The company has confirmed that Lumo, its newly launched AI chatbot positioned as a privacy-friendly ChatGPT rival, is the first to move. Servers for the product are now being housed in Germany, with Norway also in the frame for future operations. This comes amid serious grumbling about amendments to the country’s existing surveillance ordinance, which would force VPNs and messaging apps to identify users and store their data for up to six months.

Proton has been vocal about its opposition since May. In a statement roton’s head of anti-abuse and account security Eamonn Maguire said: “Because of legal uncertainty around Swiss government proposals to introduce mass surveillance, proposals that have been outlawed in the EU, Proton is moving most of its physical infrastructure out of Switzerland. Lumo will be the first product to move."

CEO Andy Yen said the move was driven directly by the proposed legal changes, confirming to Swiss media that Germany would be the new home for Lumo. He added that the firm is still “investing in Europe,” despite not explicitly ditching Switzerland altogether.

The offending law, known as the Ordinance on the Surveillance of Correspondence by Post and Telecommunications (OSCPT), demands user identification, metadata storage, and the ability to decrypt communications if the provider holds the keys. It would apply to all services with more than 5,000 users.

Proton's stance has received support from others in the privacy space. NymVPN, another encrypted provider, said in May it too would leave the country if the law passes.

Co-founder and COO Alexis Roussel told TechRadar, “You cannot invest in privacy in Switzerland right now,” adding that Proton’s move made total sense under the circumstances.

Nym is looking to shift out of Switzerland and the EU as a last resort, but its decentralised infrastructure means it doesn't hold encryption keys, possibly shielding it from some aspects of the new regulations.

Encrypted messaging app Session has also weighed in, saying its decentralised architecture makes it more resistant to the changes, though it remains wary and is watching the situation unfold.

Proton, meanwhile, insists that investing within the EU does not automatically subject it to other pending rules like Chat Control or ProtectEU.

A company spokesperson pointed out that mandatory data retention has already been ruled illegal several times by European courts, but added that the company would “continue to monitor developments in the EU closely, as we do elsewhere.”