Do you know if the encryption scheme covers metadata? For instance, who sends something to who.

Doesn't matter. All of this stuff, servers included, need to be based on open source, maintained to a large part by European engineers, and hosted in the EU by people with security clearence. It makes NO sense whatsoever to risk this sensitive data getting stolen.