If you can make any request to the outside world you can exfiltrate data, period. You can even include data in the uri or headers and they will appear in logs.
That obviously includes talking with the provider.
If you want it secure, it has to be off the internet and on your own hardware.
That obviously includes talking with the provider.
If you want it secure, it has to be off the internet and on your own hardware.