Yet still closed source with all its implications.

Or are they auditing every release or just the source code and trust you that it matches the released binary?