They can prove it. Comprehensive independent security audits managed by well known privacy and human rights organizations. Considering the scale of Google they should have number of people auditing them all the time.