I am currently entering the world of deploying my web application to the cloud.
While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The docker container I'm deploying via there command line tool is fully readable by heroku and passwords for database, external storage providers are all in my env variables that are also stored in my heroku account.
Does this mean, I need to fully trust my paas provider?
In my mind a simple VPS would be safer in that regard, because the iaas provider does not need (have?) access to my private machine. Only I have the password to that server. And my application code and passwords are inside the machine, so he has no access to it.
Of course the server would probably be more insecure to the outside world than my nodes on paas, because I have to configure the application hosting myself with a VPS and I'm certainly not as qualified as people who get paid for that stuff.
Is there some truth in this text or am I understanding something wrong here?