Also, remember the guy who spoke to us was in sales. He's parroting high-level concepts some techie told him and he wrote on a note card.
I think the bigger issue here is an inability to tag certain data as regulated and control where it lands. That's probably on their "to do" list, but it would require a data center within each jurisdiction, which sort of defeats the economic incentive of having a distrributed model with a few cost-effective storage locations.
As for encryption, et-al., the tighest controls are never used. It would be nice if they were, but encryption is pointless if your key management is poor, and either 10,000 ex-employees know the key (making it useless), or you regularly change the key for millions of customers. Customer-initiated Asymetric encryption using hardware only (no employees) has potential here, but cumbersome management is the basic reason encryption is reserved for important data sets.