You can run it on-prem, where you can actually technologically enforce data custody. Custody enforcement using the cloud hosted product, is mostly contractual,

You can run it on-prem, where you can actually technologically enforce data custody. Custody enforcement using the cloud hosted product, is mostly contractual, although they do offer some technical features, like encrypting all data using a AWS KMS key in the customer's AWS account. Still, this relies on trusting that they won't make their own separate copies of the data.