Sadly, the last independent audit of Kagi was done in 2022 before Privacy Pass was a thing. So, we are getting a bit back into "just have to take their word for it" territory. Using a TOR browser for redemption of your token might provide enough peace of mind, but your point about any entity incorporated in a five eyes country is valid regardless.

Personally, I'm OK for what I use Kagi for to be more concerned about privacy from ad makers, web trackers and the like than I am worried about state actors for my use case. But obviously that's not everyone's.