I suppose that the encryption is relevant no matter where you operate from. Does that protect metadata? I assume that all they can learn is that person X is visiting a site that uses your service, which is pretty unhelpful for spooks. In that case, the main security or privacy concern probably revolves around government data requests and/or data center security