Echoing the points made across this thread regarding the need for ecosystem parity with Big Tech without compromising Proton’s core values.
Proton’s zero-access encryption and user-owned keys are the entire reason we trust this platform. Integration between Lumo and Proton Mail, Calendar, or Drive must keep zero-knowledge security non-negotiable.
The core bottleneck for Mail integration right now is that client side encrypted data cannot be indexed or manipulated server-side by an AI assistant without compromising zero-access principles. To solve this securely, Proton could implement Scoped Decryption Tokens:
Time-Limited Session Grants: Users generate a cryptographically bound, temporary session token (valid for 1h, 12h, or 24h) via their client side keys.
Granular Scope Isolation: Decryption authority is restricted strictly by scope targeting specific labels, folders (Inbox only), or date ranges, leaving the rest of the mailbox entirely inaccessible.
Ephemerality & Revocation: Lumo performs the designated triage (generating classification rules, sorting threads, proposing Sieve filters, or extracting calendar dates) entirely in transient, zero-persistence memory. Once the task finishes or the TTL expires, the token invalidates automatically, or it can be revoked instantly from the user dashboard.
Non-encrypted competitors provide convenience at the cost of total surveillance. Providing a mathematically bounded, opt-in mechanism like scoped decryption tokens would give Lumo the deep workflow integration we need while preserving Proton's privacy standard.
W.I.S.E.
Echoing the points made across this thread regarding the need for ecosystem parity with Big Tech without compromising Proton’s core values.
Proton’s zero-access encryption and user-owned keys are the entire reason we trust this platform. Integration between Lumo and Proton Mail, Calendar, or Drive must keep zero-knowledge security non-negotiable.
The core bottleneck for Mail integration right now is that client side encrypted data cannot be indexed or manipulated server-side by an AI assistant without compromising zero-access principles. To solve this securely, Proton could implement Scoped Decryption Tokens:
Time-Limited Session Grants: Users generate a cryptographically bound, temporary session token (valid for 1h, 12h, or 24h) via their client side keys.
Granular Scope Isolation: Decryption authority is restricted strictly by scope targeting specific labels, folders (Inbox only), or date ranges, leaving the rest of the mailbox entirely inaccessible.
Ephemerality & Revocation: Lumo performs the designated triage (generating classification rules, sorting threads, proposing Sieve filters, or extracting calendar dates) entirely in transient, zero-persistence memory. Once the task finishes or the TTL expires, the token invalidates automatically, or it can be revoked instantly from the user dashboard.
Non-encrypted competitors provide convenience at the cost of total surveillance. Providing a mathematically bounded, opt-in mechanism like scoped decryption tokens would give Lumo the deep workflow integration we need while preserving Proton's privacy standard.
**Food for thought**