VoltageGPU vs Lumo by Proton

Proton AG and VoltageGPU agree on the framing of the problem. The mainstream AI assistants, ChatGPT, Claude, Gemini, Copilot, process user prompts on infrastructure where the operator retains the technical and contractual ability to read those prompts, train on them, or hand them over under subpoena. For users who treat their AI assistant the way they treat their email client or their private notes, as a place where personal, legal, financial, or medical context routinely lands, that posture is not acceptable. Both Lumo and Personal Agent exist because the answer "trust the operator not to look" is the wrong answer for that use case, and a different architecture is required.

Lumo's architecture is zero-access encryption, the same primitive that has defined Proton Mail, Proton Drive, and Proton Calendar for over a decade. The encryption keys for user data are derived from the user's password and live client-side; the server stores ciphertext only; the Proton operator does not hold the cryptographic material required to decrypt the stored content. For an email at rest, a file in Drive, a calendar entry, this is exactly the right primitive, the code is open-source so the design can be audited, and the security record across the Proton product line is excellent. Applied to Lumo, zero-access encryption means the conversation history, the user account context, and the stored data the assistant references are all protected by client-side keys.

Personal Agent's architecture is Intel TDX confidential compute. The Qwen3-32B-TEE model runs inside a TDX guest VM where the workload memory is encrypted by silicon with an ephemeral AES-256 key bound to the VM lifecycle. The CPU-to-GPU PCIe bus is encrypted by trust-domain GPU passthrough so model weights, prompt tensors, and output tokens never cross the bus in the clear. An Intel DCAP attestation quote signed by the Intel root certificate is exposed per session, so the buyer can verify cryptographically that the configuration is the one they expect. The operator, VOLTAGE EI, French SIREN 943 808 824, is mathematically constrained from reading workload memory during processing, and the hardware produces fresh evidence of that constraint on every call.

The structural difference between the two architectures is which moment of the data lifecycle they protect. Zero-access encryption is excellent for data at rest and data in transit, the ciphertext on disk is unreadable to the operator, the TLS tunnel to the server is unreadable to anyone in the middle. The moment the architecture has to address is the moment of processing: an LLM cannot answer a prompt it cannot read, so at some point inside the server the prompt has to be available to the model in cleartext. Proton's architecture minimises that exposure window and surrounds it with strong operational controls and open-source code, but the cleartext processing moment is a structural property of how LLMs work. TDX is the architectural primitive that extends the cryptographic boundary into that processing moment, the prompt is decrypted inside the silicon boundary of the TDX guest, processed in encrypted memory the operator cannot read, and re-encrypted before leaving. Neither architecture is wrong. They protect different moments of the lifecycle, and the right choice depends on which moment matters most for the buyer.

Lumo wins on brand and on heritage. Proton has built the strongest privacy brand in Europe over a decade across Mail, VPN, Drive, and Calendar, the recognition is real, the security audits are public, the operational record under hostile regulatory pressure is documented, and a buyer who lands on Lumo lands on a product made by a team whose track record on privacy engineering is in the top tier worldwide. VoltageGPU is younger, has less name recognition, and is asking the reader to extend trust to a French sole proprietorship that does not yet have Proton's decade of public proof. For a buyer for whom brand trust is the dominant factor, and that is a perfectly legitimate factor, Lumo is the right answer and we recommend trying Lumo first.

Lumo wins on price. Lumo Plus is €9.99/month, roughly $11 in USD; Personal Agent is $20/month flat. For a single individual user buying a private AI assistant out of personal budget, that is a real difference, and a free tier exists for users who want to try Lumo before paying. Personal Agent has no free tier today, the $20 covers TDX hardware time on a 32B-class model, French operator costs, the Telegram bot infrastructure, and the attestation pipeline, and there is no margin to give away free usage at this price point. If the constraint is pure personal price, Lumo wins on the spreadsheet line. We do not have a counter-argument and we are not going to invent one.

Lumo wins on ecosystem integration for users already inside Proton. If your email is on Proton Mail, your files are on Proton Drive, and your calendar is on Proton Calendar, then Lumo plugs into a workflow that already exists, the assistant can reference your Proton-stored context through the same authentication boundary that already holds your other data. Personal Agent is standalone: it lives on Telegram, it does not know about your email or your files unless you paste them into the chat, and integrating it into a Proton-native workflow requires manual copy-paste. For users whose document gravity is on Proton, that ecosystem advantage is real and we are not going to argue with it.

Lumo wins on open-source verifiability of the client. Proton publishes the Lumo client code on GitHub, the cryptographic design has been documented in public papers, and the zero-access encryption pattern has been independently audited multiple times across the Proton product line. The VoltageGPU stack is partly closed-source, the orchestration layer and the TDX deployment pipeline are not public, the attestation verification endpoint is public, and the protocol-level interaction with the TDX guest is auditable through the DCAP quote chain. For a buyer for whom open-source verifiability of every line of code is a hard requirement, Lumo wins that property and Personal Agent does not.

Where the architecture difference matters is the moment of processing. Zero-access encryption protects the stored conversation and the network transport, the ciphertext sits at rest under client-side keys, the TLS tunnel carries the request to the server under transport encryption, and the operator cannot read either. What the operator does see, by the structural nature of how an LLM works, is the cleartext prompt at the moment the model is generating the response, the prompt has to be in cleartext for the model to process it, and that decryption happens inside Proton's infrastructure. Proton's operational controls around that processing moment are strong and the design minimises the exposure window, but the cleartext moment exists. Intel TDX is the architecture that extends the cryptographic boundary into that processing moment, the prompt enters the TDX guest still encrypted at the memory layer, the model processes it inside silicon-enforced encrypted memory, and the operator running the host cannot read workload memory even with full administrative access to the hypervisor. For workloads where the threat model assumes the operator is part of the attack surface, and that is the standard threat model for client files under bar-association secrecy, for patient records under HDS, and for any data subject to a foreign sovereign's extraterritorial discovery powers, TDX is the architectural primitive that closes the processing-moment gap and zero-access encryption is not. The honest summary: if your threat model ends at "the operator could be subpoenaed for stored data", Lumo handles it. If your threat model also covers "the operator could be subpoenaed or compromised at the moment of processing", Personal Agent is the architecture that addresses it.

There is an open-source dimension to Personal Agent that we want to be explicit about, because Proton has earned the right to ask hard questions about it. OpenClaw is the private-agent stack we publish at github.com/voltagegpu/openclaw, the agent runtime, the memory store, the tool-calling layer, the Telegram bridge, the DCAP attestation harness. The whole assistant, permissively licensed, documented end to end, designed so a technical user can clone it, point it at a TDX-capable host they procure themselves, and run their own personal AI under their own infrastructure. The buyer who wants Proton-level transparency at the agent layer can self-host OpenClaw and verify every line of code that touches their conversation.

Personal Agent at $20/mo is the same OpenClaw stack running on our TDX-sealed nodes, with us absorbing the operations work. Same agent code, same Qwen3-32B-TEE model class, same Telegram surface, same DCAP attestation primitive, except the buyer does not procure a TDX-capable server, does not maintain the bot tokens, does not chase Intel firmware updates, does not stand up the attestation pipeline. The hardware seal is identical whether you self-host OpenClaw or subscribe to Personal Agent, because the seal is enforced by Intel silicon, not by who owns the box. The $20 buys time, not the seal.

This is where the honest framing against Lumo lands. Proton publishes the Lumo client because client-side openness is what zero-access encryption requires for trust, the user has to be able to verify the client encrypts before sending. We publish OpenClaw because hardware-attested compute requires the agent code measured into the DCAP quote to be auditable, the buyer has to be able to verify what is being measured. Both products lean on the same principle: the privacy claim is only as strong as the code the buyer can read. The difference is which layer of the stack carries the cryptographic boundary. Lumo: client + transport. OpenClaw + Personal Agent: client + transport + processing. Same transparency discipline, applied to different architectural primitives.

Both Proton and VoltageGPU operate from EU-friendly jurisdictions and both are deliberately not US-controlled. Proton AG is Swiss and Switzerland's data protection law is among the strongest in the world, the Swiss Federal Act on Data Protection is GDPR-equivalent in substance, the country is outside the US Cloud Act's extraterritorial reach, and the Swiss legal tradition on banking and professional secrecy carries over naturally to digital data. VoltageGPU is operated by VOLTAGE EI, a French sole proprietorship registered under SIREN 943 808 824, which puts the processor directly inside the EU under French law and inside the home territory of GDPR Article 28. For most privacy-conscious individuals the practical difference between Switzerland and France is small, both are strong, both are not the United States, both produce defensible answers to a regulator. For specific professional use cases the difference matters at the margin: a French lawyer drafting a DPA under GDPR Article 28(3) finds French law the most natural anchor for the technical-measures clause, a French clinic processing HDS-scope data finds the French operator status simplifies the certification path, and a French firm preferring on-shore EU processing for political or procurement reasons finds French SIREN preferable to Swiss AG. None of this makes Proton wrong, Swiss is excellent. It just means that for some French professional buyers, on-shore French operator status is the cleaner answer.

The delivery surface is the other architectural difference and it is more practically consequential than the jurisdictional one. Lumo lives in a web app at lumo.proton.me and in dedicated iOS and Android apps, a clean dedicated surface, well-designed, integrated with the rest of the Proton ecosystem, the kind of product where the assistant feels like a real application. Personal Agent lives inside Telegram as a bot at @VoltageGPUPersonalBot, there is no new app to install, the user opens the messaging app they already use every day, types a question in a chat, gets a response. For users who are already on Telegram heavily, which is most of the under-35 European population, large portions of the legal and consulting professions, and almost everyone in Eastern Europe, the assistant is one chat away from every other conversation they are already in. The surface difference is not "which one is better"; it is "where does the user already live". Lumo wins for users whose digital life is centred on dedicated apps inside the Proton ecosystem. Personal Agent wins for users whose digital life is centred on Telegram and for whom a new dedicated app would sit unopened next to the existing 50 dedicated apps already on the phone.

The honest comparison ends with: you can pick either, both are real privacy, both are EU-anchored, neither is the wrong answer. If your data already lives on Proton Mail and Proton Drive and the workflow is "ask the assistant questions about my Proton-stored documents", Lumo is the structurally right answer and we recommend trying Lumo. If your workflow is "ask hardware-attested questions on Telegram about sensitive material that needs cryptographic proof the operator cannot read it during processing", Personal Agent is the structurally right answer and we recommend Personal Agent. For some users, and this is more common than the marketing of any single privacy product wants to admit, both are appropriate, used for different purposes, and the right answer is to subscribe to both. Privacy is not a single-vendor decision and the architecture tradeoff is not a zero-sum competition.