Proton has always been sketchy - and I caught flak for it countless times, especially here. But: A company claiming they are "private’ and “secure” because they operate under Swiss privacy laws is already sketchy from the beginning. Why? Because Swiss privacy laws suck,are the worst in Europe and Switzerland is a country known for multiple cases of major intelligence agency overreach - especially towards foreigners and cross-border traffic.

Legally the Swiss intelligence services can order any “service provider” (that includes proton) to provide them access to traffic coming from foreign countries - this also includes the mandate to provide “technical means”, which is often seen as backdoors. And to make things better the service providers are not allowed to talk about it.

This alone is a problem. In Protons case what makes matters even worse is the fact that they are an US company de facto operating from the US and therefore are bound by the homeland security act and similar legislation.

So in the end both the Swiss and US services might read your data.