Freelancer Privacy Stack

Disclosure: Kit & Key is an independent privacy-stack site. Some links on this page are affiliate links. If you buy through them, we may earn a commission. That does not change the price you pay. It does change which paid tools we can recommend with a straight face. Mullvad, Bitwarden, and Tuta are unpaid controls. We do not earn anything when we point you there.

A freelancer is not a household and not only a cafe laptop. It is one person, a phone, a laptop, invoices, and the occasional bookkeeper. You need a password manager that matches how you share (or do not share), a mailbox you can send invoices from, antivirus on the machine that downloads client files, and a VPN for the networks you do not control. This is the kit. Install it at home. Use it on client Wi-Fi and cafe days.

If you only needed the cafe laptop, use the cafe Wi-Fi kit. If the house shares logins and devices, use the family kit.

The kit

Install in this order. Password manager first, email second, antivirus third, VPN last.

1. Password manager: 1Password Individual, or Families if you share a live vault

The freelancer failure is a reused client-portal password, or a bookkeeper who still has last year’s login in email. Sharing is not one feature. A unique link is a copy of an item. A guest is one vault. A vault (or a Bitwarden collection) is live access. Do not mix those.

Default pick: 1Password Individual. One seat. Unlimited devices. You can send someone a copy of an item via a unique link. You cannot share a live vault. Official: you need Families before you can share a vault with anyone. Solo recovery is recovery codes, if you generated them. There is no second organizer.

If a bookkeeper or spouse needs ongoing vault access: 1Password Families. Officially five people, plus guest accounts. Guests (the official accountant example) live on Families, Teams Starter Pack, or Business. Individual’s guest cell is blank. Teams is the other paid fork if you want a business SKU, not a household one.

If you already want Proton: Proton Pass Plus. Enough for solo Pass features. You can invite someone outside your plan to a shared vault. They get a free Pass account if they do not have one. Family is not required for that one share. Secure links send an item to anyone, paid Pass only. Pass Plus does not replace Mail Plus.

Unpaid control: Bitwarden. Premium does not include sharing. Official: sharing needs an organization (Free, Families, Teams, or Enterprise). Solo plus one bookkeeper is the Free organization: two users, two collections. Families is six users. Bitwarden Send is a temporary link, not collection sharing. We do not earn a commission on it.

2. Encrypted email: Proton Mail Plus

A VPN encrypts the path. It does not hold the invoice. If you send invoices from Gmail, Gmail still has them. Encrypted email is the freelancer step the cafe kit only mentioned.

Default pick: Proton Mail Plus. One user. Custom domain (one). Bridge on the desktop. SMTP submission for invoicing apps, on paid plans with a custom domain address, smtp.protonmail.ch port 587, send-only. Ten hide-my-email aliases. Free Proton Mail is encrypted (“we never see your inbox, on any plan”) but has no custom domain and no Bridge.

If you want Mail, Pass, and VPN in one sub: Proton Unlimited. That is the bundle. Duo and Family add seats. One person does not need them.

Pass Plus includes SimpleLogin Premium. It includes Mail Free features, not Mail Plus. A Pass custom domain is alias forwarding, not a mailbox. You cannot use the same domain for Proton Mail and Proton Pass at the same time. Do not buy SimpleLogin Premium on top of Pass Plus. Do not treat Pass Plus as the invoicing mailbox.

Proton’s own pages disagree on Free storage numbers. We are not flattening that.

Unpaid control: Proton Mail Free (encrypted inbox, no domain, no Bridge) and Tuta Free (1 GB; custom domain on paid only; no IMAP, by design). No third unpaid mailbox on the official pages we checked.

3. Antivirus: Malwarebytes Individual Standard

Client PDFs and “quick downloads” land on the laptop. Real-time protection is the paid product, not the free scanner.

Pick: Malwarebytes Individual Standard. Live cards say it protects 3 devices. Phone plus laptop fits. A 1-device Standard exists if you only want one. Standard Family is 10, and that is the family kit, not this situation. Teams Sole proprietor is also 3 devices. You do not need Teams for two devices. Teams adds business extras (tax ID, reports). Paid Home may be used in a business with no more than 10 devices under Malwarebytes’ small-business exception.

What is inside Standard is Premium Security. That is real-time protection, not Malwarebytes Free. Turn Real-Time Protection on after install if it is not already on. On Mac, grant Full Disk Access first or the layers stay inactive.

4. VPN: Proton VPN

Phone and laptop are two devices. Consumer paid plans already cover that. You do not need a business VPN SKU.

Default pick: Proton VPN. Ten simultaneous devices on paid plans. Same job as the cafe kit: encrypt the path, Kill switch on. Proton for Business is still 10 devices per user plus an admin panel. A solo operator does not need the panel.

Other paid pick: NordVPN. Ten simultaneous devices. There is no NordVPN Teams SKU. The business product is NordLayer, minimum five users. Skip it.

If the same login has to cover a whole household, that is the family kit, not this page. Surfshark’s unlimited-device plan lives there.

Unpaid control: Mullvad. Up to five devices. No affiliate program. We earn nothing from that sentence.

Setup

Do this at home.

Password manager. Start 1Password Individual. Generate recovery codes and store them offline. If a bookkeeper needs a live vault, start Families instead (or Proton Pass Plus, or a Bitwarden Free organization). Install the app and the browser extension on the laptop and the phone.

Email. Start Proton Mail Plus. Add the custom domain you invoice from. Install Bridge on the desktop if you need a local mail app. For invoicing software, use SMTP submission with the custom-domain address. Save the mailbox password in the manager.

Antivirus. Buy Malwarebytes Individual Standard. Install it on the Windows or Mac laptop. Turn Real-Time Protection on. Grant Full Disk Access on Mac. Run one scan.

VPN. Install Proton VPN (or NordVPN / Mullvad). Log in with the unique password in the manager. Turn Kill switch on. Connect once so you know it works.

What this kit does not do

This is a solo stack. It is not a household product and not a new company IT department.

• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1
• \1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1

If you only do one thing from this page: a password manager that matches how you share, plus a mailbox you actually send invoices from. Antivirus and VPN are the device layers.

Ownership and how we get paid

Kit & Key is independent of the product companies in this kit.

Nord Security and Surfshark merged in February 2022. Official wording is a merger, not an acquisition. They say they operate independently. We still treat Surfshark as a Nord-group sister. That does not change this kit’s VPN pick. The household unlimited-device argument is on the family page.

Kape Technologies owns ExpressVPN, CyberGhost, and Private Internet Access, and review sites in the same neighborhood, including vpnMentor. Those sites can review sister products. We do not. This kit does not pick a Kape VPN.

Affiliate links: 1Password, Proton Pass, Proton Mail, Malwarebytes, Proton VPN, NordVPN, Surfshark. If you buy through those links, we may earn a commission.

Unpaid controls: Mullvad, Bitwarden, Tuta. No consumer affiliate program on the official pages we checked.