The introduction implies some level of security analysis based on the list of "criteria" (e.g., "does not expose personal information" and "does not leak data") and the "testing setup" link.
That's exactly my point. Ask the author. They implied that they did some analysis beyond trusting claims made my developers, but there aren't sufficient details.