They could design it in a way that it operates on your data but they have no access to the data outside of these strictly defined operations. If that was a prio

They could design it in a way that it operates on your data but they have no access to the data outside of these strictly defined operations. If that was a priority to solve, it would be solved. If you’re thinking of end to end encryption, that doesn’t discharge from GDPR. When person-related data is processed outside of the EU, even just to store encrypted bits, it must comply with all aspects of GDPR. The genie is out of the bottle, cloud cooperation is a given for modern software. The question has moved on to how to regulate those clouds in ways that prevent the harmful sides. GDPR is one attempt to do that.