Could a VPS provider like DigitalOcean have access to the content of their users? In their terms of service they do not mention anything related to this question, but could they theoretically have access (e.g., via a backdoor)?
Apart from a possible hack, how could I assure my clients that their content is only known by me, even if their data is not on my server?
When you host your data on other people's servers, then these people have full access to it.
With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.
You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.
To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.
But with some criminal energy, they can still monitor your data.
Solution: Host your servers on your own premise where you have full access.
But will Digital Ocean do that? This is what their privacy policy says:
Server Data
DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.
This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.
As other answers have explained, it is impossible to prevent a third party host from being able to inspect the data on your server. What you can do however is make that data worthless to anyone who inspects it. If you can do that, then hosting your own physical server doesn't have to be the only solution.
Merely encrypting the data on the server isn't enough, and is completely useless against a determined attacker with access to the server. What you need is known as "zero knowledge" encryption and the extent and ease with which you can utilize it will depend on your server application. All encryption/decryption is done on the client side, and only encrypted data is ever transmitted to and stored on the server. The server never sees the unencrypted data at any point.
For example, a Dropbox-like file sync/storage service can achieve this fairly easily. The client encrypts files prior to uploading, and decrypts them after downloading. Anyone with direct access to the server will only be able to see the encrypted files. Another example with an easy solution is a messaging app, where encryption is done end to end. Each client transmits encrypted data via the server, with the other client performing decryption.
That alone will still leave the meta-data vulnerable. In the Dropbox eample, the attacker will be able to see file sizes, date stamps, etc. Whether or not that matters depends on your specific security needs of course, but if you want a full solution you will need to find a way to encrypt the meta data as well. Ideally you want to store a single stream of raw encrypted bytes on the server, and have all operations on it performed by the client.
Even then you will have to consider that the attacker might glean some information by analysing the amount and frequency of data that is transmitted to and from the client, as well as things like the client's IP address. That could be a problem in some contexts (e.g. people living under oppressive governments), but probably isn't for most applications.
No VPS offers privacy from the owners/operators of the hardware, yet this can be worked around via VPN tunnelling. The straightforward approach is to rent a VPS in a foreign country (.i.e Russia), and then construct a private VPN connection to the VPS from a server that you control. Then simply forward the desired ports from the VPS to your local server. This will frustrate most law enforcement, but if you attract the attention of the NSA/DEA/FBI etc, you had better add VPN over TOR as your link, and keep the private server far away from where you live.
