If it’s not open source it might be difficult to verify whether it can really be private