Being open source isn't necessary or sufficient to be able to audit a piece of software. Software can be audited even if it's closed source (for example by reverse engineering, although it's more difficult), and even if it's open source it might still be impractically difficult for non-experts to audit.

You can’t promise things like that without having good references or proof. “Promise” might be a stronger word than you meant

Check my reply to the other comment. WhatsApp has been extensively reverse engineered.