That form of security is called host-based security, where you give your complete trust to the service provider. Yes, your stuff are encrypted, but the encryption/decryption logic is coming from service provider, and they can send you whatever they want. CryptoCat was criticized by Schneier and other security researchers for this.
Patrick Ball wrote a very interesting article on the subject; he explains the concept of host-based security and other related issues. It'll help you understand the big picture regarding this matter.
To directly answer your question, yes it is possible. CryptoCat is a great example.