> Source: https://souverana.ch/insights/proton-lumo-en/ > Language: en # Proton Lumo: what privacy-friendly AI looks like Proton's AI assistant Lumo 2.0 relies on open models, its own servers and encrypted chats. Two catches remain: web search and the missing API. Analysis · Published 9 Jul 2026 · Updated 21 Oct 2026 · Joel Barmettler ## What is Lumo? **Lumo is the AI assistant from Proton, the Geneva company behind Proton Mail. Proton runs open models such as GLM-5.2 only on its own servers in Europe, and not even Proton can read the chats. Two limits remain (as of July 2026): web search sends queries to external search engines, and there is no API (interface) for other software.** **In brief** - A confidential AI does not need a model of its own: Proton runs open models on its own servers in Europe, and Swiss companies can do the same. - Private AI is often assumed to be the weaker AI. GLM-5.2, the model behind Lumo, scores better than Google’s Gemini 3.5 Flash on the intelligence index from Artificial Analysis, an independent comparison test for AI models (as of July 2026). - If you are researching sensitive topics, switch off web search in Lumo. With search on, queries go to external search engines that Proton does not name. - There is not yet an API through which other software could address Lumo (as of July 2026, announced). Lumo therefore cannot be used for your own tools and business processes. At the end of June, Proton released version 2.0, with a reasoning mode (the model thinks step by step before answering), image generation, memory, a doubled context window (the amount of text the model considers at once) and improved web search. More important than any single feature, though, is the new model underneath: Lumo had been exemplary on confidentiality but too weak for daily use. GLM-5.2 closes most of that gap. In our advisory work, we rarely recommend specific products. With Lumo, we make an exception: no other service currently shows as visibly that capable AI is possible without data leaving your control. This article is the final part of our series “Provider Data-Protection Check” and the counter-model to the four large providers before it. **Series · Provider Data-Protection Check** 1. [Is ChatGPT GDPR-compliant? What OpenAI's contracts cover](https://souverana.ch/en/insights/chatgpt-dsgvo-konform/) 2. [Anthropic Claude and Swiss data protection: what to check](https://souverana.ch/en/insights/anthropic-claude-datenschutz/) 3. [Google Gemini & data protection: what SMEs need to know](https://souverana.ch/en/insights/google-gemini-datenschutz/) 4. [Using Microsoft Copilot safely: what data protection allows](https://souverana.ch/en/insights/microsoft-copilot-datenschutz/) 5. Proton Lumo: what privacy-friendly AI looks like (this part) ## Who is behind Lumo Proton was founded in Geneva in 2014 by CERN researchers and financed by crowdfunding; the company became known for the encrypted Proton Mail. Since 2024, the majority of Proton AG has belonged to a non-profit Swiss foundation whose board includes web inventor Tim Berners-Lee, among others. An acquisition against the foundation’s purpose is therefore practically ruled out. The ownership structure is part of the security question. You entrust an AI assistant with more intimate matters than any search engine; whether the provider still shares the same values in five years therefore matters too. A non-profit foundation as majority owner is one of the few answers to that question that holds up. ## What Lumo gets right The architecture is documented and consistent. Proton uses open models, including GLM-5.2 and Qwen 3.5 (Proton now also names GLM 5.3 and Apertus 1.5; the measurements further down apply to GLM-5.2), exclusively on its own servers in Europe. No prompt reaches a third-party provider; the one exception, web search, is covered below. The chat history is encrypted zero-access: only your device can read it, not Proton. According to Proton, requests are deleted after the response, metadata such as IP addresses or timestamps are never stored, and your chats are not used for training either. If you know our article on [LLM costs](https://souverana.ch/en/insights/llm-kosten/), you will recognise the principle: open models, including Chinese ones, are not a risk as long as you control where they run. Proton downloads a finished model and operates it itself. ## How strong is the model? The usual objection to private AI is: nice, but weak. With Lumo, that no longer holds.[1] > **51 points** GLM-5.2, the strongest model behind Lumo, sits nine points behind the flagship and ahead of Google's Gemini 3.5 Flash on Artificial Analysis's independent intelligence index. > > Source: Artificial Analysis, Intelligence Index v4.1, July 2026 Here is how GLM-5.2 ranks among the best-known models: **Chart: Intelligence index: open models (red) vs. proprietary (black)** *Artificial Analysis Intelligence Index v4.1* | Category | Index (points) | | --- | --- | | Claude Fable 5 | 60 | | GPT-5.5 | 55 | | GLM-5.2 (Lumo) | 51 | | Gemini 3.5 Flash | 50 | | DeepSeek V4 Pro | 44 | | Kimi K2.6 | 44 | | Mistral Medium 3.5 | 30 | Source: Artificial Analysis, Intelligence Index v4.1, July 2026 The gap further down is notable too: Mistral Medium 3.5, the strongest model developed in Europe, sits 21 points behind GLM-5.2.[1] The comparison is only half fair, because Mistral trains its own models, while Proton downloads and operates a model trained in China. That, though, is exactly the point: open models make near-top performance available to anyone [who can operate them sovereignly](https://souverana.ch/en/insights/llm-selbst-hosten/). Europe does not need to train the best model to offer confidential AI at world-class level. The same approach already exists in Switzerland: [Infomaniak, the Geneva provider](https://souverana.ch/en/insights/souveraene-ki-infrastruktur/) behind the Euria assistant, offers Kimi K2.6 through its AI API, level with DeepSeek in the chart. Here too: open model, Swiss operation. ## The first catch: web search At one point data necessarily leaves the encrypted environment: web search. When switched on, search queries go to external search engines. Proton states that it selected the providers for privacy, performance and reliability, but does not name them. From an advisory perspective, that is not enough. On sensitive topics, search queries reveal almost as much as the chat itself. If the search uses the search index of Google or Bing, part of your question travels straight to the very corporations you were trying to avoid with Lumo. Until Proton discloses the providers, the rule for confidential topics is to switch web search off, which can be done per conversation. ## The second catch: still no API Lumo is available as a web app and for iOS and Android, and recently also as a business version for teams. What is missing is an interface (API) through which other software can connect to Lumo. Proton has announced an official API for 2026, but as of July it does not yet exist. For business use, that means concretely: Lumo cannot be integrated into coding tools such as OpenCode, nor into your own business processes, products or agentic applications, in which an AI carries out several steps on its own. Lumo is an assistant for people and cannot be built into systems. The unofficial API wrappers from the community are not suitable for sensitive data, because they fall outside the guarantees that are the reason for choosing Lumo. Once the API arrives, its pricing model will decide how useful it is. For agentic tools, prompt caching matters most. Coding assistants send the same context hundreds of times, and without discounted cache hits, that becomes expensive fast (the maths is in our article on [LLM costs](https://souverana.ch/en/insights/llm-kosten/)). If the API arrives with discounted cache hits, Lumo also becomes interesting as a component: for coding tools such as OpenCode, with GLM-5.2 as the engine, entirely on sovereign infrastructure. ## What this means for your company For individuals, Lumo is today a clear recommendation. For companies, it is two things: a good tool for employees who need a confidential assistant, and above all, evidence that the approach works. The pattern behind Lumo, top-tier open models on controlled European infrastructure, is one you can adopt for your own AI: with your own data, your own tools and an API that belongs to you. Want to operate open models sovereignly, with interfaces for your own processes? [AI architecture & solution selection](https://souverana.ch/en/leistungen/ki-architektur/) The four parts before this one review OpenAI, Anthropic, Google and Microsoft against the same grid. ## Sources [1] Artificial Analysis. «Artificial Analysis Intelligence Index v4.1». Artificial Analysis. July 2026. Unabhängiger Modellvergleich, Sekundärquelle (keine URL im Artikel). The author Joel Barmettler AI Architect · Souverana, Zurich Joel Barmettler guides Swiss companies from AI strategy to integration: sovereign, confidential and production-ready. He built the Swiss AI Hub as its architect and today co-owns its architecture; he personally leads every Souverana mandate. Mandates from one-person firms to Fortune 500 corporations. [Book an intro call](https://meet.brevo.com/joel-barmettler/30-minute-meeting) [More about Souverana](https://souverana.ch/en/) [LinkedIn](https://www.linkedin.com/in/joel-barmettler-b9ab361b7) ## Frequently asked questions What is Lumo? Lumo is Proton's private AI assistant, from the Geneva company behind Proton Mail. Version 2.0 (end of June 2026) added reasoning (step-by-step thinking), image generation, memory and better web search. Proton runs freely available models on its own servers in Europe. Chats are zero-access encrypted (only your device can read them), unlogged and not used for training. How privacy-friendly is Lumo, really? The architecture is built for confidentiality: its own European servers, zero-access-encrypted chats, no logs, no training on user data, and the majority is held by a non-profit foundation. The documented exception is web search. When it is switched on, search queries go to external search engines that Proton does not name. Which AI model powers Lumo? Proton names the models it uses publicly: among others GLM-5.2 and Qwen 3.5 (now also GLM 5.3 and Apertus 1.5), freely available models that run exclusively on Proton's servers. GLM-5.2 scores 51 points on the Artificial Analysis Intelligence Index, an independent comparison test for AI models (as of July 2026), placing it ahead of Google's Gemini 3.5 Flash. Does Lumo have an API? No. As of July 2026 there is no official interface (API) through which other software could address Lumo; Proton has announced a Lumo API on its roadmap. Until it appears, Lumo cannot be integrated into your own applications, coding tools or business processes. It can only be used through the apps and the browser. ## Glossary - **API**: A programming interface through which software addresses a language model directly, without a chat interface. Usually billed per token. - **Context window**: The amount of text, in tokens, that a language model can take into account in one request, input and answer combined. Anything beyond it is invisible to the model. - **Prompt**: The input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost. - **Zero-access encryption**: Data is encrypted so that only your device can read it. Even the provider has no access, whether it wanted it or was compelled to hand it over. - **Agentic**: AI applications that work in multiple steps, on their own: they plan, call tools and repeat steps until the task is done. In doing so they send the same context many times over. - **Prompt caching**: The provider stores prompt segments it has already processed. If the application sends the same context again, those tokens cost only a fraction of the normal price. - **Cache hit**: A hit means the start of a request is already in the cache and does not have to be computed again. The hit rate is the share of the input that comes from the cache.