I see what you mean; I read &quot;DON&#x27;T BLOW ANYTHING INTO THE CLOUD THAT YOU DON&#x27;T HAVE A COPY OF&quot; and thought of only my personal data (because if it&#x27;s user data, it&#x27;s originating from the cloud and I&#x27;m not blowing it into the cloud; if anything, I&#x27;m pulling it out of the cloud).<p>Though if we unbox that a bit... How do we balance the risk of loss due to your cloud being owned vs. loss due to the risk of your users&#x27; PII being violated if someone attacks your in-house (ostensibly in-house reliability and security-managed) copies? Better make sure you&#x27;re spending the money on security best-practices on all your copies, not just the &quot;live&quot; ones.<p>Side-note: What are your thoughts on two separate cloud providers as providing sufficient insurance? Say, having your data live in Google Cloud and at rest in Amazon S3?