Here is their write up of the security model: https://protonmail.com/blog/protoncalendar-security-model/