Different companies do it differently, but I'm not aware of any that make it absolutely impossible to get at production data (that hasn't been encrypted with a key they don't have) and program instances, just some make one (reasonably) jump through many more hoops than others. It's very much a double-edged sword so access control, auditing, etc. needs to be done carefully. (Privacy By Design.) The value can be immense -- e.g. debugging and hotloading a patch on a spacecraft 100 million miles away (http://www.flownet.com/gat/jpl-lisp.html)