They’re based in Aus, but their servers are in the US (which is why I decided against switching from GMail to them in the end, and picked someone a little more local).
That means their servers cannot be directly accessed but since they're based in Australia the company can be compelled to install decryption software without notifying anyone.