At the end of the day a company must comply with the laws of where it's based. Most controversies I remember reading about Proton were a bit overblown, probably because they're so popular.

For example : https://www.old.reddit.com/r/degoogle/comments/1rm6659/comment/o8xxupo/

or : https://discuss.privacyguides.net/t/proton-mail-discloses-user-data-leading-to-arrest-in-spain/18191/22

https://proton.me/legal/transparency

https://proton.me/mail/privacy-policy