I just don’t know how private and secure it is in comparison with the competition.
I don’t know either, but, assuming they’re really using stalwart, but I can say a little bit about stalwart.
Stalwart has three parts, the database that can be stored in different types of database files, an admin panel that can be used by the admin to configure stalwart or by the user to configure their account, and jmap and imap.
The admin panel gives admins very limited information about users’ data. You cannot see their password, their emails, etc through the admin panel. It does allow the admin to set up encryption at rest to protect the database. The default setup is intelligent about preventintg misuse and will do things like banning ‘excessive’ port scanners
The user, meanwhile, can upload their own pub PGP key file to encrypt their email bodies. This causes the emails to immediately be encrypted as they come in. The admin cannot decrypt this. It has the usual problems of PGP like impairing email searches, message titles not being encrypted, the recipient needing your pub key if you also want to also send encrypted emails, etc. The user can also set up an app password and choose the permissions for this password, like allowing imap only.
The only two factor supported by stalwart is TOTP. There is no FIDO2, something proton supports. However there is also no web client. Since thundermail will have a JMAP web client, that means they added one. Therefore the web client could support stuff like end to end encryption, FIDO2, etc. I would guess we also cannot access the stalwart user admin panel in the way I described in the last paragraph, but any feature I mentioned could hypothetically be part of the web version, as all we need for those features is a UI for access.
This is all why forum staff were happy to see them using stalwart. The security will come down to the implementation, but stalwart is a solid base. It’s also an open source project with an enterprise option, kind of like bitwarden, so we don’t have to worry about that base software becoming out of date or not maintained.