They're based in Switzerland which is no longer a safe haven, although ProtonMail seems to still trade on the idea that it is.
See:
https://www.theguardian.com/world/2016/sep/25/switzerland-vo...