Absolutely correct, no amount of wording will provide adequate proof. Thats why if you are providing a security product or product providing security features, open up the source code and provide a way to validate that that source is actually what is running on the hardware.

Until then I assume it is unsecure.