The Tarsnap client code isn't Open Source, but the source code is available, which means it can be audited.

s1kx's caveat ("Of course you will have to trust CloudBerry not to put a backdoor in their Software") therefore doesn't apply (as strongly, anyway) to Tarsnap.