I feel like "open source" has become a cheap way to earn trust. Very few people are able to understand code, even fewer actually comb through all the code and fewer still are able to find and decrypt obfuscated code, especially on large repositories. If someone really wants to hide something, publishing under open source isn't going to make a difference. Essentially, whatever you use, there's going to be some degree of trust you must instill to the company and its developers that they will protect and respect your data.