Of course it's dissapointing that protonmail did this, although i wouldn't say that the policy was changed "on a dime", as it said that ip logging was not "on by default"^[1]^. But while dissapointing, i can imagine courts pressuring Proton to start ip logging since it's easier rather than, say, change the entire backend to not encrypt the emails anymore. But to be fair i would say that if your threat model might include the government somehow, you should probably not trust any service with sensitive details like your ip. But as protonmail does what it sets out to do (encrypt your emails + some more) and as there aren't too many alternatives exept maybe tutanota, i think i'll stick with it. As for the VPN, it's open source^[2]^^[3]^^[4]^ (atleast the clients, I don't know about the server), but as I don't know how to audit code, take that with a grain of salt. And it does semi-regular(?) audits, although the last ones seem to be from 2019(?)^[3]^ and a penetration test (or maybe it was an audit, doesnt seem like it though) from 2021^[5]^^[6]^. But they said that they're planning an audit in the next months. ^[7]^.

Sources: ^[1]^https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/

^[2]^https://github.com/ProtonVPN

^[3]^https://protonvpn.com/blog/open-source/

^[4]^https://itsfoss.com/protonvpn-open-source/

^[5]^https://drive.proton.me/urls/XWPWPN079G#KSgiJSoTkysU

^[6]^https://proton.me/community/open-source

^[7]^https://www.reddit.com/r/ProtonVPN/comments/14kvy1e/comment/jsh0l7u/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

Additional sources: https://proton.me/blog/security-audit-all-proton-apps

Please tell me if i got something wrong, i'd be happy to fix any issues

Edit: formatting issues and added back the start and the end that was removed