This is server side. It does not matter if it's open source, you can never verify what they are running there.