicly available and may be self-hosted (e.g. Apertus, DeepSeek, Llama). A precondition for sovereign operation without vendor lock-in. that a company downloads, operates itself and hosts in Europe.
• Private AI is often assumed to be the weaker AI. GLM-5.2, the model behind Lumo, scores better than Google’s Gemini 3.5 Flash on the intelligence index from Artificial Analysis, an independent comparison test for AI models (as of July 2026).
• If you are researching sensitive topics, switch off web search in Lumo. With search on, queries go to external search engines that Proton does not name.
• There is not yet an API?APIA programming interface through which software addresses a language model directly, without a chat interface. Usually billed per token. through which other software could address Lumo (as of July 2026, announced). Lumo therefore cannot be used for your own tools and business processes.

At the end of June, Proton released version 2.0, with a reasoning mode (the model thinks step by step before answering), image generation, memory, a doubled context window?Context windowThe amount of text, in tokens, that a language model can take into account in one request, input and answer combined. Anything beyond it is invisible to the model. (the amount of text the model considers at once) and improved web search. More important than any single feature, though, is the new model underneath: Lumo had been exemplary on confidentiality but too weak for daily use. GLM-5.2 closes most of that gap.

In our advisory work, we rarely recommend specific products. With Lumo, we make an exception: no other service currently demonstrates as visibly that capable AI without data leaving your control is possible.

This article is the final part of our series “Provider Data-Protection Check” and the counter-model to the four large providers before it.

Who is behind Lumo

Proton was founded in Geneva in 2014 by CERN researchers and financed by crowdfunding; the company became known for the encrypted Proton Mail. Since 2024, the majority of Proton AG has belonged to a non-profit Swiss foundation whose board includes web inventor Tim Berners-Lee, among others. An acquisition against the foundation’s purpose is therefore practically ruled out.

The ownership structure is part of the security question. You entrust an AI assistant with more intimate matters than any search engine; whether the provider still shares the same values in five years therefore matters too. A non-profit foundation as majority owner is one of the few answers to that question that holds up.

What Lumo gets right

The architecture is documented and consistent. Open models are used, among others GLM-5.2 and Qwen 3.5 (Proton now also names GLM 5.3 and Apertus 1.5; the measurements further down apply to GLM-5.2), exclusively on servers that Proton itself controls, in Europe. No prompt?PromptThe input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost. lands with a third-party provider; the one exception, web search, comes further below. The chat history is encrypted zero-access?Zero-access encryptionData is encrypted so that only your device can read it. Even the provider has no access, whether it wanted it or was compelled to hand it over.: only your device can read it, not Proton. According to Proton, requests are deleted after the response, metadata such as IP addresses or timestamps are not stored in the first place, and your chats are not used for training either.

If you know our article on LLM costs, you will recognise the principle: open models, including Chinese ones, are not a risk as long as you control where they run. Proton downloads a finished model and operates it itself.

How strong is the model?

The usual objection to private AI is: nice, but weak. With Lumo, it is no longer correct.

Key figure

51 points

Source: Artificial Analysis, Intelligence Index v4.1, July 2026

Here is how GLM-5.2 ranks among the best-known models:

The gap further down is notable too: Mistral Medium 3.5, the strongest model developed in Europe, sits 21 points behind GLM-5.2. The comparison is only half fair, because Mistral trains its own models, while Proton downloads and operates a model trained in China. That, though, is exactly the point: open models make near-top performance available to anyone who can operate them sovereignly↗Local Inference · Part 1Self-hosting an LLM: GPT-5 performance for CHF 8’500A machine with two graphics cards (RTX 4090), around CHF 8’500, three weeks of measurements. Which tasks a machine of your own handles, which it does not, and where the limit sits.Read article. Europe does not need to train the best model to offer confidential AI at world-class level.

The same approach already exists in Switzerland: Infomaniak, the Geneva provider↗Sovereign AI · Part 3Sovereign AI infrastructure: why the model is the easy partThe language model is the easiest part of your AI to swap. What ties you to one provider are the models that read your documents and make them searchable (OCR and embeddings). Which Swiss hosters offer every component.Read article behind the Euria assistant, offers Kimi K2.6 through its AI API, level with DeepSeek in the chart. Here too: open model, Swiss operation.

The first catch: web search

At one point, data necessarily leaves the encrypted environment: web search. When switched on, search queries go to external search engines. Proton states that it selected the providers for privacy, performance and reliability, but does not name them.

From an advisory perspective, that is not enough. On sensitive topics, search queries reveal almost as much as the chat itself. If the search uses the search index of Google or Bing, part of your question travels straight to the very corporations you were trying to avoid with Lumo. Until Proton discloses the providers, the rule for confidential topics is to switch web search off. It can be switched off per conversation.

The second catch: still no API

Lumo is available as a web app and for iOS and Android, and recently also as a business version for teams. What is missing is an interface (API) through which other software can address Lumo: Proton has announced an official API for 2026; as of July, it does not exist yet.

For business use, that means concretely: Lumo cannot be integrated into coding tools such as OpenCode, nor into your own business processes, products or agentic?AgenticAI applications that work in multiple steps, on their own: they plan, call tools and repeat steps until the task is done. In doing so they send the same context many times over. applications, in which an AI carries out several steps on its own. Lumo is an assistant for people and cannot be built into systems. The unofficial API wrappers from the community are not suitable for sensitive data, because they fall outside the guarantees you choose Lumo for in the first place.

Once the API arrives, its pricing model will decide how useful it is. For agentic tools, prompt caching?Prompt cachingThe provider stores prompt segments it has already processed. If the application sends the same context again, those tokens cost only a fraction of the normal price. matters most. Coding assistants send the same context hundreds of times, and without discounted cache hits, that becomes expensive fast (the maths is in our article on LLM costs). If the API exists and cache hits are discounted, Lumo also becomes interesting as a component: for coding tools such as OpenCode, with GLM-5.2 as the engine, entirely on sovereign infrastructure.

What this means for your company

For individuals, Lumo is today a clear recommendation. For companies, it is two things: a good tool for employees who need a confidential assistant, and above all, evidence that it works. The pattern behind Lumo, top-tier open models on controlled European infrastructure, is one you can adopt for your own AI: with your own data, your own tools and an API that belongs to you.

The four parts before it review OpenAI, Anthropic, Google and Microsoft against the same grid.

Looking for an AI assistant your employees can trust with confidential material too?

The usual objection is that private AI is the weaker AI. That assumption is no longer correct. GLM-5.2, the model behind Proton's Lumo, scores 51 points on the Artificial Analysis Intelligence Index v4.1, an independent comparison test for AI models (as of July 2026), ahead of Google's Gemini 3.5 Flash and nine points behind the flagship.

It runs on Proton's own servers in Europe: chats encrypted so that only your device can read them, no logs, no training on user data, majority owned by a non-profit Swiss foundation. Two limits remain. With web search switched on, queries go to external search engines that Proton does not name. And an official interface (API) is still missing, so Lumo is an assistant for people and cannot be built into systems.

Our conclusion concerns the pattern behind the product: Proton downloads an open model and operates it itself. Proton does not train a model of its own for this. Swiss companies can do exactly the same, with their own data and an interface that belongs to them. The Swiss hosting provider Infomaniak shows how, with the open model Kimi K2.6.

The article covers the sovereignty grid for Lumo and six questions you should ask every assistant your team wants to use. Link in the comments.

#AI #DataProtection #Proton #Switzerland