lol. And passwords must be hashed, right?

How is the public supposed to know how the black box of an online service handles their data?