They say it is secure because all your traffic flows through their server in the clear but they don't look at it. It's refreshingly honest that the site admits this. But GotoSSH isn't as secure as regular SSH and it probably is not as secure as it could be (e.g. a Flash SSH client that implements the SSH protocol on the client side).
But since security doesn't matter in Web 2.0 (can I borrow your Google password for a minute?), this looks like a great service.