Two chat assistants can both promise that your conversations are safe and mean two different things by it. Read as privacy focused AI assistant vs mainstream AI assistant, the comparison looks like an encryption contest, and the specification that actually separates them is what happens to your words in the seconds while the model is reading them.
This is an independent editorial review. Lumo did not review or approve this article.
The federal publication quoted below is a vocabulary rather than a verdict. It defines what counts as a privacy problem and rates no product at all, so it appears here to separate two claims that feature lists tend to merge.
What privacy focused AI assistant vs mainstream AI assistant actually measures
Encryption describes how data is protected from someone who should not have it. Privacy, in the sense the federal framework below uses, describes problems that can come from the processing itself. An assistant has to process your text to answer it, so the two specifications pull apart almost immediately.
| Specification | Privacy first assistant | Mainstream assistant |
|---|---|---|
| Transport protection | Encrypted in transit | Encrypted in transit |
| Stored chat history | Encrypted so the provider states it cannot read it | Usually readable by the provider |
| What the model receives | Cleartext, by necessity | Cleartext, by necessity |
| Retention after the answer | Stated as none on the model server | Varies, often retained for a period |
| Training on your text | Stated as excluded | Varies by product and account type |
| What you can verify yourself | Published code and policy text | Published policy text |
The one sentence that decides it is about cleartext
Proton’s own engineering write-up for Lumo does not dodge this. It explains that messages and attachments are encrypted at rest, and then states the limit plainly: “So we need to provide the LLM with cleartext messages.” End-to-end protection stops at the model, because a model that cannot read your question cannot answer it.
That is why the NIST Privacy Framework is the useful measuring stick rather than any encryption claim. It defines privacy risk as “the likelihood that individuals will experience problems resulting from data processing, and the impact should they occur,” and says managing cybersecurity risk “is not sufficient, as privacy risks can also arise by means unrelated to cybersecurity incidents.” It adds that “some problems can arise simply from individuals’ interactions with systems, products, and services.”
Put those together and the shopping question changes shape. Nobody is claiming a model can work on data it cannot see. What differs is what happens in the moment it can.
The difference between privacy focused AI assistant and mainstream AI assistant is what happens next
Once cleartext is a given on both sides, the difference between privacy focused AI assistant and mainstream AI assistant is a short list of commitments about the seconds after the answer is written:
- Whether the server that ran the model keeps a record. Proton says of its model server that “the request is not logged or retained by the LLM server after completing that request,” and describes it as one “which keeps no logs of your chats.”
- Whether the stored history is readable by the provider. Lumo’s page states that “All conversations with Lumo are stored with zero-access encryption, so no one (not even Proton) can access them.”
- Whether your text becomes training material. Proton says “we never use your data to train AI models.”
- What happens if someone gets your password, since the company notes that “your data remains secure as long as the thief doesn’t know your password.”
Each of those is a policy commitment rather than a mathematical guarantee, and that is the honest way to read them. The framework language above is useful precisely because it puts commitments and ciphers in separate columns.
Reading a privacy focused AI assistant versus mainstream AI assistant claim
A privacy focused AI assistant versus mainstream AI assistant claim is checkable in five steps, none of which needs any technical skill:
- Find the sentence that says what the model receives. If a page never mentions cleartext at all, it has skipped the hard part.
- Separate transit encryption from storage encryption. They are different promises and both are commonly listed as one bullet.
- Look for a retention statement about the machine that runs the model, not only about your account.
- Check the training commitment and which accounts it covers.
- Ask what is independently checkable. Published source code and a published policy are different kinds of evidence from a marketing badge.
What Lumo publishes, and what it leaves unstated
Taking the product at its word is easier when the word is specific. Lumo is presented as “The confidential AI chat assistant,” is described as “Built and based in Europe” and “outside of US jurisdiction,” and the footer names Proton AG at Route de la Galaise 32, Plan-les-Ouates, Geneva, Switzerland. The service is sold in a free tier and a paid tier, and it is open to buyers in the United States.
Two gaps are worth naming because they are the kind a comparison runs into. The page says Lumo is “Powered by open-source language models” and names none of them, so the component that receives the cleartext cannot be identified from the page. It also says “Lumo’s code is fully open source” without pointing at a repository or a license on that page, which makes the claim hard to act on even for a reader willing to check.
There is also a small internal mismatch of the sort worth reading carefully rather than suspiciously. The introduction describes the paid tier as giving “unlimited chats,” while the feature list for the same tier says “More messages & chat history.” Those are two different scopes written for two different readers, and the feature list is the one that describes a limit.
Choosing a privacy focused AI assistant or mainstream AI assistant for beginners
For a first purchase, privacy focused AI assistant or mainstream AI assistant for beginners is best decided by what you intend to type rather than by the specification sheet. If the answer is recipes, drafts and code snippets, the retention and training commitments are a preference. If it includes client details, medical notes or anything you would not paste into a public forum, the processing commitments stop being a preference and become the product.
The useful habit is simple. Decide in advance what you will not type into any assistant, then let the policy text decide which assistant gets the rest.
Related guides
- AI Workspace vs Individual AI Subscriptions: Domain.com
- Text to Video AI Tool vs Template Video Maker: invideo
- AI Product Video Maker vs Hiring a Videographer: Pippit
Frequently Asked Questions
These come up as soon as a reader notices that both sides of this comparison hand the model readable text.
Ques: Does zero-access encryption mean the provider never sees my question?
It describes stored data rather than the moment of processing. Proton states that stored conversations cannot be read by the company, and separately that the model is given cleartext messages in order to answer. Both statements are true at once, and they describe different stages.
Ques: Is a self-hosted model the only private option?
Running a model on hardware you control removes the third party, which is the strongest version of the argument above. It also moves every cost, update and failure onto you, so it answers the privacy question by changing the product rather than by comparing two services.
Ques: Does open source code prove the privacy claims?
Published code lets a reviewer check how a client behaves, which is more than a badge offers. It does not by itself prove what runs on a server you cannot inspect, so it belongs alongside the policy text rather than in place of it.
Ques: Which specification should a cautious buyer check first?
Retention on the machine that runs the model. Storage encryption protects an archive, and training policies protect a future, but retention decides how long your actual words exist in readable form on somebody else’s hardware.
You can see the current lineup here:
Bottom line
Both kinds of assistant read your text in the clear, because that is how the technology works. What separates them is what is promised about the moments either side of that, and those promises are written in policy pages rather than in cipher names. Read the retention sentence first.
