All the requests made through DevTools seem to only load PDF scripts. I didn't detect any POST requests.

Of course, there is no guarantee that this will remain... regularly checking network activity before uploading a private document isn't too hard

You can monitor Network requests the application made with DevTools.