How could you prove/trust that they never cache the data? I think the only way is if the "app" actually ran on your PDS (Personal Data Store) instead of somewhere else. Of course that brings other challenges.
Ideally you'd pay them and that would be part of the contract. Otherwise demand a legally enforceable promise (via promissory estoppel).
I also think there is a need to figure out how to enable community-controlled SaaS platforms in addition to this. LibreOffice, for example, has essentially released an online office suite. But it has decided not to actually operate and offer this suite to the public in ready-to-use fashion. From what I understand, it is just too difficult and resource-intensive to do that. So it's up to companies running paid platforms to do it (or you can spin it up on your own server/instance and run it yourself). There's nothing inherently wrong with this. But it seems to me that there's a "next step" to take by figuring out how to enable fully community-controlled platforms so that a project like an open source G Suite (running at scale with an iron-clad privacy guarantee that is backed by community audits) that you can just go create an account on could become a reality one day. This seems like it would require a non-profit organization akin to Mozilla. How great would it be to have a community-controlled non-profit organization operating a trusted cloud platform, perhaps even audited by a group like the EFF? Very challenging, for sure. But it seems humanly possible.