VoltageGPU vs Lumo by Proton

Proton AG and VoltageGPU agree on the framing of the problem. The mainstream AI assistants, ChatGPT, Claude, Gemini, Copilot, process user prompts on infrastructure where the operator retains the technical and contractual ability to read those prompts, train on them, or hand them over under subpoena. For users who treat their AI assistant the way they treat their email client or their private notes, as a place where personal, legal, financial, or medical context routinely lands, that posture is not acceptable. Both Lumo and Personal Agent exist because the answer "trust the operator not to look" is not enough for that use case.

Lumo's architecture is zero-access encryption, the same primitive that has defined Proton Mail, Proton Drive, and Proton Calendar for over a decade. The encryption keys for user data are derived from the user's password and live client-side; the server stores ciphertext only; the Proton operator does not hold the cryptographic material required to decrypt the stored content. For an email at rest, a file in Drive, a calendar entry, this is exactly the right primitive, the code is open-source so the design can be audited, and the security record across the Proton product line is excellent. Applied to Lumo, zero-access encryption means the conversation history, the user account context, and the stored data the assistant references are all protected by client-side keys.

Personal Agent's architecture is different, and narrower. Your message reaches our web app, is stored as a job in our Postgres database and is read by the agent worker on our server, which runs OpenClaw; the reply is stored with the job. Only the model runs inside an Intel TDX trust domain at our inference provider, whose memory the CPU encrypts so that host cannot read it. GET /v1/attestation returns the TDX quotes of the instances serving our models, on a nonce you choose; it does not prove that a given reply came from them.

The structural difference is which part of the path each one protects. Zero-access encryption keeps stored conversations unreadable to Proton. Our setup keeps the model's memory unreadable to the host that runs it, but our own servers read and store each message. On stored conversations, Lumo protects more than we do; on the model host, TDX adds a hardware boundary that Lumo does not publish. Neither covers everything, and the right choice depends on which part matters most for the buyer.

Lumo wins on brand and on heritage. Proton has built the strongest privacy brand in Europe over a decade across Mail, VPN, Drive, and Calendar, the recognition is real, the security audits are public, the operational record under hostile regulatory pressure is documented, and a buyer who lands on Lumo lands on a product made by a team whose track record on privacy engineering is in the top tier worldwide. VoltageGPU is younger, has less name recognition, and is asking the reader to extend trust to a French sole proprietorship that does not yet have Proton's decade of public proof. For a buyer for whom brand trust is the dominant factor, and that is a perfectly legitimate factor, Lumo is the right answer and we recommend trying Lumo first.

Lumo wins on price. Lumo Plus is €9.99/month, roughly $11 in USD; Personal Agent is $20/month flat. For a single individual user buying a private AI assistant out of personal budget, that is a real difference, and a free tier exists for users who want to try Lumo before paying. Personal Agent has no free tier today: the $20 covers the model calls in Intel TDX, the operator costs and the Telegram bot infrastructure. If the constraint is pure personal price, Lumo wins on the spreadsheet line. We do not have a counter-argument and we are not going to invent one.

Lumo wins on ecosystem integration for users already inside Proton. If your email is on Proton Mail, your files are on Proton Drive, and your calendar is on Proton Calendar, then Lumo plugs into a workflow that already exists, the assistant can reference your Proton-stored context through the same authentication boundary that already holds your other data. Personal Agent is standalone: it lives on Telegram, it does not know about your email or your files unless you paste them into the chat, and integrating it into a Proton-native workflow requires manual copy-paste. For users whose document gravity is on Proton, that ecosystem advantage is real and we are not going to argue with it.

Lumo wins on open-source verifiability of the client. Proton publishes the Lumo client code on GitHub, the cryptographic design has been documented in public papers, and the zero-access encryption pattern has been independently audited multiple times across the Proton product line. Personal Agent runs OpenClaw, whose code is public (github.com/openclaw/openclaw), but our webhook and worker are not, and GET /v1/attestation covers the model instances only. For a buyer for whom open-source verifiability of every line of code is a hard requirement, Lumo wins that property and Personal Agent does not.

Where the architecture difference matters is who can read what. With Lumo, the operator cannot read stored conversations, and the prompt is in cleartext only at the moment of processing inside Proton's infrastructure. With Personal Agent, the model processes the prompt inside an Intel TDX enclave whose host cannot read it, but the prompt is also stored in clear in our database and read by our worker before and after. If your threat model is the operator reading stored conversations, Lumo handles it and Personal Agent does not. If you want the model itself to run in a hardware-isolated enclave, under a French operator, Personal Agent offers that, with our servers still in the path.

OpenClaw is an open-source agent runtime published by its own maintainers (github.com/openclaw/openclaw), not by us: the agent, its memory and its tools, which a technical user can install and run on their own machine. The buyer who wants full transparency at the agent layer can self-host it.

Personal Agent at $20/mo runs OpenClaw on our server, with us doing the operations: you do not install Node, run a Telegram bot or manage model keys. The model runs inside an Intel TDX enclave at our inference provider; the OpenClaw runtime itself runs on our server, not in an enclave.

This is where the honest framing against Lumo lands. Proton publishes the Lumo client because zero-access encryption needs a client the user can verify. OpenClaw is public because its maintainers publish it; what we add is the hosting, our server and our database, which you have to trust. Lumo puts the boundary around stored data; Personal Agent puts it around the model.

Both Proton and VoltageGPU are operated from EU-friendly jurisdictions and neither company is US-controlled. Proton AG is Swiss and Switzerland's data protection law is among the strongest in the world, the Swiss Federal Act on Data Protection is GDPR-equivalent in substance, the country is outside the US Cloud Act's extraterritorial reach, and the Swiss legal tradition on banking and professional secrecy carries over naturally to digital data. VoltageGPU is operated by VOLTAGE EI, a French sole proprietorship registered under SIREN 943 808 824, which puts the controller directly inside the EU under French law and inside the home territory of GDPR Article 28; our web host and our inference provider are US companies, listed in our sub-processor register. For most privacy-conscious individuals the practical difference between Switzerland and France is small. For specific professional use cases the difference matters at the margin: a French lawyer drafting a DPA under GDPR Article 28(3) finds French law the most natural anchor for the technical-measures clause, and a French firm preferring a French counterparty for procurement reasons finds French SIREN preferable to Swiss AG. None of this makes Proton wrong, Swiss is excellent.

The delivery surface is the other architectural difference and it is more practically consequential than the jurisdictional one. Lumo lives in a web app at lumo.proton.me and in dedicated iOS and Android apps, a clean dedicated surface, well-designed, integrated with the rest of the Proton ecosystem, the kind of product where the assistant feels like a real application. Personal Agent lives inside Telegram as a bot at @VoltageGPUPersonalBot, there is no new app to install, the user opens the messaging app they already use every day, types a question in a chat, gets a response. For users who are already on Telegram heavily, which is most of the under-35 European population, large portions of the legal and consulting professions, and almost everyone in Eastern Europe, the assistant is one chat away from every other conversation they are already in. The surface difference is not "which one is better"; it is "where does the user already live". Lumo wins for users whose digital life is centred on dedicated apps inside the Proton ecosystem. Personal Agent wins for users whose digital life is centred on Telegram and for whom a new dedicated app would sit unopened next to the existing 50 dedicated apps already on the phone.

The honest comparison ends with: you can pick either, neither is the wrong answer. If your data already lives on Proton Mail and Proton Drive and the workflow is "ask the assistant questions about my Proton-stored documents", Lumo is the structurally right answer and we recommend trying Lumo. If your workflow is "ask questions on Telegram, under a French operator, with the model in an Intel TDX enclave", Personal Agent fits, knowing our servers read and store the messages. For some users both are appropriate, used for different purposes. Privacy is not a single-vendor decision and the architecture tradeoff is not a zero-sum competition.