Switzerland's data protection laws are way behind the GDPR. Switzerland is struggling to adapt its data protection laws to keep its adequacy status with the EU. It has still not signed Convention 108.
Switzerland's surveillance system is growing and growing. The latest revision of the relevant law was targeted at services like ProtonMail and ProtonVPN (Federal Act on the Surveillance of Post and Telecommunications). Switzerland's federal secret service has got almost unlimited power without any meaningful control and is known as a close partner of the US (thanks to Snowden leaks). Every communication in Switzerland is under mass surveillance 24/7, the metadata is stored for at least six months (civil security authorities) or longer (secret services). Switzerland's armed forces work in close cooperation with NATO.
I am actually wondering whether Proton is a honeypot.
You don't have to take our word for this, it's actually in the text of the law.
Also, if you read the actual text of the US/Switzerland MLAT (mutual lateral assistance treaty), or the text of the Swiss Data Protection Act, you will see that "unlimited power without any meaningful control" is also patently untrue, and there are many layers of control and an explicit need to satisfy the requirements of Swiss privacy laws, even on cases originating from the US.
Isn't it more true of e.g., German-based companies and less true of Swiss-based ones?
https://www.reuters.com/article/us-swiss-secrecy/era-of-bank...
And it's not that the founders chose a Swiss structure because they were themselves Swiss. Even the product were hypothetically bug-free and fully FOSS ... the marketing (with its mountains in the background and "Secure Email Based in Switzerland" tagline) plays to the sentiment that a Swiss jurisdiction makes Protonmail a safer bet than other location is itself "snakeoil" ... if I think about this for too long I might even wonder about their much more relevant claims regarding security & actual code implementation.