[ConcernedCitizen]

The one that you have root access too. Seriously, if you can't verify it, the encryption standards or security overall is anybody's guess. It's better to control the domain. It's also better to practice end-to-end (asymmetric encryption preferred) as the end-user, to prevent unauthorized access to your secrets. But, THAT said, if you can't do any of that yourself or you simply prefer the convenience you can trust your data to a well-researched, peer-reviewed service. You should always encrypt by default instead of relying on a single point of failure. I feel like I've said "single point of failure" a lot lately.