When they receive an email, they encrypt it with your public key. The private key is stored on their server encrypted with a passphrase only you know.

Assuming they don't backdoor their client to find out your passphrase, or log emails as they receive them, you're fairly safe from having an employee browse through your emails.

Has anyone audited that system and implementation? If not, can you really trust that there's no backdoor?

No, and no. I don't actually use them, I just looked up their implementation. It also looks like I was downvoted for clarifying how they say their system works. Obviously open source doesn't absolve you from having to trust the company running the software.