http://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/blog/what-is-a-threat-model
To do this, you should consult the published threat models of the tools in question so that you understand what they can or can’t protect against. There is, after all, no such thing as 100% security. At Proton, we make this easy by publishing comprehensive threat models for both Proton Mail and Proton VPN (new window) , which outline what each service can and can’t protect against, and the best ways to mitigate some of the potential gaps.