we take this pretty seriously. we lock down the nodes themselves so that only the hypervisor has direct access. and between customers, we don't just sanitize disks. we actually delete them entirely and spin up a fresh VM from a clean qcow2 base image, so no prior customer data persists.