It depends on which kind of chat you mean, and the honest answer differs for each. Secret Chats require no trust in Telegram at all. Cloud chats require some, and the design is built to keep that requirement as small as possible.
Secret Chats
These are end-to-end encrypted. The keys are generated by the two devices and never leave them, so the server relays ciphertext it cannot read. There is no copy in the cloud, the chat exists on the two devices that created it, and messages can be set to self-destruct. If your requirement is that nobody but the two participants can read the conversation under any circumstances, this is the mode that meets it.
Cloud chats
These are encrypted in transit and at rest, and they sync across every device you own. That convenience is exactly what creates the requirement: for a message to appear on a phone you bought this morning, it has to be recoverable from somewhere. The design reduces the consequences by splitting the pieces apart, so that encryption keys and the data they protect are held in different places under different jurisdictions, and obtaining one without the other is not sufficient.
What you can verify yourself
- The client code is open. The applications are published as source, so what the app does with your messages can be inspected rather than taken on faith.
- Builds are reproducible. You can rebuild the app from published source and confirm it matches what the app store shipped, which closes the gap between the code that is published and the binary you actually run.
- The protocol is documented. MTProto is specified publicly and has been examined by people with no connection to Telegram.
- Secret Chat keys can be compared. Each Secret Chat has a key visualisation that both sides can check to confirm nothing is intercepting the exchange.
Updated