Protonmail.

That might be technical protection, however the way the SEC gets access to mails is not on a technical level, but by sending out a letter "please send us all your mails on that topic" and if the response on such a request is not convincingly consistent you get into even more trouble.

This. At Toyota corporate, we had a meeting with a lawyer and the lawyer instructed in the event of an investigation (e.g. bad floor mats), provide all of the emails and documents. Make everything easily searchable, and keep emails for 3-4 years. People think that hiding evidence from your lawyer makes things better but according to the lawyer, it actually hurts the case by not being able to have information. So save everything! The Toyota I.T. department must’ve heard something different because outlook now erases all emails older than 90 days.

Your IT department probably is likely to follow a document retention policy relating to archiving emails (an archive you don't get access to).

Your document retention policy should be included in your onboarding training and accessible to all staff, not doing this would cause all kinds of compliance problems.

Protonmail is not located in the same jurisdiction as SEC, besides all they could eventually get is encrypted garbage.

The SEC is not going after protonmail, but your company. They use legal powers against you. They don't care about technicalities. (Except on the delivery channel for the Gigabytes of data) If you don't comply, they put charges on you.