They definitely could have phrased this better. I think what they mean is that their level of confidentiality meets or exceeds local laws.

Not sure what you mean, they’ve been posting fairly regular updates on software and infrastructure improvements and security audit responses on their blog for the entire time I’ve been a customer (6 years).