Almost certainly they're sending hashes. However, if they don't have a way to disable this, that's a serious problem, hashes or not.