Anything can end up in logs, then it depends on getting access to hosted splunk via employee creds, for a hypothetical breach.