The Cypress website
https://www.cypress.io/security/ answers this question explicitly:
"No access to customer systems
The open-source Cypress app runs locally within the customer environment, typically on a user’s computer and/or within a continuous integration pipeline, and sends Testing Content to Cypress Cloud. Cypress Cloud records results from the Cypress app and maintains no access to customer systems, source code, or software."