My question might be naive but wanted to clarify this anyway.
We see software being published as open source. Take for example Signal. We can audit the software since its public. But how do we verify if the code that gets deployed in their actual servers are same as the one available in their public code repositories?
I'm particularly concerned about things like data privacy and security. Let's say the open source version of an application (e.g. Signal) collects very little of my data. But unless I can verify if the same code has been deployed on to their servers, I cannot be sure. Signal may have another private code repository which may be doing much more than what is publicly available in their repo.
Having said this, how do I make sure the software running in Signal's server is same as the one available in its public code repository?