Summary
addy.io has passed an independent security audit conducted by Securitum. The audit included a web application penetration test and a source code audit. No significant vulnerabilities were identified during testing, and the 2 low-risk issues that were found have been fixed.
Full report: https://addy.io/addy-io-security-audit.pdf
Some people have suggested using your own domain with addy’s service. If the service goes under, you can switch to another provider.
SimpleLogin is now under ProtonMail. This is probably a more assured service, but putting all your eggs in one place may not be a good idea either.