Like Schrems sentences you can't get that from USA companies, legally, but you can't get technically for ANY third party, because you are not on their servers,

Like Schrems sentences you can't get that from USA companies, legally, but you can't get technically for ANY third party, because you are not on their servers, and no one else is there to control them. How can you verify what any company state in a GDPR nightmare letter response? I've sent one time ago where a bank asking me to drop an RSA physical OTP for an Android app, that alone violate PSD2 (since the app it's not only a soft-token but also allow to operate on the same device, the reason why banking piracy was a thing again and more then ever), they respond accordingly to the law, but I can only choose to trust or not their response, I can't prove anything and I have nothing tangible to push some public inquiry on them. Oh, you might feel protected if you upload ONLY encrypted contents, at least feel protected for an unknown amount of time, potentially very long but potentially not enough long. So no, you can choose to trust someone else, but it's a choice that demand trust, you can't verify, so it's a vulnerability.