> Comments in this thread are actually discounting the threat of Amazon personnel, GCS personnel, etc., as if that threat was zero. Thank you for this comment,

> Comments in this thread are actually discounting the threat of Amazon personnel, GCS personnel, etc., as if that threat was zero. Thank you for this comment, this continuously blows my mind. If one hands over cleartext data to some third party, one must assume they will abuse it. They might not, but "might" is not a convincing control in a threat model. If they can, one must assume they will. And plan accordingly. Sure, sometimes it is ok. But any threat model that assumes a third party that could abuse the data but will never do so, is flawed. It is vital to remember two things: Even if one 100% trusts the current management of a company to do No Evil, management can change. Second, regardless of managment, a company is subject to subpoenas and NSLs, so your data will be handed over. If you don't directly control the generation, storage and usage of all encryption keys, your data is effectively in the clear.