It looks like the mail exchanger is (currently) hosted on Digital Ocean in New York.

They also use CloudFlare in front of the site, which means all your webmail or API traffic will be subject to inspection and logging by a company based in the US.

2-factor auth won't be available at beta launch (it's a MVP, we still have to see if there's enough interest), but we'll probably add 2-factor auth using https://www.authy.com at some point.