Like all sensible crypto systems it doesn't matter if the server is compromised, encryption is done client-side. The project is open-source, so you can verify this for yourself.