While I cannit defend (or attack, I'm no cryptographer) their crypto they seem to have a solution to this:
They say they don't store keys in the same datacenter or even jurisdiction as the customer data they protect.
According to them this means getting unencrypted data through a legal process would mean getting a warrant in two or more countries at once.