Proton used to have a deal with the Israeli company Radware, for DDoS protection. They have written a few disclaimers about how Radware only handled incoming traffic still with two encryption layers intact (SSL & OpenPGPjs), as if that was some sort of real protection if a company has access to raw incoming traffic.
Honestly, a company aimed at privacy, boasting of Swiss privacy, should know better than to route anything through Israeli companies.
it was some years ago. But during an outage, one of their services turned out to be routing traffic through Israeli / Unit 8200 company servers.
My trust in proton evaporated back then.
https://cryptome.org/2015/11/protonmail-ddos.htm