As described in the blog post, each write is replicated to machines in five different datacenters, and not confirmed until a quorum of three acknowledge it. So

As described in the blog post, each write is replicated to machines in five different datacenters, and not confirmed until a quorum of three acknowledge it. So you'd need a power loss in three geographically-separated datacenters simultaneously to lose data. Write confirmations block the "output gate", which means the app can keep running "speculatively" while waiting for write confirmation, but if the write fails then no one in the rest of the world will ever observe that any code after the write executed.