The ultimate digital privacy stack

Your digital
privacy stack.

Three practical blueprints. Choose the privacy tools that fit your risk, your work and the time you can give them.

By Port233 LTD12 min read

Affiliate guide. Port233 partners with Proton and DigitalOcean (via Awin) and may earn a commission when you buy through marked links, at no extra cost to you. Other providers use ordinary links. How our links work.

Find your starting point
Explore Proton UnlimitedAffiliate link · Paid plans

Before you install anything

What are you trying
to protect?

A threat model is simply a description of what matters, who you want to limit and what you can realistically maintain.

  1. What matters most? Your inbox, client files, account access or keeping an activity separate from your identity?
  2. Who are you limiting? Routine trackers, account thieves, a network observer or a specific adversary?
  3. What would failure cost? Include lost access, missed client messages and unavailable backups.
  4. What will you maintain? Be honest about updates, recovery checks and server administration.
Privacy
Reduce unwanted collection and exposure.
Security
Keep control of accounts and devices.
Anonymity
Keep an activity separate from an identity.

Blueprint 01

Everyday privacy

The low-maintenance starting point

Reduce routine tracking and protect everyday accounts.

Effort
A short setup, then updates and recovery checks.
Budget
Start free; Mail Plus and Kagi are optional paid choices.

Choose this if you want more privacy without changing your devices or learning to run servers. Keep the setup small enough that you will actually use it.

The tools

Proton Free / Mail Plus
Try the free inbox first. Consider Mail Plus when you need supported paid features such as a custom email domain.
Brave
Use its built-in Shields protections as your everyday browser starting point.
DuckDuckGo
A straightforward search option you can use without opening a paid account.
Kagi
An optional paid search alternative. Check its account requirements and privacy policy before subscribing.

Set it up in this order

  1. Set up your inbox and a way back in

    Create a Proton account, use a unique password and enable a supported second factor. Follow the account recovery instructions and keep recovery information somewhere accessible if your main device or inbox is unavailable. Keep your existing email working while you test.

  2. Make Brave your everyday browser

    Install it from the official site and start with Shields defaults. Import only the bookmarks you need and check your work websites. Review a broken site individually instead of changing privacy protections everywhere. Keep the browser and operating system updated.

  3. Choose one default search engine

    Start with DuckDuckGo. Try Kagi if you prefer its results and are comfortable paying for search. Set your chosen engine as the browser default, then compare results for actual work. A search change does not remove tracking on the websites you visit.

  4. Check the accounts that matter

    Review recovery settings for your email, domain registrar and financial accounts. Use unique passwords, and passkeys or security keys where supported. Send and receive a test email, check important logins, and keep a reminder to review recovery details when they change.

Your checkpoint

Your normal work websites still function, your email works, and you know how to recover your important accounts. Stop here if that meets your needs.

Start with Proton Free Official signup · Non-affiliate link
Compare paid Mail plansAffiliate link · Paid plans

Blueprint 03

Hardened privacy

For a specific, higher-risk requirement

Reduce linkability between activities and strengthen device and account controls.

Effort
Comfortable with supported hardware, identity separation and maintenance.
Budget
Allow for compatible hardware, spare keys and ongoing time or hosting costs.

Use this tier when you can explain the risk that an everyday setup leaves unresolved. Maximum anonymity is a goal that needs careful habits; buying this collection of tools cannot guarantee it.

The tools

GrapheneOS
A hardened mobile OS for officially supported devices. Check the current device list before buying hardware.
Hardware security keys
For example, YubiKeys using supported FIDO2/WebAuthn sign-in. Check the services and connectors you need, and register a spare.
Tor Browser
A separate browsing workflow for reducing network linkability. Use the official browser and its guidance.
Self-hosted alternatives
For example, Nextcloud for files. This is optional and transfers maintenance, backup and access-control work to you.

Set it up in this order

  1. Write down what must stay separate

    Identify the activity you want to separate from your usual identity. Review usernames, email addresses, phone numbers, documents and account recovery routes that could connect them. Logging in with your ordinary account still identifies you to that service, even when the network route is private.

  2. Check GrapheneOS compatibility before installing

    Confirm current official device support, update lifetime and whether the device can be unlocked for installation. Back up first: installation and bootloader changes can erase data. Follow the official installer through its final locking and verification steps before adding sensitive accounts. This guide is not a device-flashing walkthrough.

  3. Register and test a primary and spare key

    Choose compatible hardware keys and register both with each supported service. Test the spare before storing it separately. FIDO2/WebAuthn can resist phishing in supported sign-in flows; weaker fallback and recovery routes still matter. A key does not secure an already compromised endpoint.

  4. Use Tor Browser as its own workflow

    Download it from the Tor Project, keep it updated and avoid extra extensions. Follow its guidance on personal logins and downloaded documents; other applications are not automatically routed through Tor. Choose security settings with their compatibility trade-offs in mind. Do not add a VPN to Tor by default without understanding the configuration.

  5. Self-host only what you can maintain

    Start with non-critical data and define who patches the server, reviews access, monitors failures and restores backups. Test a complete restore, including configuration and database where required. Hosting a service yourself does not automatically provide end-to-end encryption or anonymity, and a poorly maintained server can increase risk.

For readers choosing to self-host

Optional hosting: DigitalOcean Droplets

If you have decided to self-host, a Droplet is one virtual server option for a small pilot. Use it only if you can maintain the server. Cloud hosting still involves trusting a provider; it is not an anonymity service.

  • Choose a plan and region that meet your application’s requirements. Compare current compute, storage, backup and transfer costs before creating resources.
  • You manage server access, firewall rules, HTTPS, operating-system and application updates. Start with non-critical data and follow the official setup guidance.
  • Keep a separately protected backup and test a complete restore before relying on the service for client work.
Compare Droplets Affiliate link via Awin · Paid hosting

Plan your exit. Powering off a Droplet does not end its billing. Back up what you need before destroying an unused test server, and review any retained volumes and snapshots separately. Read the billing details.

Your checkpoint

You have tested recovery, understand the separation rules and can sustain the maintenance. If a specific person or organisation is targeting you, seek advice tailored to that situation.

Read the official GrapheneOS installation guide ↗ and Tor Browser best practices ↗ before changing your setup.

Before you commit

Useful questions.
Straight answers.

Is a higher tier always better?

Choose the smallest setup that addresses your actual risk. Tier 1 is a useful result, not a failed attempt at Tier 3. Extra tools can add mistakes, cost and recovery problems. Security keys and good recovery practices can help at any tier; you do not have to adopt the whole hardened stack to use them.

Is SimpleLogin Premium already included in Unlimited?

Proton currently includes SimpleLogin Premium with eligible Unlimited subscriptions when the accounts are linked. Follow the official linking instructions and check that the benefits are active before paying for a separate alias subscription. Existing subscriptions may have their own renewal arrangements.

Do I need Mullvad as well as Proton VPN?

No. The default prosumer blueprint uses the included Proton VPN. Mullvad is an optional alternative if you have a reason to choose an independent provider. Running both or paying for both is not a requirement of this guide.

Will this make all my email end-to-end encrypted?

Encryption depends on the message and recipient. Proton-to-Proton messages are end-to-end encrypted by default. Ordinary messages to external providers are not automatically end-to-end encrypted; use a supported password-protected or PGP workflow when needed. Email aliases do not change that on their own.

Can this guide promise anonymity?

No. Privacy, account security and anonymity are different goals. Tools cannot undo identifying logins, information you disclose, unsafe recovery settings or every form of correlation. Define the outcome you need and check the limits of each service.

Choose a setup you can sustain

Build the stack
you’ll keep using.

Start small, check recovery and add a tool when it solves a real problem.

Explore the Tier 2 plansAffiliate link · Paid plans

Sources and review notes

Written from provider documentation, reviewed on 3 November 2026. This is an opinionated starting point, not a hands-on benchmark, an independent audit or a guarantee against a targeted threat. Recheck current instructions and support before making changes.

Send a correction with the page address and detail to check. Read our editorial approach.