Last Updated: 22 July 2026
Proton just released Lumo 2.0. It's the biggest update to the company's privacy-focused AI assistant since it launched last year, and it changes the pitch in an important way.
This is a product that has always competed on a different promise: an assistant that cannot read your conversations, not even Proton itself, and now it's trying to do that without falling behind on raw performance.
The timing isn't an accident. Mainstream AI assistants have taken heat lately for mining conversations to train models, using behavior for profiling, and, more recently, slipping ads into chat products. Proton is positioning Lumo 2.0 as the answer to all of that, and it says so plainly. "We believe AI should empower people, not extract from them," reads the company's announcement, which honestly sounds less like marketing and more like something you'd find in a manifesto. Then there's the harder proof: Lumo stays fully open source. Anyone with the patience to dig through the code can check the encryption claims themselves. No need to just trust Proton on this one.
For a privacy-first tool, capability has always been the harder problem to solve. Lumo 1.4 scored 15 on the Artificial Analysis Intelligence Index, an independent benchmark built from ten evaluations that cover agents, coding, scientific reasoning, and general knowledge. Lumo 2.0 Lite jumps to 34, a 127% improvement. Lumo 2.0 Max goes further still, reaching 51, up 240%.
The rebuild changed how the assistant handles requests too. There's a new Fast mode for everyday queries, responding up to 76% quicker than the old version. Then there's Thinking mode, built for harder, multi-step problems, which shows its reasoning as it works so users can actually watch each step instead of waiting on a finished answer to appear out of nowhere.
Lumo 2.0 moves well past text. Give it a prompt, or even a rough sketch, and it'll generate or edit an image right inside the conversation. It can swap out a background, tweak colors, remove something you don't want in frame. The reverse works too: upload a chart, a document, a screenshot, whatever, and Lumo will read it and answer questions about what's on the page.
Two more additions round things out. There's deep web search now, which pulls back live results with citations, everything from breaking news to financial data to a plain weather forecast. And there's memory. Lumo can hold on to preferences and context from one session to the next, but the user gets to decide what sticks, what gets dropped, and what Lumo is never even allowed to learn. For anyone doing repeat tasks, Custom Lumos let people set up a standing assistant once (a writing tool that always drafts in one tone, say) and a doubled context window supports longer conversations and reasoning across bigger documents.
None of this loosens Proton's core guarantee. Zero-access encryption now covers the new features too, including images that users upload or that Lumo generates. Proton describes this as content nobody can access, not even Proton itself.
That guarantee rests on infrastructure Proton has already tested at scale, which matters more than it might seem. Lumo runs entirely on the company's own European servers, under Swiss privacy law, the same setup that secures more than 100 million Proton Mail and Proton Drive users.
A brand-new AI startup can promise almost anything. A company already securing that many email and cloud storage accounts has something harder to fake.
Lumo 2.0 is live now across three tiers. Free gets you private AI with the core capabilities. Lumo Plus adds unlimited chats, Projects, advanced image generation, and priority access to the fastest models. Lumo Professional targets teams, layering in secure collaboration without the usual risk of data leaks. Full details on pricing and features are available on Proton's blog.
Proton AG is based in Geneva, building privacy-first versions of the internet services most people already use: Proton Mail, Proton VPN, Proton Drive, Proton Pass, and now Lumo. Swiss privacy law covers all of it, and zero-access encryption isn't an add-on here. It's baked in from day one.
