ProtonMail is a joke. It doesn't report security vulnerabilities to the users, when researchers discover them[1]. It publicly boasts about hacking a phishing site, when claims the journalist's report is based on "unsubstantiated rumors"[2]. It outsources a free VPN service to a data mining company[3], when claims it used it only as "an office space provider"[4].
[1] https://www.theregister.co.uk/2014/07/07/protonmail_fail_jav...
[2] https://motherboard.vice.com/en_us/article/qvvke7/email-prov...
[3] http://litigation.maxval-ip.com/Litigation/DetailView?CaseID...
[4] https://news.ycombinator.com/item?id=17775554