Ultimately, Privatim says that international SaaS providers should not be used for highly sensitive or confidential data unless the government can encrypt the data itself, and the provider cannot access the keys.