How to back up a Mac to Proton Drive

Short answer: Proton Drive solves confidentiality. It does not solve the thing backups are for, because sync still removes a file everywhere when you remove it once.

The encryption is real and it is good. It is also Proton's, keyed to your Proton account, which is worth thinking about before you make it the only copy.

What Proton Drive already does well

Proton Drive encrypts your files on your device before they are uploaded, and Proton cannot read them. That is end-to-end encryption in the sense the phrase is supposed to mean, and it is a genuinely different proposition from Dropbox or Google Drive, where the provider holds keys that can decrypt your data.

If your reason for avoiding the big providers is that you do not want a company reading your files, Proton has answered that. The macOS app needs macOS 13 or later and mounts here:

ls ~/Library/CloudStorage/

Why that still is not a backup

Confidentiality and durability are different problems, and solving one does not touch the other.

Deletions still propagate. Remove a file on your Mac and it goes from Proton Drive and from your other devices. Encrypted deletion is still deletion.
Damage still propagates. A file corrupted locally syncs up in its corrupted form, encrypted beautifully.
Version history is a paid feature, and it is bounded. Proton keeps previous versions on paid plans; the free plan gives you the current file and a trash bin. Either way it is a window of a few weeks.
The local copy is on your disk. Same disk as the originals, so one failure takes both.

So why encrypt a backup again before sending it?

This is the fair question, and the answer is not "because Proton's encryption is weak". It is not. There are three reasons, and none of them is about doubting the maths.

Account loss is not the same as data loss, unless it is. Proton's encryption is tied to your Proton account. Lose access to the account, whether by forgetting a password, losing a recovery phrase, or being locked out, and the files are gone in the way that matters. A backup encrypted with your own key, sitting in that account as opaque blobs, can be moved somewhere else and opened by you without Proton being involved at all.
It makes the destination interchangeable. A repository encrypted before it leaves your Mac is the same repository whether it sits on Proton Drive, on a USB stick, or on a NAS. You can move providers without re-encrypting anything or trusting the new one.
It is the only thing that stays true. Providers change plans, terms and companies. Encryption you performed yourself, with a key that never left your machine, does not depend on anyone keeping a promise.

None of this is an argument against Proton. It is an argument for the backup being a self-contained object you own.

Doing it yourself, in Terminal

Find the mount point, then archive, encrypt and record:

PD=$(ls -d ~/Library/CloudStorage/ProtonDrive-* | head -1)
tar -cJf - ~/Documents | openssl enc -aes-256-cbc -pbkdf2 -out "$PD/documents.tar.xz.enc"
shasum -a 256 "$PD/documents.tar.xz.enc" > "$PD/documents.sha256"

Check it later:

shasum -a 256 -c "$PD/documents.sha256"

The usual caveats apply. One archive, one passphrase, no history unless you make dated copies, and nothing to tell you when it stopped running.

The upload you cannot confirm

As with every third-party provider, macOS offers no supported way to ask whether a file in the Proton Drive folder has finished uploading. The status badge in Finder comes from Proton's own File Provider extension and is not readable by other software.

So a backup just written is, for some period, on your disk and nowhere else. Any tool telling you otherwise is guessing. Copy Shelter says which state it has actually established and counts only the copies it has checked.

Using the space properly

A Proton plan you already pay for is a good off-site destination, and off-site is the copy most people are missing. Copy Shelter writes an encrypted, versioned repository into a folder like that one: encrypted on your Mac with a key generated there and never transmitted, with a passphrase you choose and a recovery key written when the backup is created. Deleting a file on your Mac does not remove it from the backup, old versions stay until you decide otherwise, and every piece is read back and checked against the hash it was stored under on a schedule.

And because the format is documented and csctl reads a backup with nothing but the folder and your passphrase, the archive keeps working if you leave Proton, if we disappear, or both. That is the same reasoning that made you choose Proton in the first place, applied one layer further down.

Common questions

Proton Drive is already encrypted. Why encrypt the backup too?

Because Proton's encryption is keyed to your Proton account, and a backup encrypted with your own key is not. It can be moved to another provider or a drive and opened without Proton being involved, and it survives losing access to the account. It is about ownership and portability. The cryptography is sound.

Does Proton Drive keep old versions of my files?

On paid plans, yes, for a bounded period. The free plan gives you the current file and a trash bin. Either way it is a recovery window for a recent mistake.

Can Proton read my files?

No. Files are encrypted on your device before upload and Proton does not hold the keys. That is a real difference from Dropbox and Google Drive, and it is the main reason to choose it.

Where does the Proton Drive folder live on macOS?

Under ~/Library/CloudStorage/, in a folder beginning ProtonDrive-. The macOS app needs macOS 13 or later. Anything that can write to a folder can write there.

Is one copy in Proton Drive enough?

No, and that is not about Proton. One copy is one copy wherever it lives. Three copies, on two kinds of storage, with one of them somewhere else, is the rule worth following, and a cloud folder is a good candidate for the off-site one.

What happens to my backup if I stop paying Proton?

The account goes read-only or is eventually removed, on Proton's terms. That is precisely why a backup should be a self-contained object you can copy out and open elsewhere.