I believe there was a case where they complied with law enforcement to hand over user data, and although the contents of the emails were unreadable, the header info and subject was.

I'd say it's as safe or safer than most things, though it still requires javascript to use, which that alone has some people leery of it.