You still have to trust the parts you can neither observe nor reverse engineer. So, everything organizational and everything that happens on their infrastructure.