> their servers are Swiss based
So is Crypto AG. Didn't help Iran from keeping secrets from the NSA: https://en.wikipedia.org/wiki/Crypto_AG
[edit to add: not saying that Threema sells out like this, but "they're Swiss" is as meaningless for a security assessment as any other nationality]
>their servers are Swiss based
which doesn't mean anything.
Why not? Law, regulation and policies matter. The servers fall under the jurisdiction of the country where they are located.
There are certainly other options, but I think Switzerland is among the countries with quite reasonable data protection laws. Here the text... https://www.admin.ch/opc/en/classified-compilation/19920153/...) or some statements which I found with a quick google search: https://protonmail.com/blog/switzerland/ or https://swissmade.host/en/data-protection.
On the other hand, they have been audited [1], have transparency reports [2] and their servers are Swiss based [3]. Yes open source would be nice, but a relative small company with a focused business model (not dependent on advertisement, data-gathering, donations, kind [bi|mi]llionairs) has its advantages too.
I'm using Threema since some years and wouldn't want anything else.
[1]: https://threema.ch/en/faq/code_audit/ [2]: https://threema.ch/en/transparencyreport [3]: https://en.wikipedia.org/wiki/Threema#Privacy