Of course they can, why would one expect anything else? However if you look through their processes I am sure they are covered by some legal jargon to do the bare minimum in terms of security. They will have every knob available to debug to the lowest level possible and view everything