You don't but you could make the point that since they are not open source, you will never be sure about it.

Even if GDPR should protect against it.