CEO Andy Yen's reported directives — skip pentesting, "that's ******** and loser thinking," "ruthlessly smash everything that stands in the way of AI velocity" — are documented, discoverable evidence that risk to customer data was consciously accepted to hit revenue targets. That record exposes Proton AG to civil claims and exposes the individuals who issued it personally. This post asks for one specific measure, in the company's own interest: board-level security governance that makes such orders structurally impossible.

Civil exposure. Proton AG answers under the Swiss Code of Obligations in contract (Art. 97 ff.) and in tort (Art. 41) for the conduct of its organs and employees (Art. 55, 101/102 OR). Where auxiliaries acted with intent or gross negligence, exculpation is excluded and pre-agreed liability limits do not cover intentional conduct. Directives that override documented security objections sit, at minimum, at gross negligence (culpa lata); the conscious acceptance of a known risk to customer data can be qualified as conditional intent (dolus eventualis). A breach would not lack claimants among ~100 million users; damages would include migration and switching costs, and consumer organizations can bring collective declaratory and injunctive actions (OR Art. 10a ff.).

Personal exposure. Company organs are personally liable toward third parties for unlawful, intentional or negligent acts (OR Art. 756) — a CEO who issues such orders is not shielded by the company he leads. Where personal data is affected, the criminal provisions of the Data Protection Act (Art. 60 DSG, intentional unlawful disclosure, prosecuted on complaint) and the Criminal Code's data offenses apply to natural persons, and breaches must be reported to the FDPIC (Art. 24 DSG). The internal record — Andy Yen's Slack messages, meeting recordings, and the CTO-authored AI manifesto reviewed by 404 Media — would form the central exhibit set, in civil proceedings and a criminal file alike.

The economics. Proton's entire price premium rests on trust. One preventable breach brings churn of high-value plans, refunds, forensic and audit costs, satisfaction claims, and regulator attention — against prevention costs measured in review time and pentest cadence. Cyber insurance typically excludes knowingly accepted risks. Companies are rarely ruined by a breach alone; they are ruined by the paper trail showing leadership ordered the risk.

The ask — governance, specifically:
1) A board-adopted security governance charter (duty of care under OR Art. 717): binding release gates, and documented risk acceptance — no security-relevant release without recorded sign-off visible to leadership.
2) A protected escalation channel for internal security concerns with explicit non-retaliation, decoupled from retention decisions.
3) Periodic independent audits of the gate process, summarized publicly.

Governance is not bureaucracy. It is the firewall that keeps a bad quarter from becoming an existential liability — for the AG, its leadership, and its community.