Yes, Point will perform all processing in the device and only send events with time stamps, as well as plain sensor readings for temperature/humidity/etc. It should be easy to verify by looking at the outbound bandwidth. Limiting outbound connections w.r.t hosts, ports and bandwidth (even filtering out OTA firmware updates) should be possible (as we're not trying to hide what we do, only protect your data), but it might affect the performance and battery life of the device, and is not something we can endorse.