Proton VPN review: what the app installs, who it talks to, and whether it leaks

Who this is for

Proton VPN suits people who want a VPN that does what it says and nothing else on their computer. In four days of testing on Windows 11 the app installed only what it needs, did not phone home to anyone but Proton, and did not leak in normal use. The free plan is usable on its own.

If you need protection even when the VPN software itself crashes, switch the kill switch to Advanced after installing. The default is off, and the Standard mode did not cover that case in our test.

We tested the free plan, version 5.1.8, from 25 to 28 October 2026, in a Windows 11 virtual machine on an EU internet connection. Paid-only features (NetShield ad blocking, Secure Core, streaming) are not covered here yet.

What it installs

We took a full snapshot of the system before installing and after, and compared them.

Installing through the official installer (verified hash, signed by Proton AG, Geneva) added:

• ProtonVPN Service, a Windows service set to manual start;
• ProtonVPNCallout, a driver that hooks into the Windows firewall (this is how the kill switch blocks traffic);
• the Microsoft Visual C++ 2022 runtime, which many other programs share;
• the program folder C:\Program Files\Proton;
• on first connection, a network adapter called ProTUN and the WireGuard Wintun driver behind it.

It did not add startup tasks, browser extensions or root certificates. Three new root certificates did appear during testing, but Windows event logs show they came from Windows’ own automatic certificate updates, not from Proton.

Who it talks to

We logged every outgoing connection with Windows firewall auditing while the app was open, logged in and not connected, for 15 minutes.

There was one: an HTTPS call to 185.159.159.148, an address registered to Proton AG in Switzerland, preceded by the app looking that server up through our normal DNS. We saw no analytics, crash-reporting or advertising services.

While idle the app used about 550 MB of memory in total, about 400 MB of that in the app window’s process. CPU use was low: 11 seconds over 15 minutes.

Proton VPN 5.1.8550 MB

ZeroTier One 1.16.240 MB

Leaks

Connected to a free server in the US over WireGuard, we checked what the outside world could see:

• IP: three independent IP-check services all saw the VPN’s address.
• DNS: Windows sent queries to Proton’s resolver inside the tunnel, and Google’s resolver saw a Proton address, not ours.
• WebRTC: we sent STUN requests, the mechanism browsers use for WebRTC, to Google and Cloudflare. Both saw the VPN address.
• IPv6: our connection has no IPv6, so we could not test this.

No leaks.

Kill switch

This is where Proton loses points. We sent a request every 0.3 seconds for two minutes while breaking the connection in different ways, and counted any request that left with our real IP.

What we did	Kill switch	Result
Disabled the network for 15 s	Off (default)	No leak
Disabled the network for 15 s	Standard	No leak
Force-closed the app window	Standard	No leak
Force-killed the VPN service	Off	Leaked for ~8 s
Force-killed the VPN service	Standard	Leaked for ~9 s (twice)
Force-killed the VPN service	Advanced	No leak, but no reconnect within 100 s

A crashing service is rare in daily use, but it is exactly the case a kill switch exists for. With Standard, the firewall rules go away with the service, and traffic flows outside the tunnel until the app restarts it. Advanced keeps everything blocked outside the VPN, which worked, though we had to reconnect by hand.

What it leaves behind

The uninstaller finished in 3 seconds and restored the internet even though the Advanced kill switch had been on. It removed the app, the service, the firewall driver, the ProTUN adapter and all 40 of its firewall rules.

Left behind:

• the Wintun driver (WireGuard LLC, Microsoft-signed, stopped);
• an empty folder in AppData\Local\Proton and an empty registry key HKLM\SOFTWARE\Proton AG;
• the shared Visual C++ runtime.

None of it runs, but the Wintun driver stays in the Windows driver store until you remove it.

Server locations

We checked two free servers by measuring round-trip time from our connection and looking up the server IPs in a public IP registry. The US server (Los Angeles, Proton’s own network) and the Japanese server (Tokyo, a rented Datacamp network) were both consistent with the countries the app shows.

Company, audits and price

These facts come from public sources and are not test results.

Proton VPN is run by Proton AG from Switzerland (Tech Advisor). Its apps are open source (Proton). Securitum’s fifth annual no-logs audit, in May 2026, found no logging of browsing, DNS or traffic on free and paid servers; it was a point-in-time check of selected servers (CyberInsider).

Plan	Price	Devices
Free	$0	1
VPN Plus, 2 years	$3.49/month ($83.76 upfront)	10
VPN Plus, 1 year	$3.99/month ($47.88 upfront)	10
VPN Plus, monthly	$9.99	10

Prices as listed on 23 October 2026 (VPN.com); Proton often runs sales below these. Device limits and free-plan limits are from Proton (Proton). The free plan picks servers from 10 countries and has no data cap. The 30-day money-back guarantee is prorated (Security.org).

How to set it up safely

1. Install from protonvpn.com or through winget install Proton.ProtonVPN.
2. In Settings, turn the kill switch on and choose Advanced if you can live with reconnecting by hand after a failure.
3. After uninstalling, if you don’t use another WireGuard-based VPN, you can remove the Wintun driver: run pnputil /enum-drivers as administrator, find the entry for wintun.inf, and delete it with pnputil /delete-driver oemN.inf using the number shown.

Sources

• CyberInsider: Proton VPN passes no-logs audit
• Proton VPN: plans explained
• Proton VPN: multi-platform support
• VPN.com: Proton VPN pricing
• Security.org: Proton VPN pricing
• Tech Advisor: Proton VPN review