For mail, a few things I'd look for:

• Standard protocol compatibility (POP/IMAP/JMAP/SMTP) so you can use a client that's not controlled by the service provider.

• Easy E2EE setup with PGP/GPG.

• Custom domain support.

• Email alias support (though this can be done with a third-party service, potentially).

• Server-side filter rules for incoming mail.

Proton and Tuta, for example, fail on point #1. The E2EE promise really doesn't mean a lot when the service provider ultimately controls the client. If they control the client, they could very easily exfiltrate your keys via a backdoor. This can be mitigated with open-source clients and reproducible builds, but if you're using a web client or apps from Google/Apple stores, that's never going to be verifiable.

For VPN:

• No-logs policy.

• Independent audits.

• Port forwarding support.

• Anonymous payment options.

These are not exhaustive lists, just off the top of my head.