A promise is a promise. The "no way to spy" is likely just compliance. A lot of companies have compliance guarantees in place, like SOC2, which is about process

A promise is a promise. The "no way to spy" is likely just compliance. A lot of companies have compliance guarantees in place, like SOC2, which is about processes and documentation/audit trail. So the thing blocking you from reading customer data is another person in the organization having to confirm it's a legitimate action. Government level surveillance is not the same as an employee listening in on a whim. It's an organized endeavor, which comes with a process, so it may as well be ok from compliance point of view.