You can use hardware security modules in datacenter space you physically control to store the private keys used to encrypt your data at &quot;CloudCo&quot;.  Amazon even offers this service and calls it Cloud HSM.<p>There&#x27;s always the in-memory vulnerability, which is harder to mitigate, but requires an attacker with physical access to the hypervisor, so it&#x27;s much more difficult to execute (as most meat-space hacks are).