If the same company makes the software at the local end, there's still code there than can expose the data or the encryption key...