If you can't trust a company, don't use their api or cloud services. No amount of external output will ever validate anything, ever. You never know what's really happening, just because you see some text they sent you.

> Who know what it is doing with your codebase.

People who review the code? The code is always going to be a better representation of what it's doing than the "thinking" anyway.