My favorite 'feature' of protonmail is that you can't access your messages via imap or pop, and their suggestion regarding exporting messages is: "At this time, you are able to save individual emails by using the "Print" function found inside each email in your account."
Protonmail had a very weird role in campaigning against the new sigint-law in switzerland, they used it for marketing for their service... now they say it's not that bad because protonmail advises the government on it.
I am very dubious of protonmail's claims. They don't release their server-side code, so nobody can audit it. There is no way to make sure a PGP encrypted message sent to a friend is actually encrypted with their public key only, you have to trust them.
You are also just one XSS away from losing your private key...
The reason not to open source the backend code is... terrifying: https://protonmail.com/blog/protonmail-open-source/#comment-...
What about the other things that are important, like does protonmail do full disk encryption? do they log ip addresses? They require you to sign up with a phone number if you use tor, but "promise" not store that. How can we trust them?
Their ToS states: "you agree to not use this Service for any unlawful or prohibited activities". But hey, if Mr. Robot uses it, it must be good!
They also have a very shifty claim of e2e encryption and a weird de-facto disabling the use of pgp. They do use openpgp.js, but for encrypting your mailbox, not for actually using pgp to mail other people.
They do actually support incoming pgp just fine, but I like to think of e-mail is bidirectional. To be fair, that is something they've had on their roadmap, but for almost three years now. Giving up the ability to send pgp-encrypted e-email is not a great trade-off (and let's not even get started on their notion that you're somehow better off with gmail as long as you use pgp).
So, trust the server, trust the HTTPS connection, trust the browser to not have any backdoors or security flaws in all extensions, and trust other apps that can access the browser's files and syscalls. Trust us, we are in switzerland. Why do people think that switzerland makes them somehow better position to deal with legal issues? Anyone from switzerland will tell you that they are not immune from evil laws and different parts of switzerland are significantly more draconian than others. Tell me how switzerland is some safe-haven that you should use as a criteria to determine your opsec. This selling point is pure snake-oil.