1) Not kept logs so that when put in a position to provide logs, would not have been able to do so.
If subsequently compelled to _start_ keeping logs, then:
2) Been hosted in another jurisdiction, and obfuscate where they are hosted.
I don't know the details of Swiss law, and I don't know the details of this particular case or what real or purported crimes they're investigating. It's entirely possible that this is an overzealous application of state power.
But, even if we accept for the sake of argument that this is a government overreach, I would still suggest that harsh criticism of ProtonMail is misdirected. Switzerland may not be perfect, but we shouldn't expect them to be perfect. Life is messy, there are no utopias, and humanity has yet to find a way to structure civil society in a way that comes even close to achieving perfect justice. I would guess, though, that, for all the country's doubtlessly countless shortcomings, when it comes to quality of checks and balances in legal investigations, a company based in Switzerland doesn't really have anywhere to go but down.
I’m sure somalia has great infrastructure.
> and obfuscate where they are hosted.
Running an undeclared business with physical components sound like a stellar idea.
OP asked what concrete options there are for 2. In what jurisdiction would they have been better located?
Wtf are you talking about here? No one expects a service to not be able to take logs or change their host country.
I do expect Protonmail to explain how they have to obey the law and what that looks like. That despite the picture of the Swiss Alps they can be compelled by the Swiss govt.
I do expect Protonmail to tell users about Tor, support Tor, and talk about limitations of Protonmail and Tor.
Sure, you could say this would be bad for business but this whole "security fortress" marketing scheme is unsustainable.
Is this a serious suggestion? No registered company will be able to do this.