(yes, there is PGP, but it still leaves the metadata unencrypted). This is probably an inherent risk in email, which as both and _MS_ rightfully pointed out, simply isn't secure by design. But regardless whether it's them or another encrypted email provider, if you're unlucky, and your provider doesn't want to become the next Lavabit, but instead they choose to comply with a court order so that they could continue operating, you could still end up with your emails from/to other email servers being snooped on. OTOH, Tutanota seems IMO to be much more trustworthy. Given this story, it seems that something indeed may be fishy about PM (not to mention other interesting tidbits from the article provided by - I'm not 100% convinced they are a spook honeypot, but this kind of sudden policy change makes me wonder whether they are to be fully trusted. However, I am also somewhat wary of Google knowing too much about me, so I ended up using both Protonmail and Tutanota. I don't think there is any email provider more secure (as in hard to hack) than Google.

If you have to conceal metadata (Ukraine has me thinking about this), you're somewhat in spy-vs-spy territory, and you and your communication partners need to know what you're doing and probably use ad hoc methods depending on the exact situation. Note that it's very difficult to keep your email away from google: even if your own account is on protonmail, when you email your friend, without prior selection there is a high chance that your friend is using gmail. If you do want to use email then this is somewhat in conflict with #2, since having both people on the same provider helps control leak outside that provider, and having both people use gmail is fairly innocuous. 3) protecting the metadata of who you are communicating with: for that, email has fundamental weaknesses. 2) Preventing your email content from being collected and analyzed by personal profiling companies like google: for that, it helps to use smaller providers, who simply don't the resources to embark on such projects.

state agencies: for that you need end to end encryption. There are 3 separate questions here: 1) protecting your email content from surveillance by e.g.

Is proton email more secure than gmail