I can't speak to the sandboxing, but their implementation is definitely non-standard considering that I don't see Google or gstatic appearing in umatrix when I go through the logon process and they aren't flagging me for captcha even though I am coming out of a known VPN endpoint which trips recaptcha on every other site that employs it.