If you can make any request to the outside world you can exfiltrate data, period. You can even include data in the uri or headers and they will appear in logs.

That obviously includes talking with the provider.

If you want it secure, it has to be off the internet and on your own hardware.

What about checking temporal entropy of outbound data/similarity to a private dataset?

The timescale can be adjusted to a length suitable for sensitivity of the data.

Although you may run into the monkey and typewriter problem a bit if the period is indefinite.