You can run it on-prem, where you can actually technologically enforce data custody.
Custody enforcement using the cloud hosted product, is mostly contractual, although they do offer some technical features, like encrypting all data using a AWS KMS key in the customer's AWS account.
Still, this relies on trusting that they won't make their own separate copies of the data.
Custody enforcement using the cloud hosted product, is mostly contractual, although they do offer some technical features, like encrypting all data using a AWS KMS key in the customer's AWS account.
Still, this relies on trusting that they won't make their own separate copies of the data.