Comment Re:One simple question I wish were answered... (Score 2) 75
If I'm running your OS in a hyper-visor, I can pause the VM and dump the memory. Then I've got your key because the OS loads the key into memory.
Your provider can see your data in the clear. End of Story. Physical hardware is the be's all end's all.
Some things are true across all the big players (I don't know about the government-audited services; I can only imaging there's even more tracking).
If you're running the service, you don't have access to the datacenters, and likely don't even have access to the location of the data centers (the big players all keep exact datacenter locations somewhat secret - they have addresses, but the addresses don't mean much). If you work at the data center, you don't know what any given server is doing. So you don't really have physical access to the hardware in a useful way.
Further, everything is logged and audited like crazy - not so much for stuff like PCI compliance, but for troubleshooting. If a server falls in the woods, a whole team will hear. I'm sure everyone has tools to let you remote into any given hypervisor, but I'd be quite surprised if you could do so without a heck of an auditing trail.
It's not quite there for banking, but for most normal business, chances are there's more safety against a bad employee of MS Google, or Amazon than there is protecting you from your own IT staff locally.