Proton Lumo 2.0 Locks Your Prompts Away From AI Training

The real test for Proton Lumo 2.0 isn’t whether it can answer a prompt. It’s whether users can trust what happens to that prompt after they hit send.

Proton has launched Lumo 2.0, a second-generation private AI chatbot that the company says is never trained on user data, according to ZDNet. That claim is the product’s sharpest edge. For anyone using AI to summarize sensitive notes, draft confidential messages, analyze files, or ask questions they wouldn’t want recycled into future model training, the privacy model matters as much as the answer quality.

Why should ChatGPT users care that Proton Lumo 2.0 says it won’t train on their prompts?

A chatbot prompt can contain more than a question. It can contain work product, private correspondence, unpublished plans, or personal context that the user didn’t mean to hand over as training material.

That is the pressure point Proton Lumo 2.0 is trying to exploit. Proton’s pitch is plain: use an AI assistant without turning private conversations into model-improvement fuel. The company says conversations, data, and inputs are not used to train the AI model.

This matters because the AI assistant market has split into two decision paths. One path prioritizes maximum capability. The other prioritizes control over data. Lumo 2.0 sits firmly in the second camp, even as Proton adds features meant to narrow the functionality gap.

Proton says more than 10 million people have used Lumo to date. It also says Lumo 2.0 recorded a 127% improvement over Lumo 1.4 on the Artificial Analysis Intelligence Index, across areas including speed, reasoning, and knowledge.

For more context on the product’s feature push, see XOOMAR’s coverage of Proton Lumo 2.0 challenging ChatGPT with private images.

What is Proton Lumo 2.0, and why is Proton building a private AI chatbot?

Proton is best known for Proton Mail and Proton VPN, products built around encrypted communication and privacy-first positioning. Lumo extends that brand into AI.

Lumo first arrived in 2025 as a privacy-preserving alternative to general-purpose AI assistants such as OpenAI’s ChatGPT and Anthropic’s Claude. It can answer questions, search the web, generate text and images, and analyze uploaded files, according to ZDNet’s summary of Proton’s announcement.

The 2.0 release is Proton’s biggest Lumo update since launch. The company says the assistant’s architecture has been overhauled, and the new version now runs entirely on Proton’s European infrastructure.

That infrastructure claim is central to the product. Proton is based in Geneva, and ZDNet notes that Swiss privacy laws align with many GDPR principles while going further in areas such as the guaranteed right to privacy and strict requirements for foreign data requests.

The strategy is obvious. Proton wants privacy to become a feature users actively choose in AI, not a footnote buried in settings.

How does Proton Lumo 2.0 lock down chatbot data under an EU-style privacy model?

Proton’s privacy claim has several layers, and they shouldn’t be blurred together.

First, Proton says Lumo 2.0 does not train on user conversations. That is different from saying no data ever touches a server. A cloud AI assistant still needs to process the prompt to generate a response.

Second, Proton says Lumo uses zero-access encryption. Messages are encrypted across the network, including Proton’s internal pipeline, until they reach the LLM. After a response is generated, the information is stored locally so only the user can access and decrypt it, according to ZDNet.

Proton describes it this way:

"Your messages are encrypted across the entire network, including Proton's internal pipeline, until they reach the LLM, which keeps no logs of your chats," Proton says. "On the way back, the reply is secured with the same encryption strategy, ensuring your message never crosses any network boundary unencrypted."

Third, Lumo includes Ghost mode, which users can enable so chats disappear once the conversation ends.

The privacy stack looks like this:

The important distinction: “not trained on your data” is a training-policy claim. “Zero-access encryption” is an access-control claim. “European infrastructure” is a data-location and legal-risk claim. Together, they form Proton’s case, but each should be evaluated separately by serious users.

How would Proton Lumo 2.0 handle a sensitive work prompt compared with a typical AI assistant?

Take a founder who wants to summarize an unreleased investor memo. The document includes revenue discussion, hiring plans, and product strategy.

With a standard AI assistant, the founder may need to check whether chats are retained, whether prompts can be used for training, whether an opt-out exists, and whether the account is covered by consumer or business terms. That review takes time, and the wrong setting can matter.

With Proton Lumo 2.0, the selling point is simpler: Proton says that prompt won’t be used to train the model, and the conversation is protected by its zero-access encryption design. If the founder enables Ghost mode, the chat is also meant to disappear once the conversation ends.

That doesn’t make Lumo a free pass for every category of confidential data. Regulated information, legally privileged material, and sensitive client files still require policy review. Users need to understand their own compliance duties before uploading anything.

The practical shift is the risk calculation. If the answer quality is good enough, a privacy-first assistant reduces one major objection to using AI on sensitive work: fear that the input becomes part of someone else’s model pipeline.

What trade-offs come with choosing Proton Lumo 2.0 over larger AI chatbots?

Privacy-first AI still has to compete on usefulness. Proton knows that, which is why Lumo 2.0 adds more than privacy controls.

The update includes:

• Fast mode: quicker replies for basic queries.
• Reasoning mode: deeper answers for multi-step tasks.
• Images: support for processing text and images in the same conversation, plus improved image generation.
• Web search: live results with citations, aimed at reducing errors and hallucinations.
• Memory: user-controlled retention of preferences and context.
• Projects: secure workspaces for conversations, files, and instructions.
• Custom personas: user-defined roles such as trainer, teacher, or personal assistant.

That gives Lumo a broader feature set than a bare-bones private chatbot. Still, users should test it against their current assistant with identical prompts.

A realistic comparison should include:

• Quality: Does it answer well enough for your actual work?
• Files: Can it handle the documents you need analyzed?
• Web: Are citations useful and current?
• Images: Does multimodal support meet your use case?
• Collaboration: Are Projects and business tools enough?
• Cost: Does the paid tier match your expected usage?

For adjacent AI safety context, XOOMAR has also covered how Meta chatbot testing dragged teen safety into the dark. Different issue, same broader lesson: AI products are now being judged on governance, not just output.

Who should try Proton Lumo 2.0 now, and who should wait before switching?

Proton Lumo 2.0 is an obvious trial for existing Proton users, privacy advocates, journalists, consultants, small business owners, and anyone who has avoided AI tools because of training-data concerns.

The free version is available to try, though ZDNet reports users need to sign up for an account. For heavier usage, Lumo Plus costs $9.99/month and includes unlimited daily chats and history, web search, large-file upload and analysis, access to advanced AI models, and priority support. Lumo Professional starts at $11.99/month and adds business-oriented features such as secure collaborative tools, cloud storage, email aliases, and additional Proton security features.

Enterprises, healthcare teams, legal teams, financial firms, and developers under strict review should move slower. Proton’s claims are strong, but procurement teams still need to examine terms, retention rules, auditability, access controls, and internal approval requirements.

A practical checklist:

• Training: Confirm whether chats train models.
• Retention: Review chat history and deletion controls.
• Encryption: Check what is encrypted, when, and from whom.
• Location: Understand where processing occurs.
• Quality: Test your real prompts, not demo prompts.
• Fit: Decide whether privacy or maximum capability matters more for the task.

The next question won’t be whether Lumo 2.0 is private enough for Proton loyalists. It will be whether its answers, file tools, image features, and business controls are good enough for users who want privacy but won’t accept weaker AI.

Key Takeaways

• Lumo 2.0 targets users who want AI help without their prompts being used for model training.
• Proton says more than 10 million people have used Lumo, showing demand for privacy-focused AI tools.
• The reported 127% benchmark improvement suggests Proton is trying to close the gap between privacy and performance.