Proton shipped Lumo 2.0 on June 30, and the headline writes itself: a private ChatGPT alternative, built in Europe, that got a lot smarter overnight. The interesting question is the one the launch posts skip. Private how, exactly? The honest answer has two halves. Your saved chats are genuinely locked, encrypted so that not even Proton can read them. But the prompt you send is decrypted in the clear on Proton's servers to answer it, then forgotten. So Lumo is far more private than a mainstream chatbot, and not the same thing as running a model on your own machine. Here’s what 2.0 actually changed, what its privacy protects, what it doesn’t, and who should switch.
The short answer
Lumo 2.0 is the update that makes Proton’s private assistant genuinely usable: image generation, reasoning modes, sourced web search, memory, and a big capability jump. Its privacy is real but specific. Your saved history is locked so even Proton can’t read it, while your prompt is decrypted on a Proton EU server to answer it, then forgotten. More private than a mainstream chatbot, not the same as running a model yourself.
What Lumo 2.0 actually changed
Proton’s first Lumo was easy to file under “nice idea, come back later.” Private, yes, but limited enough that you kept a mainstream chatbot tab open anyway. Lumo 2.0, out June 30, is the version that closes that tab for a lot of tasks. It went multimodal: it generates images from a prompt, edits them, reads charts and documents you upload, and turns a rough sketch into a finished picture, all in one conversation. It picked up two reasoning modes, Fast for quick answers and Thinking for multi-step problems. Web search now returns live results with source citations, so it can pull current news, financial data and weather instead of guessing. And it gained memory: Projects are encrypted workspaces that hold your chats, files and instructions together and recall your preferences across sessions.
The capability numbers back the vibe shift. On the Artificial Analysis Intelligence Index, Lumo 2.0 Lite scores 34 against the old 1.4’s 15, and the flagship Lumo 2.0 Max hits 51. That’s a 240 percent jump on the top tier, and everyday answers come back up to 76 percent faster. This isn’t a point release. It’s the release where a privacy-first assistant became one you’d actually reach for.
The privacy, honestly: what zero-access encryption covers
Here’s where Proton’s marketing and a security engineer’s reading start to diverge, and it’s worth getting right. Lumo’s privacy has two separate layers, and they’re not equally absolute.
Your stored history is genuinely locked. Saved chats, uploaded files and generated images use zero-access encryption, the same design as Proton Mail and Drive: the data is encrypted so that only your device, unlocked by your account password, can read it. Proton can’t. An independent teardown of the traffic confirmed the encrypted flags and the two-way protection, so this part holds up. Not even Proton can open your saved conversations.
The prompt in flight is a different story. To actually answer you, Proton’s GPU server has to decrypt your message in the clear, feed it to the model, and generate a reply. There’s no trick that lets a model reason over text it can’t read. Proton’s own security model says the plaintext lives only in memory during the request and is “forgotten as soon as the response is generated,” with no logs kept. That’s a real and meaningful promise. It’s also a promise, backed by Swiss law and a no-logs policy, rather than a mathematical guarantee. Proton calls this “user-to-Lumo encryption” precisely because it’s not classic end-to-end: the AI decrypts your message, not a human, but decrypt it does.
Private by policy, not by locality
So the honest framing is a spectrum, not a yes or no. At one end, a mainstream chatbot: convenient, and your prompts sit on a big AI provider’s servers under terms that often include training. At the other end, a model running on your own machine, where the prompt never leaves your device, which is the strongest privacy there’s and the reason we wrote up running Qwen locally and offline. Lumo sits in a real and useful middle. Your prompt does leave your device, but it goes to open-weight models on Proton’s own European hardware, under Swiss privacy law, with no logs and no training on your data, and your history comes back locked so even Proton can’t mine it later.
For most people that middle is exactly right. You get far more capability than a laptop can run, and far more privacy than pasting the same text into a mainstream chatbot. You just have to be clear-eyed that “private” here means “processed by a company that has staked its whole brand on not looking,” not “never decrypted anywhere.”
The capability reality
Don’t let the privacy story oversell the brains. Lumo 2.0 Max at 51 on the intelligence index is a capable generalist: it drafts, summarizes, explains code, reads a document, makes a serviceable image. It’s not a frontier model. The flagships from the big labs still score higher and pull further ahead the harder the reasoning or the coding gets, which is the tradeoff you accept for keeping the whole thing in Europe on open weights. Match the task to the tool. Everyday private work, Lumo. A gnarly multi-file refactor or research-grade reasoning is still frontier territory, and our model comparisons cover that shelf.
Who should switch, and who shouldn’t
Switch if you’ve data you’d never paste into a mainstream chatbot: client material, health or legal questions, unreleased work, anything covered by a regulation with teeth. For that person, Lumo 2.0 is finally good enough to be a daily driver rather than a principled compromise, and the free tier is a genuine trial, capped on chats, uploads and images but fully functional. Lumo Plus runs about $12.99 a month, or nearer $9.99 billed annually, and lifts the caps while unlocking the most capable models; a Lumo Professional tier targets teams. One fair gripe from the community: Proton Unlimited subscribers expected Lumo to be bundled in and found Plus behind a separate paywall, which stings if you already pay for the suite.
Don’t switch expecting frontier intelligence, and don’t mistake it for local privacy. If your threat model says the prompt must never touch someone else’s server, the answer is a local model, not Lumo. For everyone between “I don’t care” and “nothing leaves this laptop,” Proton just made the most compelling case yet for the private middle.
Sources: Proton’s Lumo 2.0 announcement and Lumo security model documentation; feature and pricing coverage from TechCrunch and MacRumors; and an independent analysis of Lumo’s zero-access encryption by Race Dorsey. Intelligence Index figures are Proton’s own, June 30 2026.
Frequently asked questions
Is Proton Lumo actually private?
More than a mainstream chatbot, with an honest caveat. Your saved chats, files and images use zero-access encryption, so only you can decrypt them and Proton can’t read them. But to answer you, Proton's server decrypts your prompt in the clear, runs the model, and keeps no logs of it. So it’s private by policy, Swiss law and encryption, not private in the sense of never being decrypted anywhere.
Does Proton Lumo train on my conversations?
No. Proton states it doesn’t use your prompts or chats to train the models, and it runs open-weight models on its own European servers rather than sending your data to a third-party AI provider.
Is Lumo 2.0 as smart as ChatGPT or Claude?
Not at the top end. Lumo 2.0 Max scores 51 on the Artificial Analysis Intelligence Index, a big jump from Lumo 1.4's 15, which makes it a genuinely useful assistant. Frontier flagship models still score higher, so use Lumo for private everyday work, not for the hardest reasoning or coding.
How much does Proton Lumo cost?
There’s a free tier with caps on chats, uploads and images. Lumo Plus is about $12.99 a month, or nearer $9.99 a month billed annually, and removes the limits and unlocks the most capable models. A Lumo Professional tier targets teams.
Is Lumo more private than running a local AI model?
No. A model running on your own machine never sends the prompt anywhere, which is the strongest privacy there is. Lumo processes prompts on Proton's servers, so it’s a trusted-server model. If you want nothing to leave your device, run a local model; if you want more capability than a laptop can give while still avoiding the big AI providers, Lumo is the middle ground.
