[susam]

Some secret code hosted on Eyeo's server cannot magically collect keystrokes made on a user's web browser. There has to be a client side JavaScript code or a plugin on the web browser that collects this data and sends it to the server, and therefore, one would be able to point to the plugin or the piece of code that runs on the web browser that does sends the keystrokes related data back to the server.

At the very least, one would be able to see the data (or suspicious data, if it is obfuscated) being sent from the web browser to the server in the 'Network' tab of the web browser's inspector/developer-tools. Do you see any such suspicious data being sent from the web browser to the server? Can you post a screenshot if you do?