FAQ says it's using the NaCl crypto library, so I guess its protocol is as strong as the encryption. The audit would be less ambiguous, because so many other factors could come into play for all parts of an app, not just the communications part.