The Proton Blog

The Palantir Mafia is changing the business of war and surveillance

Proton Team — Tue, 13 Oct 2026 18:07:20 GMT

Palantir has become one of the most recognizable technology companies working with the U.S. government. Its software is used by military and intelligence organizations, while its work with law enforcement and immigration agencies has made it a focus of privacy and civil liberties debates around government surveillance.

Speaking broadly, Palantir’s software helps organizations connect and make sense of large amounts of existing data. That capability can be useful for businesses and governments alike, but its applications become more consequential when the data involves military operations, policing, or immigration enforcement.

Palantir’s influence extends beyond the company itself. A growing group of defense and surveillance startups has emerged from the same network of former Palantir employees, investors, and executives. Some build weapons. Others build the software that connects sensors, drones, databases, and people. Several work directly with Palantir or with the same large defense contractors that have supplied the U.S. military for decades.

You could call this network the “Palantir Mafia,” borrowing the language once used for the PayPal alumni who went on to reshape Silicon Valley. Within it is a smaller group with a particularly strong connection to military and surveillance technology.

The companies are different, but the pattern is striking. People leave Palantir, carry experience from government and military projects into new businesses, and often find the capital and relationships needed to sell those products back to governments.

The result is a new layer of the military-industrial complex, built around software, data, artificial intelligence, and venture capital.

Meet the companies spreading Palantir’s model

While all of the companies in the “Palantir Mafia” perform different jobs, their connections create a recognizable pattern. Former Palantir employees are carrying knowledge, relationships, and ways of working into new defense companies, while investors and established contractors help those companies reach government customers.

Epirus

Epirus, founded by Joe Lonsdale (who also co-founded Palantir), makes Leonidas, a high-power microwave system designed to disable drones. The system can be deployed in different configurations, including on vehicles, and it has been integrated with General Dynamics Land Systems’ Stryker combat vehicle.

Epirus has also joined Palantir’s Warp Speed program, giving the companies another direct connection.

Valinor

Valinor is newer and less flashy. Founded by former Palantir executive Julie Bush, the company describes itself as tackling “unsexy” problems in defense. Its products include systems for drones and other military infrastructure, and its software can connect with Palantir’s platforms. The name itself is a nod to the works of J. R. R. Tolkien which also inspired the names of Palantir and Anduril.

Valthos

Valthos takes a different approach. The company develops AI systems intended to detect and prevent biological weapon attacks. Its co-founder and CEO, Kathleen McMahon, was previously the Head of Life Sciences at Palantir. Valthos reflects a broader concern among some technology executives that advances in AI and biotechnology could make biological threats easier to create.

Anduril

Then there is Anduril, the biggest and best-known company in this group. Founded in 2017 by three former Palantir employees, including Trae Stephens, who is also a partner at Founders Fund. Its products include surveillance and combat drones, autonomous systems, and Lattice, a software platform that uses sensor data to identify and track objects.

Anduril’s growth shows how far this model has moved. The company was valued at $61 billion after a 2026 funding round, putting it in a very different financial category from most defense startups.

Its technology has also crossed between military and domestic security. Lattice has been used in border surveillance, showing how systems developed for national security can have applications closer to home.

Kela

Kela, an Israeli defense technology company, follows a similar software-first approach. It provides a platform that can connect drones, sensors, and weapons from different manufacturers into a single system. Its co-founder and president, Hamutal Meridor, previously ran Palantir’s Israeli operation. Kela has also secured work connected to the Israeli military.

Rivet Industries

Rivet Industries was founded by David Marra who previously worked at Microsoft on a military mixed-reality headset program. Marra later then spent a year at Palantir. Rivet now develops wearable systems for soldiers. In 2025, the Army awarded Rivet a $195 million Soldier Borne Mission Command contract, and the company works closely with Palantir.

Peregrine Technologies

Peregrine Technologies was founded in 2018 by Nick Noone, who previously ran Palantir’s U.S. Special Operations business. At Palantir, Noone worked with data to identify ISIS members in Syria. He later took that experience to a small police department in California, initially building Peregrine’s technology for free before turning it into a commercial product.

Peregrine now provides software to hundreds of agencies. Its platform brings together information that police departments already have access to, making it easier to search and visualize data from different sources.

From foreign battlefields to local police

Palantir’s own history includes a predictive policing project in New Orleans. The system used information such as arrest records, social media posts, police contacts, and family relationships to generate assessments about people’s likelihood of being involved in violence. The project was later examined by researchers and civil liberties organizations concerned about the lack of transparency and the risks of assigning people police risk scores. The Harvard analysis of predictive policing provides additional context on the New Orleans system.

Peregrine says it does not operate a predictive policing system of that kind. Instead, the company says it helps agencies organize and visualize existing information rather than adding new surveillance sources.

The problem is that “existing information” can still be extensive. Once those systems are connected, the question is no longer simply what a company collects itself. It becomes a question of what information a police department can bring together and what conclusions it can draw from it.

That is one of the most important parts of the Palantir model. A company does not necessarily have to collect every piece of information itself to make a large amount of information more useful.

Bankrolled by the Founders Fund

There is another connection running through several of these companies: Founders Fund.

Co-founded by Peter Thiel, the venture capital firm backed Palantir and has invested in or supported several companies in this wider network. Trae Stephens is particularly important because he sits at the intersection of several parts of it. He worked at Palantir, became a Founders Fund partner, and helped co-found Anduril.

That makes the network less mysterious. You don’t need a formal organization with membership cards or a central office. Shared investors, former colleagues, and existing government relationships can create many of the same effects.

Founders Fund has also been unusually explicit about its investment philosophy. Its manifesto argues that successful entrepreneurs often have what it calls a “near-messianic attitude” and believe their company is essential to making the world a better place. It also argues for independent, contrarian thinking rather than simply following the rest of the venture capital industry.

Defense has traditionally been difficult territory for venture capital. Government procurement can be slow, contracts are complicated, and established contractors already have decades of relationships and infrastructure.

The newer defense companies are approaching the problem differently. They bring venture-backed software culture, rapid product development, and consumer technology ideas into a market that has historically been dominated by large contractors.

The money follows the opportunity. So does the talent.

The startups aren’t replacing the old defense giants

It would be easy to tell this story as a simple battle between Silicon Valley startups and traditional defense contractors.

Epirus has integrated its Leonidas system with General Dynamics’ Stryker vehicle, and General Dynamics Land Systems has invested in Epirus. Rivet names Northrop Grumman as a partner. Anduril has integrated Lockheed Martin radar into its battlefield software.

The relationship is closer to an expanding ecosystem than a hostile takeover. That matters because the growth of defense technology startups does not necessarily shrink the role of companies such as General Dynamics, Northrop Grumman, and Lockheed Martin. Instead, startups can provide new software, sensors, weapons, and interfaces that become part of existing military systems.

The distinction also changes how we should think about disruption. In consumer technology, a startup can sometimes replace an incumbent by building a better product and taking its customers. Defense procurement works differently. A new company can win a contract while still relying on established manufacturers, military infrastructure, and government procurement systems.

The result can be a larger market in which startups and traditional contractors both benefit.

The scale of that market is already visible. In 2025, the U.S. Army awarded more than $350 million for work on virtual displays for soldiers, with money going to both Anduril and Rivet. The two companies can compete for contracts while also building products that fit into the same broader military technology ecosystem.

The companies don’t need to destroy the old military-industrial complex to change it. They can become another layer within it.

Who decides what this new military industry becomes?

Governments want better intelligence, faster software, autonomous systems, counter-drone weapons, and tools that can connect huge amounts of information. In some cases, those technologies can give soldiers or investigators information they could not easily obtain before.

But greater technical capability also changes the balance of power.

When a company develops software that can connect databases, sensors, cameras, weapons, and government agencies, the technical decision about what the system can do becomes a political decision about what governments are able to do.

That is why the story of Palantir’s former employees matters beyond a list of startups. The network shows how quickly expertise can move between military intelligence, private technology companies, domestic policing, and surveillance.

It also shows how venture capital can influence what gets built. Dwight Eisenhower warned about the military-industrial complex in his 1961 farewell address. He argued that the country needed to guard against the acquisition of “unwarranted influence” and warned that the growth of military and industrial power could endanger democratic processes. He ended with an appeal for an “alert and knowledgeable citizenry.”

More than six decades later, technology has changed but the basic question has not.

Who has the power to decide how military and surveillance systems are built, where they are deployed, what data they can use, and how their capabilities expand? This becomes harder when the systems are developed by private companies, financed by investors, and sold through government contracts that most citizens never see.

The companies emerging from Palantir’s orbit are not a single organization, and they do not all have the same products or goals. Some are building defensive systems. Some are developing tools for policing. Some are working on ways to connect military hardware and software.

What connects them is a network of people, capital, technology, and government relationships.

That network is becoming an increasingly important part of how the United States and its allies approach defense and surveillance.

The question is not whether these technologies will shape the future. They already are. The question is who gets to shape them, and who gets to decide where the power they create should stop.

SOC 1 vs SOC 2: What’s the difference, what you need, and what it costs

Jessica Bernard — Tue, 13 Oct 2026 17:29:42 GMT

SOC compliance can be complicated and time consuming for organizations. If you’re currently investigating it, we’ve compiled an extensive guide to help you understand the core aspects. In this guide we explain the difference between SOC 1 vs SOC 2, why you might need one over the other, how SOC audits work, and whether SOC 3 is worth considering.

SOC 1 vs SOC 2 vs SOC 3

What’s the difference between Type I and Type II SOC reports?

What is SOC 1, who needs it, and why?

What is SOC 2, who needs it, and why?

What is SOC 3, who needs it, and why?

Which companies need multiple SOC reports?

How do SOC audits work? Timelines, costs, and resources

How much does a SOC audit cost?

How Proton can help you complete SOC audits

Tips for SOC audits

FAQ

SOC 1 vs SOC 2 vs SOC 3

SOC reports may sound like tiers of the same type of report, but they’re not. They’re actually three different reports built for three different audiences. So when you’re comparing them, it’s not about which one is better, but which one is better suited to your needs.

SOC 1 is for companies whose services touch a customer’s financial reporting, like payroll processors, claims administrators, or fund administrators.
SOC 2 is for companies handling customer data, like SaaS, cloud, and technology vendors.
SOC 3 is a public-facing summary of a SOC 2 report. It uses the same underlying criteria, but without the sensitive technical detail, so it can be shared freely.

Why get a SOC audit?

Customers need proof that your company can be trusted with their data, but auditing every vendor individually can be slow and expensive for everyone involved. Your organization’s customers are the intended audience for the report.

Developed by the American Institute of CPAs (AICPA), a SOC audit enables a company to go through that process once with an independent CPA firm, then hand the resulting report to a potential customer, instead of filling out a new security questionnaire for every opportunity. In regulated or security-conscious industries like finance and healthcare, a SOC report often determines whether your company makes it onto a vendor shortlist at all.

A SOC audit also pushes companies to implement real security controls, like access management, monitoring, and incident response, along the way. So while the report exists to satisfy customer procurement teams, the process behind it builds your security practices, regardless of who’s reading the report. Because SOC reports reveal detailed information about company processes and infrastructure, companies generally require customers to sign an NDA before the report can be shared.

Comparison table: SOC 1 vs SOC 2 vs SOC 3

	SOC 1	SOC 2	SOC 3
Focus	Internal controls over financial reporting	Security, availability, processing integrity, confidentiality, and privacy	Same criteria as SOC 2, but summarized
Governing standard	SSAE 18 (AT-C 320)	SSAE 18 (AT-C 105/205)	SSAE 18 (AT-C 105/205)
Typical audience	Auditors, regulators, and the customer’s finance/accounting teams	Customers’ security, IT, and procurement teams	General public / prospective customers
Report distribution	Restricted: Shared under NDA with specific stakeholders	Restricted: Shared under NDA with specific stakeholders	Public: Can be posted or shared freely
Example companies	Payroll providers, claims processors, fund administrators	SaaS platforms, cloud providers, data centers	Companies that have a SOC 2 and want a shareable version
Report types available	Type I and Type II	Type I and Type II	Not applicable

What’s the difference between Type I and Type II SOC reports?

There are two types of reports available for SOC 1 and SOC 2 audits, and this is where comparisons become more useful.

A Type I audit examines the paperwork, policies, and system designs a company has put in place and assesses whether those controls are appropriately designed to protect data. It doesn’t test whether the safeguards actually work over time, it just confirms they’re there and look correct.

A Type II audit examines paperwork, policies, and system designs, then monitors their operation continuously over a period of 3 to 12 months. The auditor verifies that the controls are not only well‑designed but also effectively followed; that the company keeps logs, makes backups, monitors access, and handles incidents as promised.

Customers and partners usually trust a Type II audit more because it demonstrates ongoing, real‑world security performance. Unlike SOC 1 and SOC 2, which just serve different audiences, a Type II audit can be considered stronger than a Type I.

What is SOC 1, who needs it, and why?

SOC 1 is a compliance and auditing framework for companies whose services affect their customers’ financial reporting. SOC 1 satisfies the needs of customers’ external auditors and provides assurance that a service organization’s controls won’t introduce errors into its customers’ books.

What types of companies benefit from SOC 1 attestation?

SOC 1 is the go-to attestation for companies that handle financial transactions or data on behalf of others. This includes payroll processors, payment processors, fund administrators, claims processors, and loan servicing platforms. A SOC 1 can unlock new contracts with larger clients, reduce friction during annual audits, and reinforce a company’s reputation for reliable, well-controlled financial processes, which often determines whether your company is even considered for financially sensitive work.

What is SOC 2, who needs it, and why?

SOC 2 is a compliance and auditing framework for companies that handle customer data. A SOC 2 audit produces a report that documents how a company’s controls hold up against the AICPA’s Trust Services Criteria, covering security, availability, processing integrity, confidentiality, and privacy, along with an independent auditor’s opinion on whether those controls are properly designed. SOC 2 is a necessary attestation for companies that need to prove the effectiveness of their security controls to U.S. customers and partners.

What types of companies benefit from SOC 2 attestation?

Companies that deliver technology‑enabled services will benefit the most from SOC 2 certification. This includes software‑as‑a‑service (SaaS), cloud infrastructure, data analytics platforms, fintech solutions, and health‑tech applications. With data breaches becoming the norm, customers need reassurance that a company can protect the data and systems they’re trusting them with. A SOC 2 provides this, which can then unlock new contracts with large corporations, simplify vendor‑risk assessments, and bolster a firm’s reputation for strong data protection.

Read about Proton’s SOC 2 Type II audit

What is SOC 3, who needs it, and why?

A SOC 3 is derived from the same audit process as a SOC 2, it just serves a different purpose. The SOC 3 report is a high-level summary of the same information, without the detailed and specific information that necessitates an NDA, so it’s often used as a public-facing summary of the SOC 2 report.

What types of companies benefit from SOC 3 attestation?

It’s not possible to get a SOC 3 without going through the SOC 2 audit process, but companies that are already being assessed for a SOC 2 and want to use that information in marketing campaigns or sales decks may benefit from pursuing a SOC 3 report.

Which companies need multiple SOC reports?

Choosing between SOC 1 and SOC 2 is often a case of choosing which report suits your customers’ needs. However, some companies do need more than one SOC report. For example, a fintech company that processes payments and stores sensitive customer data might need both a SOC 1 (because it touches customers’ financial reporting) and a SOC 2 (because it handles customer data).

Combination of SOC audits	Company type
SOC 1 + SOC 2	Companies that handle both financial reporting and significant customer data
SOC 1 + SOC 3	NA (It’s not possible to get a SOC 3 without a SOC 2)
SOC 2 + SOC 3	Companies that handle significant customer data and want to demonstrate their SOC 2 attestation in public-facing content
SOC 1 + SOC 2 + SOC 3	Companies that handle both financial reporting and significant customer data and want to demonstrate their SOC 2 attestation in public-facing content

How do SOC audits work? Timelines, audit phases, and renewals

There are a range of variables that will impact how costly and time-consuming a SOC audit is. Here are some of the factors to keep in mind if you’re planning SOC 1 or SOC 2 compliance.

SOC timeline

SOC	Timeline
SOC 1 Type I	~ 2–4 months
SOC 1 Type II	~ 6–12 months total, observation window typically 6–12 months
SOC 2 Type I	~ 3–6 months total
SOC 2 Type II	~ 6–15 months total, observation window typically 3–12 months

SOC audit phases

A SOC audit contains multiple phases that unfolds over weeks or months. Here’s what each stage looks like:

1. Prep (weeks 1–4)

Before any testing begins, you identify which systems fall within scope and confirm which of the AICPA’s Trust Services Criteria apply. For SOC 2, that typically means security as the required criterion, plus any combination of availability, processing integrity, confidentiality, and privacy based on customer needs. You’ll also inventory the controls you already have in place, like access policies, encryption standards, backup procedures, and incident response plans. The goal here is to avoid surprises later.

2. Documentation (weeks 4–8)

You compile evidence that your controls exist and are properly designed. This includes written policies, system architecture diagrams, role-based access matrices, vendor risk assessments, and training records. The auditor will review these materials to ensure they cover all relevant requirements and align with what customers would reasonably expect.

3. Audit (weeks 8–12)

For a Type I report, the auditor performs fieldwork around a single point in time. They interview key staff, sample control evidence, and verify that your documentation reflects reality. At this stage, they’re confirming that controls are designed correctly.

4. Observation (months 3–15)

A Type II adds an observation window where the auditor monitors your controls continuously. During this period, they’ll examine things like:

Access logs: who got permissions, when access was revoked, and whether privileged accounts were reviewed periodically
Change management records: how code deployments were approved and tracked
Incident handling: whether security events were detected, escalated, and resolved according to your documented process
Backups and monitoring: evidence that systems are actually being monitored and restored as promised

At the end of the observation period, the auditor issues their opinion on how well your controls operated throughout the entire window.

SOC renewals

Renewing your SOC attestation should generally be quicker than the first audit. Since your scope, controls, and system boundaries are already established, the auditor is building on a known baseline rather than starting from scratch, and many renewals are both cheaper and quicker than the initial audit. Reports are typically valid for 12 months, so most companies renew annually, often starting the next observation period right after the current one ends to avoid any gap in coverage.

How much does a SOC audit cost?

It’s almost impossible to determine the cost of a SOC audit without getting a quote from a CPA, as they can range from as little as USD 5,000 to upwards of USD 150,000. The cost will depend on a number of factors, including the size of your organization, your organization’s readiness, how many resources you can dedicate to the process, and which type of audit you’re going for. Type I audits are generally less expensive, because they take less time.

How Proton can help you complete SOC audits

Proton holds both ISO 27001 certification and SOC 2 Type II attestation, which can make it easier for companies that use Proton products to obtain their own accreditation. By using a secure, encrypted workspace, you inherit a proven security baseline that already meets the rigorous audits behind SOC 2 Type II. This can reduce the effort required to demonstrate compliance and shorten audit timelines.

Tips for SOC audits

Do as much prep work as possible before the audit starts. A lack of readiness can often slow down the process and increase costs.
Define your system boundaries before fieldwork begins. Ambiguity about what’s actually in scope is one of the most common causes of delays.
Choose your Type II observation window based on who’s asking for the report, not just how fast you want it. A three month window gets you a report sooner, but many customers expect six months to a years’ worth of evidence and may push back on anything less.
Assign clear control owners early. The biggest delays can happen while chasing down the right person internally for evidence, approvals, or interviews.
Plan for renewals and treat evidence collection as an ongoing habit instead of a pre-audit scramble. Organizations that build continuous monitoring into their normal operations often have faster, cheaper renewals than those that treat each cycle as a one-off project.

FAQ on SOC 1 and SOC 2 audits

What are SOC 1 and SOC 2?

SOC 1 and SOC 2 are both audit frameworks developed by the AICPA, but they serve different purposes. SOC 1 focuses on internal controls over financial reporting. It’s designed for companies whose services affect their customers’ financial statements, like payroll processors or fund administrators. SOC 2 focuses on security, availability, processing integrity, confidentiality, and privacy. It’s designed for technology and cloud service providers that handle customer data.

Do you need SOC 1 before SOC 2?

No, SOC audits aren’t sequential, they’re just different, so you don’t need to complete a SOC 1 before you do a SOC 2. A SOC 1 is intended for businesses that perform financial reporting, while a SOC 2 audits a company’s security, privacy, and processing integrity.

How long does a SOC 2 audit take?

A SOC 2 audit can take anywhere from three months to over a year to complete, depending on whether you’re pursuing a Type I or Type II audit, the size and complexity of your organization, and the readiness of your team.

How much does a SOC 1 or SOC 2 audit cost?

A SOC audit can cost between USD 5000 – USD 150,000 depending on the type of audit, the size of your organization, and the complexity of your systems.

Is SOC 2 a certification?

No, a SOC 2 isn’t a certification, it’s an attestation. Although the terms are used interchangeably with SOC 1 and 2 audits, an attestation is more like a rating, while a certification is a pass/fail.

How often do you need to repeat a SOC 2?

A SOC audit doesn’t technically expire, as long as the systems remain unchanged, but the industry standard is to renew them every 6-12 months. Many companies set up a yearly renewal process, but it will depend on whether you’re pursuing a Type I or Type II audit, and if it’s Type II, how long the observation period is.

Can you get a SOC 3 without a SOC 2?

No, a SOC 3 is derived from the same audit process as a SOC 2. A SOC 3 is an optional add-on to a SOC 2, not a separate process.

How to take effective meeting notes that drive real action

Tom Odlin — Tue, 13 Oct 2026 14:49:51 GMT

It’s an all-too-common scenario: Your team agrees on something in your weekly meeting, but a week later you realize nobody wrote it down and nobody followed up on it.

Focused, actionable meeting notes give your team a shared record of decisions and responsibilities, including enough context for people who missed the discussion.

In this guide, we’ll share how to:

Choose between meeting notes and formal meeting minutes
Prepare for a meeting and capture the main discussion points, decisions, and actions
Organize, share, and follow up on your notes
Assess AI meeting assistants for privacy and check their summaries for accuracy

What are meeting notes, and how do they differ from minutes?

Meeting notes summarize what was discussed, what was decided, and who agreed to do what next.

For meetings that need an official record, such as board or committee meetings, use meeting minutes. Minutes follow a formal structure and record proceedings such as motions, votes, and resolutions, along with decisions and assigned actions.

	Meeting notes	Meeting minutes
Format	Informal, flexible	Formal, following a set template
Intended audience	Internal, team members and collaborators	Stakeholders, board, compliance
Function	To provide an action-oriented reference for internal teams	An official record of proceedings that can be used for auditing, legal purposes
Typical content	Records attendees, agenda, key points of discussion, agreements, and action items	Attendance, motions, votes, resolutions, and assigned actions
Best for	1:1s, project kickoffs, brainstorming sessions	Board meetings, formal committee meetings, public hearings

Get started with nine free templates in our guide to writing meeting minutes.

What meeting notes should include

Include a descriptive title and the meeting date, and use a consistent layout for similar meetings. Organize the main content around the four A’s:

Agenda: List the topics the meeting was intended to cover.
Attendance: Record who attended and, where relevant, who was absent.
Agreements: Explain what was decided and the main reasons behind it.
Action items: Record the agreed tasks, with a named owner and deadline for each one.

How to take meeting notes

The following steps help you prepare, capture the main points, and turn them into a document your team can use.

1. Prepare your agenda

Ask the organizer to share the agenda before the meeting so participants have time to prepare questions, research topics, and suggest anything else that needs discussing.

Add a descriptive title, the date, and each agenda item to your note-taking document as a heading. Leave space underneath for discussion points, decisions, and actions so you’re ready to take notes when the conversation starts.

If there’s no agenda, ask the organizer what the meeting needs to achieve. A discussion about possible approaches needs different notes from a meeting where the team must choose one.

2. Record attendance

Record who attends the meeting and, where relevant, their role or team. Include colleagues who were expected but couldn’t attend, so you know who needs an update afterward.

An attendance list helps readers identify who took part in a decision and who to contact for more context. For meetings with external participants, include their organization so colleagues understand their involvement.

Check the list when the meeting starts and update it if anyone joins later. If someone misses a discussion that affects their work, flag the relevant outcome when sharing the notes.

3. Capture agreements

During the discussion, focus on the main points, what was decided, and why. You don’t need to write down everything people say. Short phrases and bullet points help capture the information without losing track of the conversation.

Choose a note-taking method that suits the meeting:

Cornell method: Divide your page into three sections: two columns with space for a summary underneath. During the meeting, write only in the right-hand column. Afterward, read through your notes and complete the other two sections:
- Notes column on the right: Use the wider column to capture discussion points, decisions, and actions.
- Cue column on the left: Beside each chunk of notes, add a keyword or short question that identifies what it covers. For notes about postponing a launch, for example, write “Launch date” or “Why was the launch postponed?”
- Summary area at the bottom: Summarize the meeting in two or three sentences, drawing out the main decisions and next steps from your notes.

Outline method: Use agenda items as headings, with bullet points underneath for related discussion, decisions, and actions. This works well when the meeting follows a clear sequence of topics.
Quadrant method: Divide your page into four sections: Notes, Action Items, Questions, and Key Decisions. Keeping these separate helps you find the information you need when preparing the shared document.

Whichever method you use, be clear about what the team decided. If someone suggests postponing a launch but nobody agrees to it, don’t write that the launch has been postponed. Note that a postponement was discussed but no change was agreed, and record any agreed follow-up, such as checking when testing will be complete.

Before the meeting ends, read out the decisions you’ve recorded and ask participants to confirm they’re correct.

4. Define action items

Confirm each action before the meeting ends. Give the owner a chance to agree to the task and flag anything that would prevent them from completing it.

Each action should include:

Who: Name one person responsible for moving the task forward. Other colleagues can contribute, but everyone should know who to contact for an update.
What: Describe the work and what counts as finished. “Draft three launch-message options and share them with the team” gives the owner a clearer task than “Look into launch messaging.”
When: Use an exact date rather than “later this week” or “ASAP,” so the deadline remains clear whenever someone reads the notes.

Record any dependencies, too. Someone preparing a cost comparison needs to know when the revised supplier quote will be available. Include who will provide it and by when, so the task owner knows what they’re waiting for.

How to organize, share, and follow up on meeting notes

Once the meeting ends, your notes need to become a clear record that people can act on.

Review and organize your notes

Review your notes soon after the meeting, while you still remember the discussion. Work through the following checks:

Clarify your notes: Expand shorthand and confirm unclear decisions or responsibilities with the people involved.
Group related points: Organize the document under topic headings. If the team returned to the budget several times, bring those points together in one place.
Remove unnecessary detail: Cut repeated arguments, tangents, and comments that don’t explain the outcome. Keep the reasons behind decisions and any unresolved questions.
Make the document easy to scan: Use short paragraphs and bullet points, with action items in a separate list or table.
Check for missing context: Read the document from the perspective of someone who wasn’t there. Explain unfamiliar references and add any information needed to understand the discussion.

Share your notes

Share the finished notes within 24 hours. Store the document in a shared, searchable workspace with a consistent naming format, such as “2026-10-12 — Email vendor renewal.”

Send a direct link rather than separate attachments so everyone refers to the same version. If your notes contain confidential business or client information, you can share them securely with Proton Drive, which uses end-to-end encryption and lets you add a password and expiration date to the link.

Before sending:

Check access: Make sure the intended readers can open the document and restrict confidential information to the people who need it.
Include relevant absentees: Add colleagues who missed the meeting but need the information or have work assigned to them.
Highlight the outcome: Include the main decision and upcoming deadlines in your message.
Tag action owners: Direct each person to their assigned tasks.
Request acknowledgment where needed: For critical actions, ask the owner to confirm they’ve seen the task and deadline.

If a reader identifies an error in the notes, correct the shared document and notify anyone whose work is affected.

Follow up on actions and decisions

Before the next related meeting, ask owners to update their tasks. Record what’s complete, what’s blocked, and any revised deadlines.

For stalled work, establish what’s preventing progress and add unresolved blockers to the next agenda. A missing approval, for example, needs to be addressed before the task can continue.

If the team changes an earlier decision, record the new agreement and link to the notes it replaces. Add a link in the original document pointing to the updated decision, so readers can identify which agreement is current.

An example of effective meeting notes

The example below brings the four A’s together in a finished document, including the work required before the team can make a final decision.

Meeting: Email vendor renewal
Date: October 12, 2026
Attendees: Maya, Operations; Alex, IT; Priya, Finance
Absent: Sam, Procurement

Agenda: Decide whether to renew the current email vendor before the October 30 renewal deadline.

Discussion: The team reviewed the proposed renewal price, current usage, and the work involved in switching providers. Finance needs a confirmed annual cost, while IT needs to check the cancellation notice period, data-export process, and the alternative provider’s security protections.

Agreements: Request a revised quote and compare it with one alternative provider before making the renewal decision.

Action items:

Owner	Action	Deadline
Maya	Request a revised annual quote from the current vendor.	October 14, 2026
Alex	Confirm the cancellation notice period and document the data-export steps.	October 15, 2026
Alex	Check whether the alternative provider meets the team’s security requirements and share the assessment.	October 16, 2026
Priya	Compare the revised quote with the alternative and share a cost summary.	October 19, 2026

Follow-up meeting: October 21, 2026 — review the cost comparison and security assessment, then decide whether to renew or switch.

Should you use AI for meeting notes?

AI meeting notes tools record and transcribe discussions, while a business AI assistant can prepare summaries from written notes and pull out action items.

Ask participants for permission before using a tool to record or transcribe the meeting, and check how the service handles your data before recording or uploading notes. A recording could include client information, internal plans, or employee concerns, even if you leave those details out of the final summary. For each service you’re considering, find out:

What you need to share: Whether the tool needs the full recording or transcript, and whether you can leave out sensitive details.
How the information is used: Whether recordings, transcripts, or summaries are used to train models or for purposes beyond preparing your notes.
Who can access it: Your team, the provider, and other companies involved in processing or reviewing the content. A promise not to train AI on your data doesn’t establish who can read it.
What’s stored: How long the service retains recordings, transcripts, summaries, and processing logs, and what you can delete.
How it’s protected: What encryption covers and whether the provider holds the keys needed to read stored information.

If your meeting notes contain confidential information, Lumo for Business offers AI assistance without using your conversations to train models. Saved chat history is protected with zero-access encryption, so even Proton can’t read it.

AI can and does get things wrong. Once you’ve generated a summary, check it against your original notes or recording before sharing. Pay particular attention to:

Decisions: Confirm that suggestions or unresolved discussions haven’t been presented as agreements.
Responsibilities: Check that each person named as an owner accepted the task.
Details: Verify names, figures, and deadlines against the original discussion.
Missing context: Make sure the summary explains the reasons behind important decisions.

Your meeting notes cheat sheet

Taking effective meeting notes means capturing decisions, assigning clear actions, and following up on progress. Ready to put this into practice? We’ve got you covered with a quick checklist to keep handy before, during, and after your next meeting:

Before: Agree who will take notes and prepare a document with the title, date, and agenda headings.
During: Record attendance, decisions and their reasons, and action items with named owners and deadlines.
Before everyone leaves: Confirm the decisions and ask action owners to acknowledge their tasks.
Within 24 hours: Check and organize your notes, then share a link with the people who need them.
Before the next meeting: Review progress, identify blockers, and add outstanding issues to the agenda.

Keep in mind, however, that your meeting notes are only as private as the meeting they come from. Proton Meet provides end-to-end encrypted video conferencing, which helps keep confidential conversations private.

How to write a follow up email: a practical guide

Tom Odlin — Mon, 12 Oct 2026 11:55:42 GMT

If you need to chase down an unpaid invoice, get feedback, or give someone a timely nudge about a deadline, you’ll need to write a follow up email. A well-crafted follow-up email is powerful. It can keep work moving, build strong collaborator relationships, save time, close deals, and even improve cash flow. But it can also be so hard to find the right words to express what you mean.

In this blog, we will help you write the kind of follow-up email that helps you communicate what you mean clearly and get your recipient to respond before projects run later.

We’ll cover the six most common types of follow-up email (with tips on when to send them and templates you can copy) and give you the rules to writing a more effective follow-up email for every workplace situation.

Six common types of follow up emails

Follow-up emails have different purposes. For each scenario, we’ve listed when to send it and a template you can adapt for your own message.

Reminders

Whether it’s about an upcoming payment, a critical all-hands meeting, or a deliverable that will have a knock-on effect if its not submitted on time, a reminder email can keep work on track. The challenge is to write it so that it inspires action, without coming across as pushy. To do that:

Use an empathetic and open tone
Reply in an existing thread or set some context in one or two sentences
State the upcoming date clearly
Give the reader an opportunity to ask for more support

When to send: A couple of days (or more) ahead.

Template:

Subject: Reminder: Your [name the invoice/meeting topic here] is coming up on [state the deadline here]

Hi [Name],

Thanks for your participation in [offer context here].

I wanted to get in touch to offer you a friendly reminder that [name the invoice/meeting topic here] is fast approaching. It’s due by [state the deadline here].

If there’s anything we can do to support you, please do get in touch.

Best regards,

[Your name]

[Your title]

[Your business]

Information requests

You’ve already sent an email that was detailed, clear, and considerate. But you haven’t heard back from the recipient, and it’s now holding up a decision or delaying a deadline.

How do you send a follow up email after no response without apologizing too much (“Sorry to be a pain, just wanted to check…”) or using passive-aggressive language (“As per my last email…”)?

Here are some tips:

Give the reader an easy “out” upfront (“I know this is a busy time”)
State clearly what action you need the reader to take
Outline the downstream impact of a delay
Make the next step easy for the reader (“Please respond to confirm”, “Click this link to book”)

When to send: 1-2 business days after the due date.

Template:

Subject: Following up: [name the invoice/document/deliverable here] still needed

Hi [Name],

I know this task is only one of many on your to-do list, but I wanted to ask for your input on [name the invoice/document/deliverable here].

This needs your urgent attention because delay at this stage will affect [mention downstream effects here] and we’ll need to push back [mention the launch date / project timeline / next stage of the work here].

I’ve included a link here to [upload the file / confirm directly], but please do let me know if there’s anything else I can do to push this through.

Best regards,

[Your name]

[Your title]

[Your business]

Meeting summaries

Sending meeting minutes or a call summary to a vendor, partner, or investor after you’ve had a productive meeting accomplishes two important things that keeps work on track: it records the decisions you made and clarifies the necessary next steps.

To write a helpful meeting summary, don’t forget to:

Remind recipients about the main points covered
Confirm key decisions made
State next steps and follow ups that must be scheduled

When to send: Within 24 hours when decisions made in the meeting are still fresh so that the message reads as reinforcement. If you lay out a next step here, send another follow-up email in a week.

Template:

Subject: Next steps from [mention the date here] meeting on [mention the topic here]

Hello all,

Following on the meeting scheduled to discuss [topic with more context], I am including below a summary:

[Mention key decision 1 here]

[Mention key decision 2 here]

[Mention key decision 3 here]

Next actions:

[Name the relevant stakeholder here] to complete [name the specific task here] by [set a deadline here].

Name the relevant stakeholder here] to complete [name the specific task here] by [set a deadline here].

I will check in within the week to check on the status of each task and will be monitoring this thread for any follow up questions. The next meeting on this project will be on [include the date here].

Best regards,

[Your name]

[Your title]

[Your business]

Status updates

You’ve wanted to send this kind of email before. Maybe when you delegated a project to a vendor or placed an order with a supplier, and wanted to ask: “Are we still on track to hit on schedule to hit our targets?” so you could prepare for delays or project hiccups.

Writing a status request email is delicate work. If you ask for a status update too firmly, it can read like an accusation. Ask it too softly and you might miss your deadline.

To write a status update email, remember to:

State the purpose of your email early
Mention what you can do to support the recipient
Include the deadline or target you’ve agreed to hit

When to send: 2-3 business days after the last agreed checkpoint or expected delivery date has passed.

Template:

Subject: Quick check-in on [mention the project name here]

Hello [Name],

We’re only [mention the number of days to deadline here] and I wanted to make sure we have everything in place to meet it. Could you give us an update on how your team is progressing?

If you’d like help [mention specific ways in which you can support the recipient here], please let us know. We’re here to support in any way necessary.

As you already know, [include deadline or target here] and I want to make sure you have everything you need from us to meet it.

Thanks for all your efforts,

[Your name]

[Your title]

[Your business]

Contacting a member of your network

You know your network, former colleagues and peers, can open new doors for your business. But you’ve lost touch and don’t know how to reopen the conversation without it feeling forced, transactional, or like you’re only reaching out because you need something.

But how do you write an email that says both “I’m genuinely happy to reconnect” and “I noticed you can now buy from me”? Leaning too hard into the opportunity can read as opportunistic, but lean too soften can make it unclear why you emailed at all.

Before you write this type of email, remember:

Open with the relationship by referencing something specific from your history together. Make the opportunity a soft mention
Give them an easy, low-pressure way to respond (a call, a coffee, a quick reply)

When to send: When you’ve identified a specific opportunity that your contact may want to contribute to and benefit from.

Template:

Subject: Saw [refer to the specific update] and thought of you

Hi [Name],

I just saw that you’ve [mention the genuine trigger new here] and am so pleased to see you succeed at [add specific achievement here]. Congratulations!

My team at [remind the recipient of who you are and what your business does here] is working on something I think you may be interested in. We’re [mention what that something is, briefly, here].

If you think this is a fit and you’re interested in hearing more, I’d love to tell you more [give them options for low-pressure ways to connect here] soon.

Either way, congratulations again! We’re delighted for you.

Best,

[Your name]

[Your title]

[Your business]

Thanking somebody

It can be easy to treat thank-you emails as a formality, but a well-written one can make your reader feel valued, and more inclined to help you again.

A client who refers new work your way is more likely to repeat that favor if you thank them sincerely. The same goes for a supplier who’s turned an order around for you under pressure, or a colleague who’s put in hard work on a shared project.

Before you write this type of email, remember:

Name the specific thing they’ve done for you and what it meant to you or your business, rather than offering a general “thanks for everything”
Keep it short, so it doesn’t feel like you’re angling for another favor
Don’t attach a new ask: this will undercut the sincerity of your thanks. Instead, where appropriate, offer to return the favor when signing off

When to send: When the moment’s fresh and when the specific impact of what they’ve done for you can be measured. Sometimes that’s immediately after your interaction, sometimes that’s a day or two after.

Subject: Thanks for [specific thing]

Hi [Name],

Just wanted to say thanks for [the specific thing they’ve done]. It made a real difference to [what it enabled: saved time, avoided a mistake, kept things on track, etc.].

[If this isn’t a one-off favor, call that out specifically: “You’ve turned things around fast for us more than once now, and it doesn’t go unnoticed”.]

Let me know if there’s ever anything I can do for you in return.

Best regards,

[Your name]

[Your title]

[Your business]

Sending a follow-up email that invites a response

Following the advice in this blog won’t guarantee you a reply. But the common reasons why emails go unanswered are: The ask is unclear, there’s no obvious next step, or the message arrives at a moment your recipient is too buried in their inbox to deal with it. A follow up that’s specific, well-timed, and makes it easy for your reader to take action makes it easier for your recipient to respond without having to dig back through the thread to figure out what you actually need from them.

Those are the factors you control by how you write the email. But there’s also: when it lands. Proton Mail can help you to schedule follow up business emails with Schedule Send. You can direct emails to your recipient’s inbox at a specific time so it lands at when they’re most likely to respond.

That could mean the difference between an invoice that’s delayed or paid immediately, a project that’s stalled or completed, and a deal that’s open or closed.

Try Proton Mail for business

A simple framework for deciding what to automate vs. keep manual

Tom Odlin — Mon, 12 Oct 2026 11:37:48 GMT

You’ve heard that AI can help you get more work done, faster. But where do you start?

To know what to automate, you’ll need to identify tasks that are repetitive, rule-based, and easy to check. Then you’ll need to set up a workflow that can run without constant supervision but flag failures before they cause problems. Finally, you’ll need to leave enough room for human judgment where a mistake could be costly to undo.

If you’re on our website, you’re probably also considering the privacy and security implications of workflow automations. You’ll need to know where your business and client data goes, who can access it, and how it will be used.

In this guide, we’ll walk you through each of these decisions, step by step, to help you spot good candidates for automation and run a pilot that saves your team valuable time.

We’ll answer every question you have about workflow automation including:

What is workflow automation
How to identify tasks that are easy to automate
How to vet every automation before you commit
How to plan an automation workflow sequence
How to leave room for human judgement in your automation workflow
How to choose automation software that protects your data
How to test your workflow automation

What is workflow automation?

Workflow automation uses software such as Zapier, Microsoft Power Automate, and Jira to carry out steps that would otherwise be done manually. For routine work, this often means following straightforward rules, such as sending a reminder when a deadline passes or uploading an approved report to the correct folder. In the next section, we’ll show you how businesses are automating tasks in every department, from customer inquiries to marketing reports.

AI workflow automation uses large language models to interpret information, generate content, or choose the next action within a workflow. Large language models can work with connected software, such as calendars or file storage services, to take actions within the permissions they’re given.

Depending on the connected tools available, an AI assistant for business can manage a whole workflow from start to finish or handle individual steps. For example, you could ask Lumo to prepare a project update from your team’s weekly progress notes.

Workflow automation benefits and examples

Workflow	Example of automation	Practical benefit
Customer inquiries	Acknowledge incoming requests and route them to the appropriate team	Faster responses: Customers receive confirmation outside office hours, and requests reach the right people sooner
Invoice processing	Transfer invoice details into accounting software and flag missing fields or possible duplicates	Lower processing costs and fewer errors: Less time spent entering information and correcting transcription mistakes
Employee onboarding	Create setup tasks, send welcome information, and notify colleagues when their input is needed	Greater consistency: Each new hire gets the required steps without relying on someone to remember every detail
Sales handoffs	When a deal is marked complete, create an onboarding task and notify the account team	Better coordination: Teams know when work is ready for them and who is responsible for the next step
Inventory updates	Transfer stock figures between systems and flag items below a set threshold	More capacity: A growing number of products and orders requires fewer manual stock checks
Marketing reports	Collect campaign metrics and populate a standard report	More time for analysis: The team spends less time assembling figures and more time deciding what to change

How to identify tasks that are easy to automate

Before automating a task, consider whether it still needs to be done at all. A report nobody uses may be worth retiring rather than automating. Then, for the work you’ve decided to keep, look for tasks that share these traits:

They happen often: The task comes up daily, weekly, or with every new request, so time saved adds up.
They follow the same steps each time: You could write the process down as a set of rules without needing many exceptions.
The information arrives in a predictable format: Forms, spreadsheets, and standard documents are easier to automate than free-form requests.
Mistakes are easy to spot: A missing field or misfiled document is quickly noticed and fixed.

To find them, look for where work slows down or goes wrong. Common signs include information copied by hand from one place to another, colleagues waiting for someone to pass work along, and the same errors being corrected again and again. Tasks like these are often well suited to automation, such as:

Copying information between apps or spreadsheets
Sending standard reminders and confirmations
Checking whether required fields are complete
Preparing reports from the same sources
Moving files into predictable folders

Now that you’ve identified tasks you could automate, it’s time to check whether each one is worth the effort.

How to vet every automation before you commit

Because every automation takes time to set up, check, and maintain, run each task through these five checks before you commit to it:

Compatibility: Confirm the software you’re considering can exchange information with the apps you already use. If it can’t connect to where your data lives, someone will end up moving it by hand, which defeats the purpose.
Ownership: Name one person to set up the automation and keep it running. When a process changes or a step fails, your team needs to know who to go to.
Technical support: Find out whether that person can manage the setup alone or will need help from IT or an outside provider. Build that time and cost into your plan from the start.
Current workload: Ask the people who do the work how long each task takes, how often they fix mistakes, and how much time they lose waiting on approvals.
Time saved: Using those figures, compare the time automation could save with the time it takes to set up, review, and maintain, plus any subscription costs. For example, a three-hour setup that cuts a two-hour monthly task to 30 minutes of review pays for itself in two months.

How to plan an automation workflow sequence

Automation is easier to set up and check when you have a clear plan for how the work should move from start to finish.

Sketch the process as a simple flowchart and work through these points:

Start and end points: Define what kicks the workflow off, such as a form submission or an email arriving, and what counts as finished.
Each action in order: List every step between the two, and note what information each step needs and what it passes on to the next.
Decision points: Wherever the work could go more than one way, write the rule as a yes-or-no question. “Is the amount present and readable?” is something software can check. “Does the claim look right?” isn’t.
What happens when something goes wrong: For every “no,” decide where the work goes next, who gets notified, and where it rejoins the workflow once the problem is fixed.
Approvals: Mark any step where the workflow should stop and wait for a person before it continues. The next section covers how to decide which steps need one.

For example, you might use document workflow automation to process expense claims that employees submit with receipts for their purchases. The plan below shows how the software reads each receipt, handles missing information, and sends a complete claim for approval.

How to leave room for human judgement in your automation workflow

If you’re worried about automation making a mistake that nobody catches, the answer isn’t to avoid it. It’s to decide in advance which steps need a person to check them.

Start with how the result will be used and what happens if it’s wrong. An incorrect internal label is usually easy to change, but an incorrect price sent to a client may already have shaped their expectations.

If a step needs review, give the reviewer access to the original information and a clear decision to make. For steps that run automatically, make sure the software waits for required approvals, records what happened, and alerts the person responsible when a step fails.

For each step, choose whether to automate it, use software to prepare work for someone to review, or keep it manual.

Approach	When it fits	Example
Automate	Clear rules, predictable inputs, and errors that are easy to detect and correct	Create a task from a completed form
Assist and review	Software reduces preparation time, but the result needs checking before use	Summarize meeting notes or draft a client update
Keep the decision manual	The step depends on negotiation, empathy, conflicting evidence, or an exception to policy	Agree on compensation for an unhappy client

How to choose automation software that protects your data

Before uploading business or client information to an automation tool (and especially personally identifiable information), check how the company behind it handles your data.

Once you’ve shared it, reviewing or rejecting the result won’t change the fact that the provider already has your information. Expense receipts, for example, may reveal employee travel or client relationships.

For each service you’re considering, find out:

What you need to share: Which details, files, or conversations it needs, and what you can leave out.
How the information is used: Whether the provider uses your information beyond carrying out the task. For AI services, check whether uploads and generated content are used to train models.
Who can access it: People in your team, the provider, and any other companies involved in processing it. Note: A promise not to train AI on your data doesn’t establish whether the provider can read your stored information.
What’s stored: Whether the service keeps files, conversations, or processing logs, how long it retains them, and what you can delete. You’ll find all this information in each application’s data retention policy.
How it’s protected: What encryption covers and whether the provider holds the keys needed to read stored information. A file copied from encrypted storage into another service becomes subject to that service’s protections and practices too.

How to test your workflow automation

Running your first automation as a small pilot lets your team find problems before more work depends on it.

Pick a low-risk task: Choose something repetitive that doesn’t involve private or confidential information and produces results that are easy to check.
Put one person in charge: Make sure colleagues know who can pause the workflow, investigate failures, and update it when the process changes.
Brief the people doing the work: Explain which steps now happen automatically, what’s still their responsibility, and how to report a problem.
Test the awkward cases, not just the easy ones: Run ordinary cases alongside incomplete submissions, duplicates, and failed transfers. Check that the workflow waits for approvals and sends problems to the right person.
Measure the results: Compare the effort involved with the original process, including the time spent reviewing outputs, correcting mistakes, and maintaining the automation.
Expand only if it holds up: If the pilot saves work overall and quality holds up without creating extra work elsewhere, you can extend it to more tasks.

Choose a business AI assistant that’s private

Lumo is a business AI assistant that helps with summaries, comparisons, and drafts without using your conversations to train models by default. Saved conversation history is protected with zero-access encryption, so even Proton can’t read it. With appropriate human review, these protections give teams a private environment for AI assistance involving business information.

Privacy needs to carry through the rest of the workflow, too. After preparing a summary or draft, a technical colleague or IT provider can use the Proton Drive CLI for Business to automate file workflows from the command line and script file uploads, downloads, and management.

Automation should give your team more capacity while preserving the confidentiality of the information entrusted to it.

Why did the ASOS hackers go directly to their customers?

Kate Menzies — Fri, 09 Oct 2026 15:56:57 GMT

On Tuesday October 6, customers of ASOS, the British fashion retailer, received a push notification from the official app with the title “ASOS HACKED.”

It read: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”

With this message, hackers unleashed a new weapon in the cyberattack arsenal: breaching business accounts and taking their extortion demands directly to customers. If these ASOS-style attacks become commonplace, there are implications for any business that regularly sends messaging to customers. Mass messages to consumers through emails or in-app messages are an easy way to amplify phishing attacks from trusted senders, similar to the bitcoin scam sent through hacked Twitter accounts in 2020. It can also add pressure on companies to pay ransoms or provoke general chaos that affects companies’ bottom line.

Luckily, on a fundamental level, your prevention strategies as a business or consumer don’t change much. Here’s what we know.

What happened to ASOS?

Snowflake is a data storage and analysis service that ASOS used as cloud infrastructure. The hackers used a social engineering attack to gain access to an employee’s account on a platform called Simon AI, which is integrated natively into Snowflake. News reports said the hackers tricked the employee by “impersonating a trusted contact to obtain login credentials”.

(Snowflake itself wasn’t compromised in this instance, but it has been breached before.)

From there, they launched an unorthodox ransomware attack, using the ASOS app’s notification system to make an extortion demand sent to ASOS users. As the notification was addressed to the DPO (data protection officer) and IT department for the company, it appears that the hackers were making the threat public to create pressure on ASOS to make a payment.

In a market announcement the same day, ASOS said it was investigating unauthorized activity involving platforms used to communicate with customers. It also notified customers that their personal information, including names and contact details, may have been accessed, but that passwords and payment details didn’t appear to have been impacted.

However, in the following days, it emerged that hackers did in fact collect data about potentially millions of customers. The hackers contacted the BBC with an example of the stolen data: names, addresses, phone numbers, emails, customer numbers, and dates of birth.

What should ASOS customers do?

Because hackers obtained personal information, they can now launch much more effective phishing attacks against ASOS customers.

If you’re an Asos customer:

Create a new strong password for your ASOS account.
If you’re contacted by someone claiming to be from ASOS saying they need further information or that your account is now locked, don’t engage with them. Inform ASOS of the call, email, or SMS via their official customer care channel.
If you receive any unusual emails from other retailers or someone you don’t know asking you for more information or telling you to click a link, don’t click or engage with them. Always navigate to the company’s website or app directly to log in rather than through unexpected links you receive.

What is the impact?

ASOS’s brand reputation has also been significantly impacted. Not only has customer data been stolen, but the attack was announced directly to its customers in real time: ASOS didn’t have time to contain the attack before notifying customers and regulators of a breach.

Shares in ASOS fell by as much as 11% following the attack as concerned customers posted about it on social media. The direct notification created significantly more anxiety and urgency than a standard extortion attack made directly to a business. By targeting users, the hackers caused more chaos because it wasn’t clear how extensive the threat was.

Businesses need to be aware that the platforms they use to communicate with customers are likely to be targeted by hackers more in the future. If hackers can go directly to your customers, you lose control of your response instantly and customer confidence in your brand is shattered.

How can businesses avoid this type of attack?

Hackers gained access to the Snowflake account by impersonating a trusted ASOS contact, a typical example of phishing. We’ve written extensively about how to protect your business against phishing, but one of the most important actions your business can take is enabling two-factor authentication (2FA) for all accounts with access to sensitive customer data.

Enable 2FA

By enabling 2FA, you create an extra layer of protection for accounts that’s much harder for hackers to breach. Combining 2FA with a strong, unique password for each account is an effective and simple solution to protect your business from phishing attacks.

Centralize password management

Adopting a business password manager with a built-in 2FA authenticator, email aliases, and secure sharing can help your business guard against the kind of attack launched at ASOS. Securing logins in an end-to-end encrypted password manager which can safely generate, store, and autofill passwords helps your team members work safely and protect the sensitive data they need access to.

Harden communications channels

Often security audits start with critical systems like payment systems, core databases, or customer relationship managers. But the ASOS hack shows that communications channels are dangerous vectors that need to be locked down. Social media accounts, in-app notification platforms, email platforms like Mailchimp, and SMS platforms should be restricted to the minimum number of employees with 2FA strictly enforced.

Even if an email address or password is phished, hackers can’t access an account protected by 2FA. If each account has a unique password and uses an email alias, hackers can’t retry passwords across multiple services or build an activity profile for the email address.

As hackers continue to evolve their attack strategies, don’t give them an opportunity to damage your reputation and target your customers. Adopt a business password manager that keeps you and your customers safe.

Why “zero data retention” may not protect your business data

Eamonn Maguire — Thu, 08 Oct 2026 17:35:26 GMT

If you’ve thought twice about sharing proprietary knowledge or customer data with OpenAI or Anthropic, you’re not alone. Data privacy has become a deciding factor for businesses choosing an AI vendor. Fortune reported this week that zero data retention (ZDR) is now where labs at the frontier of AI innovation are now competing. The promise of ZDR is simple: The vendor processes your prompt, returns an answer, and doesn’t keep a record of it. In practice, though, ZDR is reserved for top-tier customers. It also comes with exceptions (more on that soon), that means a vendor can override their own policy over just a few weeks.

How we got here

On June 9, Anthropic launched its most powerful models, Fable 5 and Mythos 5, with a mandatory 30-day retention requirement on all traffic. It applied on every platform the models run on, including AWS Bedrock and Google Vertex AI, and it overrode zero retention agreements some businesses had already signed. Anthropic said the data was needed to detect misuse, would not be used for training, and would be deleted after 30 days “in almost all cases.”

Businesses didn’t buy it. Within a day, Microsoft restricted its own employees’ access to Fable while its lawyers reviewed the terms. Nvidia limited its use of Anthropic models to lower sensitivity work and leaned on its own Nemotron models internally. Palantir declined to offer Anthropic models through its software until Anthropic guarantees irrevocable zero retention. Booz Allen Hamilton, the US consultancy that does much of its work for defence and intelligence agencies, barred staff from using the commercial model for proprietary cybersecurity work.

A month later, Microsoft CEO Satya Nadella and Palantir CEO Alex Karp warned companies publicly against frontier AI dependence. “You essentially pay for intelligence twice,” Nadella said, “once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful.”

Vendors are now competing to repair the damage. On August 19, OpenAI reaffirmed full zero data retention for eligible enterprise and API customers on its frontier models. It previewed Private Safety Processing, a design in which content for eligible customers stays on infrastructure that the customer controls, or sits on OpenAI infrastructure encrypted under keys OpenAI does not hold. Automated systems scan it and return a narrow signal describing the category and severity of the activity.

On September 1, Anthropic announced Enterprise Frontier Safeguards, or EFS, which stores misuse-monitoring data in the customer’s own cloud account under the customer’s own encryption keys rather than in Anthropic’s. EFS was not available at announcement and is rolling out in phases later this fall, on Enterprise plans. In the meantime, the customers that Anthropic deems eligible get ZDR on Fable as a bridge.

Both fixes preserve monitoring. Where the records sit and who can read them may have changed, but no neither AI lab has committed to removing the records.

Why data retention has become a dealbreaker

Businesses that adopted enterprise AI accepted retention terms on the understanding that their data would be kept briefly, used only to catch misuse, and never used for training. Four things undermined that understanding.

A court can override a deletion promise. In May 2025, a preservation order in the New York Times lawsuit forced OpenAI to keep ChatGPT and API output logs indefinitely, including deleted chats and chats on the paid Team plan. The order lasted about four months and some of that data is still held. API customers with ZDR were not affected, because their data was never stored. But once a vendor keeps a copy, a court decides how long it exists.

US law reaches your data wherever it sits. Under the CLOUD Act, US authorities can compel a US company to hand over data in its possession, custody, or control, even if that data sits in a European data centre. An EU data residency option from a US vendor changes where your data is stored, not which government can demand it. Partners and contractors are part of this problem, not a footnote to it: Anthropic’s 30 day rule applied on AWS and Google Cloud too, and OpenAI says specialized third party contractors can access conversations for support, abuse investigations, and legal compliance. Customer-held encryption keys limit what a cloud provider can hand over, but they do not take the provider out of US jurisdiction.

The FBI can also issue National Security Letters without a judge’s approval. These demand subscriber and transactional records, meaning who used the service, when, and how much, rather than the content of conversations. They usually carry a gag order, so the vendor may be barred from telling you. That is why metadata matters even when content is deleted.

The US government can also simply switch the model off. Three days after the June 9 launch, a letter from the US Department of Commerce barred access to Fable 5 and Mythos 5 for non US nationals. Anthropic revoked customer access worldwide until controls lifted around June 30. For roughly three weeks, the most capable model on the market was unavailable outside the United States because a US agency decided it should be. No data handling term, however well drafted, protects against that. Availability is a jurisdictional risk too, and European buyers have started treating it as one: in a Proton survey of 1,500 European business leaders published this year, 74% said they worry a US authority could order a vendor to cut off their access.

Retention became the price of access. A ZDR contract a business had negotiated did not protect it on the model it most wanted to use. Firms bound by client confidentiality or sector regulation had to choose between the best model and their own obligations.

A distinction worth holding onto: “we don’t train on it” is not the same as “we don’t learn from it.” A vendor that keeps your prompts can still study them, which tasks you automate, what your workflows look like. Security experts quoted by Fortune say AI companies could use insights like these to improve future products without training on the data directly. That could help a vendor build something that competes with your product.

All the exceptions under zero retention

The headline number is rarely the whole policy. Read the retention terms and the same carve-outs appear again and again.

Abuse monitoring. Most AI APIs keep prompts and outputs by default so they can scan for misuse, typically for around 30 days, sometimes with human reviewers able to read them. Abuse monitoring was exactly the justification for Anthropic’s 30-day rule, and it is why you have to apply for ZDR. The current published defaults: OpenAI API, 30 days for abuse monitoring; Azure OpenAI, 30 days stored in Microsoft’s environment with human review limited to already flagged content, removable only by approval for modified abuse monitoring, which requires an enterprise agreement; Google’s paid Gemini Developer API, 55 days by default, configurable down to 7, 14, or 28, while Vertex AI runs 30 days. The number depends on which surface you are actually buying.
Flagged conversations. If an automated classifier decides a chat breaks the usage policy, the retention clock changes. Under Anthropic’s published terms, inputs and outputs flagged as violations can be kept for up to two years, and the trust and safety classification scores attached to them for up to seven. Classifiers make mistakes: a security team probing its own defences, or a researcher asking about chemistry, could trip one. Retention policies generally do not promise to tell you when it happens.
Data about your data. Even when the conversation itself is deleted, records about it can survive: classifier scores, account and user identifiers, timestamps, usage volumes, which tools or connectors were called. That is enough to build a detailed picture of how your company works. It is also exactly the kind of record a National Security Letter can demand.
Feedback buttons. A thumbs up or down sends the whole conversation with it. Anthropic keeps data submitted through feedback or bug reports for five years.
Files, memory, and agents. ZDR typically covers the model call, not the features wrapped around it. Uploaded files, vector stores, memory, saved chats, connectors, and agent sessions are stored until you delete them. Anthropic’s own policy, for example, excludes services “with longer retention under your control,” such as its Files API.
Personal accounts. If staff use AI on personal plans, your company’s data falls under consumer terms. Under consumer terms updated in late 2025, Anthropic users who allow their chats to be used for training have them retained for up to five years.

Deletion promises almost always end with exceptions for safety investigations and legal obligations, the “almost all cases” clause. Those exceptions are where your data stays longest.

The terms themselves are the risk

Anthropic has changed its policy: its newest models ship without Fable’s retention requirement, and EFS is on its way. But all of these changes prove that a vendor can change the terms on its own and go back on every agreement it has already made.

The AI vendor you use decides the terms for how your data is handled, and it can rewrite them whenever it chooses.

That’s why some companies have decided to keep sensitive AI work in house instead. Fortune’s report says that after the Fable announcement, security software firm Cinder saw a spike in ordinary companies asking how to run open models themselves.

Taking on that complex infrastructure is still rare, though. Menlo Ventures estimated that open source models made up 11% of enterprise LLM use in late 2025, down from 19% the year before. And that was before this summer’s backlash.

Businesses know that when they run a model themselves, security becomes their responsibility. Not many companies can take on that burden.

Five questions to ask your AI vendor

Start with an inventory: list every AI tool in use, and note which tier and which account, company or personal, each person is on. Then ask each vendor:

What exactly is retained on our tier, and for which models and features? Ask whether ZDR covers new models as well as current ones, and whether it covers uploaded files, memory, connectors, agents, and feedback, not just the basic API call.
What does abuse monitoring keep, for how long, and does a flag extend it? Ask who reviews flagged content, whether a human can read it, and whether you will be told when one of your conversations is flagged.
What survives when the conversation is deleted? Ask about classifier scores, metadata, logs held by partners and contractors, and backups.
Who can access retained data, and which governments can demand it? Ask whether employees and contractors can read it. Ask whether the vendor or any of its cloud providers is subject to the CLOUD Act, regardless of where your data is stored. Ask whether you will be notified of a subpoena or legal hold, and whether the vendor publishes how many government requests it receives, including National Security Letters. The New York Times order kept deleted chats on paid Team plans for months.
Can you change these terms, and with how much notice? Ask whether your ZDR agreement binds future models. In June, Anthropic’s new retention rule overrode existing agreements on its newest models from the day they launched.
What do you do about customers who chose your product precisely because you keep no records? Adversaries gravitate toward zero retention for the same reason enterprises do. Anthropic’s September threat intelligence report describes a platform that tunneled traffic through US infrastructure to evade regional blocks and used a ZDR service to route restricted research requests. Any credible vendor, including one with nothing to log, needs an answer to how misuse gets caught when there is no archive to inspect. If they can’t articulate one, that’s notable.

Choose a private AI

We built Lumo for businesses that want to work in private, and to have good answers to those questions. Lumo doesn’t keep logs of your conversations, and that’s the default for every user, not a feature reserved for top-tier contracts.

Chats you choose to save are protected with zero-access encryption, so only you can decrypt them on your device, and Proton can’t read them, hand them over, or study them.

Lumo doesn’t train on your conversations, and it runs on open-source models in Proton’s European data centres, under Swiss and EU law rather than US legal process. And because Proton is funded by subscriptions, not by building frontier models, we have no reason to learn from your data.

Learn more about Lumo

How stolen business credentials end up on the dark web — and what to do about it

Kate Menzies — Thu, 08 Oct 2026 15:10:24 GMT

A single stolen password doesn’t immediately cause chaos. It might be stored in a leaked database, or bundled with thousands of other records. Sometimes it is traded, resold, tested against other services, or used weeks later in a phishing campaign that looks unrelated to the original breach.

By the time a business realizes one of its accounts is exposed, the credential may already have passed through several hands. That is what makes dark web business credentials so difficult to manage. The breach may happen in one place, the data may appear somewhere else, and the attack that follows may target a completely different system.

By the time those credentials appear on the dark web, the breach has already happened somewhere. What becomes visible there is the next risk: who can find the data, who can reuse it, and how quickly the business can respond. Dark web business credentials are a valuable resource for cybercriminals, so your business needs to be prepared in the event that it’s affected by a data breach.

How business credentials get stolen

It can take days, weeks, or even months before a business notices that credentials have leaked. They may be captured through a fake login page, pulled from an infected device, exposed in a supplier breach, or reused from an old personal account, often ending up on dark web marketplaces where stolen data is bought in bulk.

Phishing

Phishing emails remain a common route for credential theft. An employee may land on a page that looks like a familiar SaaS platform, opens a document request that asks them to sign in, or follows a message that appears to come from a trusted service. Once the credential is entered, the attacker can try to use it immediately or store it for later. A single successful phishing attack can expose every system the compromised account can access.

Ransomware

Other leaks are less visible. During ransomware incidents, attackers may steal files before encrypting systems, including account lists, configuration files, passwords, and access records. A supply chain breach can expose credentials through a vendor, contractor, software provider, or managed service partner, even when the business’s own systems were not the first point of compromise.

Reused passwords

When employees use the same password across personal and work accounts, a breach outside the company can still become a business problem. Attackers do not need to break into the work system first. They can test already-leaked credentials across dozens of services and see where they still work, an attack known as credential stuffing.

Infostealer malware

Employee devices can also become a source of exposure. Infostealer malware is built to collect saved passwords, browser sessions, cookies, autofill data, and other sensitive information from a device. If that device is used for work, even occasionally, personal compromise can give attackers access to business accounts, tools, or communication channels.

By the time the credential appears in a criminal dataset or dark web source, the original theft may already be days, weeks, or months old. The business is not only dealing with a leaked password. It is dealing with uncertainty: where the credential came from, who has seen it, whether it was tested, and what else may have been exposed with it.

What happens after credentials are stolen

Once credentials are stolen, they rarely stay in one place. They may be added to a larger breach dataset, shared privately, sold in bulk, or used by different groups for different purposes. Some attackers want direct account access. Others want lists of valid business emails, passwords, session data, or admin accounts they can resell.

The value depends on what the credential unlocks:

A basic employee login may help with phishing or internal reconnaissance
A reused password can open multiple accounts
An admin credential may give access to settings, customer data, billing information, or user management
A financial account login can support payment fraud
SaaS credentials can expose documents, messages, project data, or customer records

Business data on the dark web becomes dangerous because it can be used to take destructive action. A credential may unlock an account, but even partial records can help attackers understand who to impersonate, which customers to target, which finance processes to imitate, or which employees to pressure next. What looks like a leaked database to the business may look like a set of opportunities to someone preparing fraud, phishing, vishing, or account takeover.

In our article introducing the Proton Data Breach Observatory⁠, we outlined that many breaches don’t make the news, which hides the true scale of the problem. Proton built the Observatory to show where business data is leaking onto the dark web and to help organizations understand emerging risks from real-world exposure.

What business data is most valuable on the dark web

The most valuable business data on the dark web isn’t limited to passwords or payment details. Attackers often look for any information that helps them access accounts, impersonate employees, target customers, or understand how a business operates.

Proton’s Data Breach Observatory⁠ shows how varied exposed business data can be, from names and email addresses to contact details, passwords, and other records that can support further attacks. Even partial information can become useful when combined with data from other leaks.

The business data most valuable to attackers usually includes:

Login credentials: Email addresses, passwords, session cookies, and authentication tokens can give attackers a direct path into business accounts. This risk is higher when employees reuse passwords across tools or when MFA is not enabled.
Employee information: Names, job titles, work emails, phone numbers, and organizational details can help attackers identify who to target and how to make a message look legitimate. This data can support phishing, impersonation, and business email compromise attempts.
Customer data: Names, contact details, addresses, account information, and purchase history can be used for fraud, identity theft, phishing, or social engineering. Even when this data does not include passwords, it can help attackers make scams more personal and convincing.
Financial and payment information: Invoices, bank details, billing records, tax documents, and payment data can support invoice fraud, payment redirection scams, or attempts to impersonate suppliers and partners.
Internal business documents: Contracts, supplier lists, project files, strategy documents, and operational records may not provide immediate account access, but they can reveal how the business works, who it depends on, and where attackers may find weaknesses.

Reused passwords, leaked credentials, and predictable combinations are the easiest ways into a business account, no exploit required, just a list and patience. But other exposed data still helps attackers build more targeted attacks. Once business information appears on the dark web, the risk is not only that one account may be compromised. The same data can be reused, combined, and exploited long after the original breach.

What to do if you find your business credentials on the dark web

While there is no precise estimate for losses caused specifically by dark web activity, it plays a role in a much larger cybercrime economy. An academic review, Global Cybercrime Damages: A Baseline for Frontier AI Risk Assessment, estimates total global cybercrime damages at approximately $500 billion per year, with a likely range between $100 billion and $1 trillion. Dark web forums and marketplaces contribute to this ecosystem by making stolen credentials, personal data, and business information easier to trade, combine, and reuse.

If business credentials are found on the dark web, your first priority must be reducing the chance that attackers can still use them. A credential that was exposed months ago may still be valid if the password has not been changed, multi-factor authentication (MFA) is missing, or the same password was reused across other tools.

1. Identify which accounts, employees, and systems may be affected

Reset the exposed passwords, revoke active sessions, and check whether the same or similar passwords were used elsewhere. If the account connects to email, file storage, finance systems, customer data, or admin panels, treat it as higher risk and review recent activity for suspicious logins, forwarding rules, permission changes, or unusual downloads.

If the exposed credentials involve personal data, assess whether the incident needs to be reported to the relevant supervisory authority, the ICO in the UK, the national data protection authority in each EU member state. Under both UK and EU GDPR, not every personal data breach is reportable, but organizations must notify when the breach is likely to pose a risk to people’s rights and freedoms. The ICO’s report a breach⁠ guidance can help businesses assess the incident and understand the reporting process.

2. Enforce MFA wherever possible

Make sure to focus on tools that contain sensitive business data such as email, admin accounts, and cloud platforms. If MFA was already enabled, review the authentication method and recovery options to make sure attackers cannot bypass it through compromised backup codes, weak recovery email accounts, or social engineering.

3. Notify affected internal users

Next, you need to inform team members who have been affected, and give clear instructions on what to change and what to watch for. Once credentials appear on the dark web, attackers may use them for credential stuffing, phishing, impersonation, or attempts to move from one compromised account into other business systems.

4. Review your access controls

Remove unused accounts, update permissions, check shared credentials, and make sure employees are using unique passwords for every business service. A password manager can help teams generate stronger passwords, store them securely, share access without exposing the password itself, and give admins better visibility into risky password behavior.

5. Keep monitoring for further exposure

Finally, keep monitoring for future exposure. Dark web data can resurface, be repackaged, or be combined with other leaks long after the original breach. Finding exposed credentials early gives the business a better chance to reset access before attackers turn leaked data into account takeover, fraud, or a wider security incident. A business password manager like Proton Pass for Business makes that easier by identifying vulnerable accounts and delivering data breach alerts in one place, so exposure surfaces without anyone having to go looking for it.

How Pass Monitor helps detect credential exposure

Dark web exposure is often delayed and fragmented. A leaked email address may appear in one dataset, a password in another, and related personal information somewhere else. Monitoring helps surface those signals sooner, before exposed credentials are quietly reused in account takeover, phishing, or fraud.

With a business password manager like Proton Pass for Business⁠, teams can store credentials in encrypted password vaults, generate unique passwords, autofill logins, share access securely, manage passkeys, and use built-in two-factor authentication. Admin features such as policies, reporting, logs, group management, SCIM provisioning, and SSO integration help keep access controlled as the business grows.

Our dark web monitoring tool is a feature in Proton Pass for Business that helps you identify business vulnerable accounts and receive data breach alerts in one place. It includes dark web monitoring, password health checks, and inactive 2FA alerts.

Pass Monitor can alert users when personal information is compromised in a data leak and identify reused or weak passwords. Password health estimates how long a password would take to crack, so a team can see the difference between a password that falls in seconds and one that would take years.

It also highlights accounts where 2FA is inactive, an important additional layer of security, and often the difference between a leaked password being an inconvenience and being a breach. Instead of waiting to find out about a data breach before it’s too late, give your business the tools it needs to protect itself.

Monitor your business credentials on the dark web with a business password manager⁠.

There’s only one way to stop AI stealing your business data

Kate Menzies — Wed, 07 Oct 2026 17:21:34 GMT

With every prompt, AI labs are ingesting more of your business data every day. Your only protection? A loosely-worded promise not to train on it.

A recent Lawfare analysis argues that when businesses hand their data to a few powerful AI labs, they are teaching those labs how to make them redundant. The authors call this replacement through knowledge acquisition (RKA).

While there is no way of knowing what AI labs do with your business data today, three converging forces are in play: largely unchecked power to set the terms, a legal system still grappling with what “training” even means, and both the ability and the incentive to compete with their own customers.

Your business may be feeding the beast that could ultimately consume it whole.

Do AI labs train on enterprise data?

The largest AI labs have made a concerted effort to assure business users that their data is private by default:

OpenAI claims that it does not train on inputs or outputs from ChatGPT for business users.
Anthropic claims that business data is excluded from training for Claude’s model by default.
Microsoft claims that prompts, responses, and data aren’t used to train Copilot.
Google claims that Gemini doesn’t train its model on business data without prior permission or instruction.
X claims that interactions on Grok business plans don’t improve its model, but will apparently use its own SpaceX employee data for training purposes.

In practice, their promises to protect their users’ privacy are intentionally vague, and thinner than they look:

Key terms are loosely defined. Lawfare points out that OpenAI’s enterprise agreement defines customer content as the input and output, then defines those using the words “input” and “output.” Anthropic’s terms rule out training models on customer content without defining what training means.
Some data may fall outside the promise. Patterns, metadata and summaries an AI generates but never shows you may not count as inputs or outputs at all.
“Training” is narrower than it sounds. Using your data to build test benchmarks, tune system prompts or train separate safety tools may not count.
The terms can change. Providers typically reserve the right to amend them, and every new model release is a chance to reset them.
You can’t check. Only the lab knows what goes into its training. A breach would be nearly impossible for you to spot.Proton founder and CEO Andy Yen has warned that once you share information with an AI, you can’t really take it back. Before long, he argues, AI “could know you better than even you yourself.” For a business, the stakes are higher.

What your business stands to lose

What an AI learns about your business is what makes it competitive. Big Tech knows that.

In a case that ran from 2019 to 2022, the European Commission investigated Amazon for using nonpublic data from third-party sellers to inform its own retail business — in effect, using sellers’ own data to compete against them. Amazon committed to stop, and the ban was later written into the Digital Markets Act.

In some industries, it’s not just a competitive edge at stake. Compliance is at risk too. Businesses in medicine and finance have a legal duty to protect sensitive information under rules such as HIPAA and the GDPR. Those rules are clear about securing personal data, but the AI industry is so new that a gray area is growing.

And with AI now built into meeting note-takers, email and everyday workflows, it touches far more of your business than it did when it lived in a chat window.

What AI labs stand to gain

AI labs have a financial and competitive incentive to ingest as much data as possible.

The AI market is set to keep growing dramatically, with Gartner speculating that AI will touch all IT work by 2030. It also forecast that AI spend would reach $2.5 trillion in 2026, a 44% increase on the previous year. Given the challenge of continuing to develop more intelligent AI models without significant training materials, AI firms are more likely to begin finding ways to benefit from their enterprise customers.

Exploding demand is forcing AI labs to become increasingly creative about the ways they can develop their models. And business data is clearly valuable to these labs: Google won a $10 million bid to purchase data from bankrupt airline Spirit Airlines in August. According to the Association of Flight Attendants, this data packet includes employee sensitive data. That data could be ingested and used to train Google’s AI models without the consent of those employees.

OpenAI claims that it does not train on inputs or outputs from its products for business users. But knowing about the enormous value of this data to businesses, we now need to consider the AI industry’s legal standing when it comes to processing data.

We can’t rely on regulation that might not come

Can regulation protect your business data from the largest AI labs? To grasp this, we must examine the financial and the political realities of the industry.

The US dominates AI. According Stanford’s Artificial Index Report, 59 notable models operate out of the US, the largest number of any country in the world. This dominance is important to note; in March, the White House released a national policy framework for regulating AI. It calls for state-level laws to be replaced with a federal AI policy framework to “protect American rights, innovation, and prevent a fragmented patchwork of state regulations that would hinder [US] national competitiveness.” The framework notes that state-level laws regulating AI must not be allowed to “act contrary to the United States’ national strategy to achieve global AI dominance.”

Is it more likely that the US government will prioritize the data privacy rights of individual businesses, potentially located outside the US? Or the expansion rights of its national AI empire? European businesses simply can’t guarantee that American AI tools will put their data sovereignty first. With the largest AI labs operating in the US, there’s an inflection point on the horizon.

A better choice for enterprise AI

Instead of hoping for regulation or trying to keep up with privacy policies, businesses have an easier and more effective option: choosing an AI tool built for privacy. There’s room for innovation without exploitation. The AI tool you choose should stay just that: an AI tool to assist you; not a competitor you’re training to take your place. It should seek to fulfill its function, growing over time, without poaching trade secrets.

Proton built Lumo to meet this need. With no incentive to collect or exploit user data, AI can be a transformative tool for businesses. Lumo keeps no logs of business chats, protecting your data from third parties and government surveillance. With an ad-free business model and no funding from Big Tech or venture capital, Lumo’s only incentive is to provide the best business support possible. Proton as a business is governed by the Proton Foundation, meaning that we act in the interest of people, not industrial domination.

Based in Switzerland, Proton is also regulated by stringent data privacy laws and the GDPR. Its code and model are both open source, so any business can verify our claims. Lumo is designed to do exactly what AI should do: provide assistance without exploitation. Choosing a European alternative to Big Tech’s AI tools is a business’s best way to protect itself from unregulated and untrustworthy AI labs.

Try Lumo for Business

5 signs you need a business password manager

Greg Ng — Wed, 07 Oct 2026 10:40:12 GMT

Small and medium-sized businesses (SMBs) rely heavily on informal password sharing practices. For people on small teams who trust their colleagues, it feels efficient — even if in the back of your mind you know it’s not secure.

In fact, our SMB Cybersecurity Report 2026 found that even respondents who had a password manager in their tech stack still shared credentials via email, messaging apps, shared documents, conversations, or in writing.

But credentials, when shared unsafely, create structural gaps in your security. As many as four in five small businesses have experienced a recent data breach, and a single incident can cost a small firm over $1 million.

If any of the following apply to your business, it may be time to replace shared credentials with a business password manager.

1. Your team collaborates on shared company accounts

If your team runs social media, manages a shared support inbox, or works in the same analytics or advertising dashboards, chances are multiple people need access to the same accounts.

In practice, this means credentials get shared so work can move forward. It also creates a security risk.

When multiple people use the same login, it becomes difficult to track who accessed the account or what actions were taken. You can’t control what you can’t see. If something goes wrong, there’s no reliable way to attribute activity to a specific user.

A business password manager allows teams to share access without exposing the underlying credential. The password remains encrypted and centrally managed while employees access the account when they need it.

2. You work with contractors, freelancers, or agencies

Maybe it’s a marketing agency managing campaigns, a freelancer updating your website, or a consultant reviewing analytics — at some point, most companies need external support.

To get work started quickly, it’s common to send them the credentials they need.

Once those credentials are shared, however, you lose control over where they’re stored and who might still have access to them. Access may persist long after the engagement ends. That puts business decisions, financial data, customer records, HR information, and strategic plans at risk of exposure.

A business password manager lets you grant access to specific credentials without permanently revealing them. When a project ends, you can revoke access immediately without resetting passwords across your entire team.

3. Your employees join and leave frequently

New hires need credentials on day one. People move between roles. And when someone leaves the company, you need to make sure they no longer have access to your systems.

If credentials are shared informally, offboarding becomes complicated. The only reliable option may be resetting passwords across multiple systems and redistributing them to everyone who still needs access. In practice, this process is often delayed or incomplete, leaving former employees with active access to company systems.

A business password manager centralizes how credentials are shared. It simplifies onboarding and offboarding. Access can be granted or revoked from a single place without forcing teams to reset and redistribute passwords repeatedly.

4. You need accountability for account activity

If your company works with larger clients or operates in regulated industries, you may eventually face security questionnaires, vendor risk reviews, and compliance frameworks like GDPR and HIPAA that all require clear access controls. Shared credentials make that difficult to demonstrate.

If multiple employees use the same login, there is no reliable way to attribute account activity to a specific individual. You may not control when these reviews occur, but you can ensure your access management practices hold up to scrutiny.

A business password manager provides centralized credential management and activity logs that make access easier to audit and verify. Each access request is tied to a specific user, and activity logs record when credentials are viewed or used. Instead of shared logins with no accountability, you get a clear record of who accessed what and when.

5. Your passwords are stored in browser vaults

Most browsers now offer to save passwords automatically. It’s convenient, and many employees rely on these built-in vaults to store credentials for the tools they use every day.

In many cases, saved passwords are tied to a browser account and synchronized across devices through the browser vendor’s cloud infrastructure. That means credentials are stored within large platform ecosystems operated by companies like Google, Apple, or Microsoft — the same companies that control the browsers themselves.

And because the credentials are managed within a broader platform account, you have limited visibility into where they’re stored, how they’re protected, and who ultimately controls the infrastructure.

A business password manager keeps credentials in an encrypted vault designed specifically to protect sensitive data. Instead of relying on browser infrastructure, access is managed centrally so credentials remain encrypted, controlled, and visible to your organization.

Take back control of your credentials

Without a password manager, businesses rely on habits they can’t fully control. Credentials get reused, stored in browsers, passed through chat, or written down in shared documents so teams can keep moving. Over time, access spreads across employees, devices, and services with little visibility into who has what.

A business password manager gives teams a secure way to store and share credentials while giving administrators centralized oversight. Access can be granted or revoked instantly, shared logins stay encrypted, and employees no longer need to rely on insecure workarounds to collaborate.

If your organization still depends on browser vaults, spreadsheets, or informal sharing practices to manage credentials, it may be time to rethink how access is controlled.

Learn more: Watch how Proton Pass helps businesses stop breaches and secure access