If the filesystem is shared (i.e. server has / , and your vm1 is under /data/vm1 for example), they can access any files or databases without even logging in.

If the filesystem is shared (i.e. server has / , and your vm1 is under /data/vm1 for example), they can access any files or databases without even logging in. If the filesystem is on a SAN they can access it read-only of course without you even knowing.