Using someone else's infrastructure means trusting someone else's administrators. Most cloud providers answer that with operational assurance: contracts, audits, certifications, and administrative controls. These are necessary, but they depend on trust in the provider, who ultimately controls the infrastructure and often holds the encryption keys. That leaves a residual risk that data can be accessed through internal privilege, misconfiguration, or legal compulsion such as the U.S. CLOUD Act.
