Worst case, they’re saving it to an encrypted blob storage, calling that encrypted, and hiding deep in the ToS that you actually agreed to that

And then it’s discovered that bucket was accidentally set to public. Oopsie daisy! But you can’t sue us because also in the ToS was a forced arbitration clause.