The vendor should not be able to reach into your data — and my architecture makes that true

I spent today deciding what my own product is allowed to reach. The answer I kept landing on was: nothing of yours.