Using an encrypted VM is standard but the encryption is the core issue. Just plain encryption will allow them to proclaim it’s all secure/private. But that is where I don’t trust Meta. Are they using a different key for every user? They are not claiming that meta cannot and will not see the data. Can they say that the user data is not exfiltrated for their own training and analysis? Are they claiming that their developers cannot see user data? What happens when a government request comes? What happens when a bug happens and their admins and devs need to debug? What about a rogue dev/admin?

I don’t trust meta will do any of this