

Jurisdiction doesn’t matter, it’s an myth spread by Protonmail marketers so everyone thinks their privacy is ensured by some strict Swiss privacy laws.
Although privacy laws are pretty mild everywhere. Even GDPR is quite outdated and is barely enforced.
Proton, Tuta and others do it because “Swiss privacy” or “EU-based” brand is much more recognizable and easier to sell people on, compared to “we do metadata obfuscation” or “here is our 50 page long security audit”.
However, what actually matters more is security architecture. Signal is US based, but they thought through how to retain as little data on users as possible, so when FBI asked them for info, Signal could only give them date of account registration, user ID, and last login.
TLDR ignore country of registration and HQ location, evaluate on the merits



Or both! Don’t consume where possible, seek out the most ethical option when you must