I think a great middle ground for embracing the cloud but retaining control over your data is the ability to bring your own encryption key. This makes it possi

I think a great middle ground for embracing the cloud but retaining control over your data is the ability to bring your own encryption key. This makes it possible for the SaaS to do the thing that you pay them money to do, but retain control if you want to walk away. Plus it guarantees that they are doing some sort of field/row encryption to be able to mix in keys. The crux is that to do BYOK securely, you need guarantees that the key is handled correctly and in an ideal world, some sort of verification. That doesn't mean code auditing by every customer...I favor granting access to a key that can only be released into a secure enclave for sensitive SaaS operations to reside within.