I think the assumption is that a backup solution is very very strongly encrypted and decrypted on the client side