It's amusing to see people here continuing to recommend Google tools for core aspects of some shiny, fragile, new startup despite so many, many posts and comments on HN having been placed time and time again describing how arbitrary that monster can be about cutting you completely down from whatever it offers you for some bullshit algorithmic reason or another, and with near zero customer service recourse.
By now Google often acts worse than the complaints departments of many government agencies, which at least usually by law have to have a human accesible to you somewhere along the line. Yet it keeps getting recommended by either the clueless or the indifferent.
Yea, my dumbass used Google voice as my main 2fa number and recently lost access to it. Can't get it back and I'm locked out of everything. Don't be like me. Google really can't be trusted for personal or business use. If I could talk to a human and pay $100 for it I would.
Problem is eventually you need it for Google Ads, or YouTube really for many things. And none of them are "vital" if they go wrong. They aren't core income pipeline parts. And then you get sucked in.
B2B and go to a conference? Where are you putting your video demo reels/talks? YouTube
Consumer and testing marketing messages for something non-consumer? Google Ads.
Your B2B client wants you to provide your SaaS via a private endpoint on GCP? What else are you going to do than use GCP?
Then once you are on it on company computers, it's a short walk to Google Docs and then Google Workspace, etc.
Needing Google occasionally is understandable but keeping it to a minimum and as disconnected as possible from core business functionality, and as replaceable as possible if things go sideways with its brainless algorithms, is absolutely doable.
Please, enough justification for why almost anyone generally "needs" Google.
For example:
>B2B and go to a conference? Where are you putting your video demo reels/talks? YouTube
Really? Simply no alternatives exist? I guess Vimeo is just a curious internet legend.
>Your B2B client wants you to provide your SaaS via a private endpoint on GCP? What else are you going to do than use GCP?
So explain to the client why you prefer not to use Google, but if they insist, then keep it specific to them and avoid it for anything generally essential to your business. You state this as if nearly a dozen alternatives to Google Cloud don't exist.
>Then once you are on it on company computers, it's a short walk to Google Docs and then Google Workspace, etc.
Don't take that short walk then, take another one instead.
The point is that alternative solutions do usually exist and even where Google becomes unavoidable, it absolutely shouldn't mean having to fully embrace its services.
I agree with you as a technical guy. It's not the worst. But as to why is happens:
If your business-focused founder or Marketing guy is going to the conference, it'll be Youtube, even though Vimeo is accessible. Unless you go make the account, share it to them, and have a SOP, why would they look at Vimeo?
The problem is when you get any sort of size the non-tech people choose Google as a default and then it (with weak force) slowly black holes up what they do. Just like people chose Microsoft Office (and still do for mature corps) for all kinds of admin, not necessarily technical people using Google (although I would say >80% of the tech graduate emails I am given for contact past graduation are gmail which is a sign of the times!)
The rule is simple. Google is fine for anything not in the critical path.
Need something to spread on social media? Fine. Post on Twitter, Facebook, Google, go nuts.
Never use Google (or other sketchy vendors) for anything you need to rely on to be there tomorrow.
Example: Youtube is fine for promotional materials. If you run an ed-tech and need videos to be there for students (core business), pay for something which works.
Example: Running a Black Friday promotion? Adwords. Relying on Google SEO for your main business as the main way to recruit customers? Bad idea.
You get one exception to this if you're building a Google-centric business. Is your business an Android App? You obviously get to use Android in your core business. If your business a Youtube channel? You get to use Youtube.
Things like Google Workspace, Google Cloud Platform, etc. are out. If, tomorrow, Google decides to wipe all you Google Workspace data (yes, it did this to a startup I was involved with), you're DOA. Office 365 is annoying compared to Google Workspace, but still worth it, since Microsoft won't wipe out your business as a statistic.
The way I think about this is each business has risks which multiply out:
(failed to execute technically) * (odds of market fit failing) * (odds of not being defrauded by your co-founder) * ....
This should multiply out to how likely your startup is to succeed. The way exponentials work, most of those risks need to be very, very low. You get one, maybe two, big ones. Every Google product in the core critical path has perhaps 10% odds of wiping out your business. Adopting Android is totally worth it if your business is Pokemon Go, but for most aspects of your business, pick trustworthy vendors.
At a startup you can run your company on the communication tools provided in Google workspace. There's much more to this than calendar and email. Tagged comments for coordinating actions, using gdocs with meetings and transcription and summarization by Gemini, communal editing and sharing, the gdocs history, sheets and slides, backup and logging tools, domain management and more. If you use proton, you get Google workspace from 15 years ago, at best.
I suggest Zoho one. It's been in service for many many years. It's not as feature rich as Google or MSFT, but their service is fantastic and gives you all options a small business needs (office, marketing, CRM, sales, HR, Finance among others).
I pay for it. I dont do anything super fancy, and its been working fine for two years now. I think the cost is low enough that I'm happy paying and not thinking about email setup, and happy I'm not paying google
In my opinion, E2EE comes with too many compromises to be worth it for most people and/or companies. Proton wasn't evolving quickly enough, so I switched to Fastmail.
Email aside, no CardDav/CalDav is a dealbreaker for me.
I went from Proton to Fastmail and then Migadu. But I think that it is not really answering the question.
The question is about a Business Suite similar to the Google Suite. I don't think that Fastmail provides a Drive or Docs (as far as I know they have mail, contacts and calendar, right?).
Not to say that Proton is a perfect alternative: Proton Docs is pretty new and doesn't have the excel/powerpoint equivalents that Google has.
I am bootstraping, and have used proton for years as my only email, but have my own email now, and am slowly backing out of proton. The horrible way that they extort by limiting and degrading a service is only part of the problem.They degraded email replies at one point, to a tiny "page" with less than one full line of text.
There is more, but proton is not worth the effort to remember and detail all of it.
I will use google or any other service for building up an advertising presence.
And keep the proton, until everything is moved.
And then again, pragmatism might decide in favor of useing the proton service, but only as the core of my business is seperate,and will spread my
add bucks around, so I feel safe.
Currently have NO guggle anything, because of past denial of service, and will only use them for the advertising side as well.
> The horrible way that they extort by limiting and degrading a service is only part of the problem.They degraded email replies at one point, to a tiny "page" with less than one full line of text. There is more, but proton is not worth the effort to remember and detail all of it.
Are you saying they made it so that you cannot send replies with less than one full line of text? I don’t think I’ve seen or heard of Proton doing that.
Same here. When you say your own email, do you mean Fastmail? I love Proton and they got me and my SO largely off of Google. Fastmail is just so good, I’m going to migrate everything there eventually.
I migrated from gmail to proton then to fastmail and I can now really appreciate how much more polished gmail was.
My biggest pain is fastmail's ios app, e.g. clicking on an email notification will in 50% of cases result in fastmail's app to open in an unresponsive state where I have to forcefully quit the app and start again. It's been like that for close to two years now.
I think most business people dont care about clients at all because they use IMAP/SMTP/carddav/caldav.
Once you have more than one mailbox then its kinda the only way. So apple mail, thunderbird etc. And then you mostly get some quality provider mailbox.org, fastmail, infomaniak or whatever but its all the same.
> When you say your own email, do you mean Fastmail?
Not sure what they mean, but at the very least I think you should have your own domain. So that you can migrate without changing the email address (and having to ask all your contacts to update to the new one).
I have used it now for almost 7 years running a law firm. It's worked great for exactly our use case: privileged emails, including attachments, can be time and passworded with legit TNO encryption. I initially used nextcloud/webDAV for our own calendar, but switched over recently to protonmail and it hasn't been an issue. Some storage space is useful. Haven't used the VPN. It's a boutique firm. We have only 4 employees. YMMV
I am also interested because of Proton’s commitment to privacy and Google’s commitment to…the opposite. But I would think Proton will not (yet?) have the type of controls most businesses need to administer a company wide service and manage confidentiality, security, etc.
email wise whats cumbersome with proton is it tries to upsell me again and again with its add-ons.
on google workspace i can say the best advantage is how almost 90% other sites out there supports signing in with google. and it's also cheap at $6 per head, and it doesnt harass you with upsells unlike proton.
The backup mitigates the problem because, if you are banned, which only happens to fools and fakes, you can take the backup and set it up on another service. Sure, you lose a couple of days of time migrating, but that's not a reason to avoid choosing a better solution.
A couple of days migrating can be a 100K+ outage in lost work if you have around 50 employees.
And for this estimation, I’m really taking your word that migrating 50 people in an emergency is really going to take only a couple of days, which I honestly don’t believe.
Sure, if you get a business account for your solo business, a backup will save you. If you have more people or a non trivial Google setup, the backup recovery is it’s on challenge while you could be working on your business if they didn’t, in this hypothetical but very possible scenario, lock you out of your business tools.
I've used their calendar and email. The calendar has had issues over the past few months where it would revert unexpectedly and silently back to a previous date (like they reverted to backup but no notification), with all changes and appointments changed after that date being lost.
Some of the email features are very dependent on browser features where you can't set them manually for example timezones impact all visible dates among both apps, and are derived from the metadata of the client which don't update to the current date/time but to last visited time.
If you happen to be traveling, this can cause missed appointments/confusion when you do the mental gymnastics from your original timezone.
Personally, I don't think its ready for production requirements of business.
Proton suffers from the Lavabit problem but worse, it pretends to offer security and freedom when it does neither and acts as a tool of foreign governments to abuse individuals. Use your own GPG keys and better clients, preferably with self-hosting in Iceland or Sweden.
You're a fool if you believe handing over metadata like your personal phone number so you can be tracked is an improvement. That's not email and not a replacement for GPG, something that actually works properly. Session is a superior app for text replacement. I think you need to find new blogs that don't offer crap advice.
Settings > Privacy > Phone number has two options:
- "Who can see my number". If you choose "Nobody", then your phone number will not be visible to anyone unless they have it saved in their phone's contacts.
- "Who can find me by number". If you choose "Nobody", then nobody will be able to see you're on Signal unless you message them or have an existing chat with them.
[Not op] People (newbs) join signal and it shows I'm on. So they message me "hi!".
If I wanted whatsapp etc chats, I'd be on them, but signal is for my real friends, and essential contacts. I chose for several reasons, and being visible on everyone's list is not one of them.
Session started as a fork of the Signal client/server to use identifiers that are not phone numbers (perfectly sensible) but having deviated from the known primitives of the Signal protocol and omitting PFS gives me pause.
> They resisted this change for years, but eventually gave in and fixed it.
I believe that one big reason for that is that it was not trivial to get with the quality they wanted. I respect the fact that they "resisted" instead of just adding some bad implementation for the sake of it.
Protonmail is not Crypto AG. Swiss laws are great for that purpose and it's a nice island inside the EU. Also a few actual cases disclosed by Proton that show the workings when collaboration does indeed happen: "here's the encrypted data that we store. Good luck."
As long as you keep emailing within the Proton realm, there's not much risk of a data leak or foreign govt. intervention. Maybe a denial of service? Or why do you see this as a risk?
Personally I love that they explore more for businesses but as a full biz suite they're not quite there yet. Love their email and VPN though.
It's amusing to see people here continuing to recommend Google tools for core aspects of some shiny, fragile, new startup despite so many, many posts and comments on HN having been placed time and time again describing how arbitrary that monster can be about cutting you completely down from whatever it offers you for some bullshit algorithmic reason or another, and with near zero customer service recourse.
By now Google often acts worse than the complaints departments of many government agencies, which at least usually by law have to have a human accesible to you somewhere along the line. Yet it keeps getting recommended by either the clueless or the indifferent.
Yea, my dumbass used Google voice as my main 2fa number and recently lost access to it. Can't get it back and I'm locked out of everything. Don't be like me. Google really can't be trusted for personal or business use. If I could talk to a human and pay $100 for it I would.
Please don't say that. I can absolutely see google charging for customer service.
Welcome to nightvale
I used to live in the US and use voice as my primary number for everything. I don't think there is a better option.
Not for free!
When you are not paying for the product then you are the product!!
But it is NOT that hard for HN community to get VOIP number over SIP. All the smart phones have a sip client now days.
Just use it everyday and you'll be good.
Doesn't seem to do too well with foreign numbers. Never had issues calling but 2FA texts don't come through.
Problem is eventually you need it for Google Ads, or YouTube really for many things. And none of them are "vital" if they go wrong. They aren't core income pipeline parts. And then you get sucked in.
B2B and go to a conference? Where are you putting your video demo reels/talks? YouTube
Consumer and testing marketing messages for something non-consumer? Google Ads.
Your B2B client wants you to provide your SaaS via a private endpoint on GCP? What else are you going to do than use GCP?
Then once you are on it on company computers, it's a short walk to Google Docs and then Google Workspace, etc.
Needing Google occasionally is understandable but keeping it to a minimum and as disconnected as possible from core business functionality, and as replaceable as possible if things go sideways with its brainless algorithms, is absolutely doable.
Please, enough justification for why almost anyone generally "needs" Google.
For example:
>B2B and go to a conference? Where are you putting your video demo reels/talks? YouTube
Really? Simply no alternatives exist? I guess Vimeo is just a curious internet legend.
>Your B2B client wants you to provide your SaaS via a private endpoint on GCP? What else are you going to do than use GCP?
So explain to the client why you prefer not to use Google, but if they insist, then keep it specific to them and avoid it for anything generally essential to your business. You state this as if nearly a dozen alternatives to Google Cloud don't exist.
>Then once you are on it on company computers, it's a short walk to Google Docs and then Google Workspace, etc.
Don't take that short walk then, take another one instead.
The point is that alternative solutions do usually exist and even where Google becomes unavoidable, it absolutely shouldn't mean having to fully embrace its services.
I agree with you as a technical guy. It's not the worst. But as to why is happens:
If your business-focused founder or Marketing guy is going to the conference, it'll be Youtube, even though Vimeo is accessible. Unless you go make the account, share it to them, and have a SOP, why would they look at Vimeo?
The problem is when you get any sort of size the non-tech people choose Google as a default and then it (with weak force) slowly black holes up what they do. Just like people chose Microsoft Office (and still do for mature corps) for all kinds of admin, not necessarily technical people using Google (although I would say >80% of the tech graduate emails I am given for contact past graduation are gmail which is a sign of the times!)
The rule is simple. Google is fine for anything not in the critical path.
Need something to spread on social media? Fine. Post on Twitter, Facebook, Google, go nuts.
Never use Google (or other sketchy vendors) for anything you need to rely on to be there tomorrow.
Example: Youtube is fine for promotional materials. If you run an ed-tech and need videos to be there for students (core business), pay for something which works.
Example: Running a Black Friday promotion? Adwords. Relying on Google SEO for your main business as the main way to recruit customers? Bad idea.
You get one exception to this if you're building a Google-centric business. Is your business an Android App? You obviously get to use Android in your core business. If your business a Youtube channel? You get to use Youtube.
Things like Google Workspace, Google Cloud Platform, etc. are out. If, tomorrow, Google decides to wipe all you Google Workspace data (yes, it did this to a startup I was involved with), you're DOA. Office 365 is annoying compared to Google Workspace, but still worth it, since Microsoft won't wipe out your business as a statistic.
The way I think about this is each business has risks which multiply out:
(failed to execute technically) * (odds of market fit failing) * (odds of not being defrauded by your co-founder) * ....
This should multiply out to how likely your startup is to succeed. The way exponentials work, most of those risks need to be very, very low. You get one, maybe two, big ones. Every Google product in the core critical path has perhaps 10% odds of wiping out your business. Adopting Android is totally worth it if your business is Pokemon Go, but for most aspects of your business, pick trustworthy vendors.
At a startup you can run your company on the communication tools provided in Google workspace. There's much more to this than calendar and email. Tagged comments for coordinating actions, using gdocs with meetings and transcription and summarization by Gemini, communal editing and sharing, the gdocs history, sheets and slides, backup and logging tools, domain management and more. If you use proton, you get Google workspace from 15 years ago, at best.
I suggest Zoho one. It's been in service for many many years. It's not as feature rich as Google or MSFT, but their service is fantastic and gives you all options a small business needs (office, marketing, CRM, sales, HR, Finance among others).
https://www.zoho.com/one/
Pricing[0] is $37/employee/month, so 3-6 times the price of Google Workspace[1].
But avoiding getting locked out of your account and having to post on HN to get any support from Google? Priceless.
0: https://www.zoho.com/one/pricing/
1: https://workspace.google.com/lp/business/
It also provides a lot more than google workspace does, assuming you need those extra tools it ends up being very cheap for what you get.
Structurally, what does proton do that means you'd not get locked out of your account?
I was referring to Zoho (that is the pricing I mentioned).
I don't know if Zoho has great customer service, but I cannot imagine it is worse than google's.
I bit the bullet and am trying it out. I'll let anyone who is interested know how it goes.
I pay for it. I dont do anything super fancy, and its been working fine for two years now. I think the cost is low enough that I'm happy paying and not thinking about email setup, and happy I'm not paying google
In my opinion, E2EE comes with too many compromises to be worth it for most people and/or companies. Proton wasn't evolving quickly enough, so I switched to Fastmail.
Email aside, no CardDav/CalDav is a dealbreaker for me.
I went from Proton to Fastmail and then Migadu. But I think that it is not really answering the question.
The question is about a Business Suite similar to the Google Suite. I don't think that Fastmail provides a Drive or Docs (as far as I know they have mail, contacts and calendar, right?).
Not to say that Proton is a perfect alternative: Proton Docs is pretty new and doesn't have the excel/powerpoint equivalents that Google has.
I am bootstraping, and have used proton for years as my only email, but have my own email now, and am slowly backing out of proton. The horrible way that they extort by limiting and degrading a service is only part of the problem.They degraded email replies at one point, to a tiny "page" with less than one full line of text. There is more, but proton is not worth the effort to remember and detail all of it.
I will use google or any other service for building up an advertising presence. And keep the proton, until everything is moved. And then again, pragmatism might decide in favor of useing the proton service, but only as the core of my business is seperate,and will spread my add bucks around, so I feel safe. Currently have NO guggle anything, because of past denial of service, and will only use them for the advertising side as well.
> The horrible way that they extort by limiting and degrading a service is only part of the problem.They degraded email replies at one point, to a tiny "page" with less than one full line of text. There is more, but proton is not worth the effort to remember and detail all of it.
Are you saying they made it so that you cannot send replies with less than one full line of text? I don’t think I’ve seen or heard of Proton doing that.
Same here. When you say your own email, do you mean Fastmail? I love Proton and they got me and my SO largely off of Google. Fastmail is just so good, I’m going to migrate everything there eventually.
I migrated from gmail to proton then to fastmail and I can now really appreciate how much more polished gmail was. My biggest pain is fastmail's ios app, e.g. clicking on an email notification will in 50% of cases result in fastmail's app to open in an unresponsive state where I have to forcefully quit the app and start again. It's been like that for close to two years now.
I think most business people dont care about clients at all because they use IMAP/SMTP/carddav/caldav.
Once you have more than one mailbox then its kinda the only way. So apple mail, thunderbird etc. And then you mostly get some quality provider mailbox.org, fastmail, infomaniak or whatever but its all the same.
> When you say your own email, do you mean Fastmail?
Not sure what they mean, but at the very least I think you should have your own domain. So that you can migrate without changing the email address (and having to ask all your contacts to update to the new one).
> When you say your own email, do you mean Fastmail?
I assume they mean they run their own server now.
I have used it now for almost 7 years running a law firm. It's worked great for exactly our use case: privileged emails, including attachments, can be time and passworded with legit TNO encryption. I initially used nextcloud/webDAV for our own calendar, but switched over recently to protonmail and it hasn't been an issue. Some storage space is useful. Haven't used the VPN. It's a boutique firm. We have only 4 employees. YMMV
I'd consider Synology, upfront investment but if you really want privacy and control they have a nice suite of tools you host yourself on your NAS.
I am also interested because of Proton’s commitment to privacy and Google’s commitment to…the opposite. But I would think Proton will not (yet?) have the type of controls most businesses need to administer a company wide service and manage confidentiality, security, etc.
may i ask whats the horror with adwords?
email wise whats cumbersome with proton is it tries to upsell me again and again with its add-ons.
on google workspace i can say the best advantage is how almost 90% other sites out there supports signing in with google. and it's also cheap at $6 per head, and it doesnt harass you with upsells unlike proton.
Lots of stories about having google account connected to adwords locked out for various reasons, not all valid.
There's are several third party Google backup services for the paranoid...
It's not about backups - it's about loss of ongoing use infrastructure
The backup mitigates the problem because, if you are banned, which only happens to fools and fakes, you can take the backup and set it up on another service. Sure, you lose a couple of days of time migrating, but that's not a reason to avoid choosing a better solution.
A couple of days migrating can be a 100K+ outage in lost work if you have around 50 employees.
And for this estimation, I’m really taking your word that migrating 50 people in an emergency is really going to take only a couple of days, which I honestly don’t believe.
Sure, if you get a business account for your solo business, a backup will save you. If you have more people or a non trivial Google setup, the backup recovery is it’s on challenge while you could be working on your business if they didn’t, in this hypothetical but very possible scenario, lock you out of your business tools.
> if you are banned, which only happens to fools and fakes
If that is truly how you feel then I pity the fools who give you their business.
> which only happens to fools and fakes
Lots of people have directly stated otherwise. Are you super sure they're wrong?
it can happen to you
I use Zoho, cheap and has more services. In Africa they even give us localised prices.
I don't know about their business suite.
I've used their calendar and email. The calendar has had issues over the past few months where it would revert unexpectedly and silently back to a previous date (like they reverted to backup but no notification), with all changes and appointments changed after that date being lost.
Some of the email features are very dependent on browser features where you can't set them manually for example timezones impact all visible dates among both apps, and are derived from the metadata of the client which don't update to the current date/time but to last visited time.
If you happen to be traveling, this can cause missed appointments/confusion when you do the mental gymnastics from your original timezone.
Personally, I don't think its ready for production requirements of business.
Proton is so bad. Full of bugs and edge cases. Use fastmail instead.
[dead]
[flagged]
Proton suffers from the Lavabit problem but worse, it pretends to offer security and freedom when it does neither and acts as a tool of foreign governments to abuse individuals. Use your own GPG keys and better clients, preferably with self-hosting in Iceland or Sweden.
For truly sensitive communication, it’s better to use Signal: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/
You're a fool if you believe handing over metadata like your personal phone number so you can be tracked is an improvement. That's not email and not a replacement for GPG, something that actually works properly. Session is a superior app for text replacement. I think you need to find new blogs that don't offer crap advice.
What kind of threat model do you operate under where Signal Technology Foundation knowing (one of) your phone numbers is a large risk?
The fact that signal knows my phone number doesn't bother me.
The fact that anyone who knows my phone number can know that I use signal does bother me.
Settings > Privacy > Phone number has two options:
- "Who can see my number". If you choose "Nobody", then your phone number will not be visible to anyone unless they have it saved in their phone's contacts.
- "Who can find me by number". If you choose "Nobody", then nobody will be able to see you're on Signal unless you message them or have an existing chat with them.
May I ask why you’re bothered by this fact?
[Not op] People (newbs) join signal and it shows I'm on. So they message me "hi!". If I wanted whatsapp etc chats, I'd be on them, but signal is for my real friends, and essential contacts. I chose for several reasons, and being visible on everyone's list is not one of them.
You can turn that off in settings
Session started as a fork of the Signal client/server to use identifiers that are not phone numbers (perfectly sensible) but having deviated from the known primitives of the Signal protocol and omitting PFS gives me pause.
Session was the go to couple years ago but now SimpleX chat is imo superior with proper PFS even quantum resistent and better UX.
And how is the situation with desktop clients? Last I saw the situation was not exactly great.
no problem so far
And now Signal allows you to use identifiers that are not phone numbers (except for your registration to the server).
They resisted this change for years, but eventually gave in and fixed it. You no longer need to hand out your phone number.
https://signal.org/blog/phone-number-privacy-usernames/
> They resisted this change for years, but eventually gave in and fixed it.
I believe that one big reason for that is that it was not trivial to get with the quality they wanted. I respect the fact that they "resisted" instead of just adding some bad implementation for the sake of it.
Nitpick: AFAIK, revealing a phone number is required for registration. But it’s no longer required in order to communicate with other Signal users.
There is no reason to tell people they are fools. Especially when you believe that email with PGP "actually works properly" w.r.t. metadata.
You mean the company with a HQ in the US?
[dead]
[dead]
Protonmail is not Crypto AG. Swiss laws are great for that purpose and it's a nice island inside the EU. Also a few actual cases disclosed by Proton that show the workings when collaboration does indeed happen: "here's the encrypted data that we store. Good luck."
As long as you keep emailing within the Proton realm, there's not much risk of a data leak or foreign govt. intervention. Maybe a denial of service? Or why do you see this as a risk?
Personally I love that they explore more for businesses but as a full biz suite they're not quite there yet. Love their email and VPN though.
For extra email privacy you can still use proton on a separate domain or a subdomain https://bitcreed.us/bitblog/howto-protonmail-as-secure-whist...