Right now my main concern is rug pulling and draining user funds, but many of the node runners are in my WoT and I trust them to not collect data or do prompt injection.

A proactive approach is better in this case than a reactive one, imo. Unless your audit system requires active approval.

Private Provider does not collect any data or engage in any other malicious behavior. My mission is to offer continuous uptime and quality upstream models so users have a good first experience with a project I believe in.