I'm not sure about the former, but the answer to your second question is yes, they do client-side encryption: https://support.mozilla.org/en-US/kb/how-firefox-sync-keeps-...