Class action, violation of the Terms and Conditions.
I'd honestly be shocked if Google/Microsoft are monitoring the clients of their public cloud and keeping the data to create their own products off of.
I'd honestly be shocked if Google/Microsoft are monitoring the clients of their public cloud and keeping the data to create their own products off of.
A breach in that area would cost them potentially billions in losses.
Outside of the DoD space, the main distinctions between these offerings is where data can be stored and where and to what level of vetting vendor employees are.
Source: I work on FedRAMP compliance for GCP Databases.
AWS US East-West (Northern Virginia, Ohio, Oregon, Northern California) is FedRAMP compliant at moderate impact level.
[1]: https://www.wsj.com/articles/amazon-scooped-up-data-from-its...
they have access to the private data, by definition. the entire point is that it's not exposed nor is it used. clearly you've never worked at one of the companies in question lol. when you're on-call you might need to actually access private data.
true data sovereignty products are something countries in the EU are wanting USA companies to implement though, so then it's simply inaccessible, not public or private.
the industry is moving in this direction with things like AWS Outposts
When I was on-call and had to dive deep to solve customers' issues at one of those companies, we could only access anonymized data stripped of all PII (including emails and even IP addresses), to the point where the only non-scrambled things we could get were timestamps and error stacktraces/executed commands (which were also stripped of all PII, which made debugging a bit more difficult).
And every instance of access to that anonymized no-PII data required a physical authenticator, and it would automatically send an email to your manager (and some mailing group, i forgot) and create a special log that indicated "such and such was trying to access this anonymized ABC data for XYZ stated purpose".