I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent.
Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on the client), PBKDF2 always felt to me like a footgun when compared to scrypt or argon2 which don't have as many (any?) insecure modes of operation.
The website states that AES is used, but is it in an authenticated mode (e.g. GCM ?)
Finally, their website states that they use "popular and reputable crypto libraries" and that they don't roll their own crypto, but the libraries they use are awfully low-level. Something like libsodium or FilSottile's age would be something I'd be more comfortable with when considering a hosted method.
In the meantime, I think I'll keep using KeePass2 (w/ Argon2 and ChaCha20) and synch'd with SyncThing to minimise my attack surface.