Make no mistake: any company that wants to operate above board, be it a VPN provider, a privacy-focused mail provider or whatever, always has to comply with the local law. If the “local” happens to be an oppressive regime like the US, tough luck… even in Switzerland if their gov forces a company to comply with something they will comply. Proton’s no exception.