If their storage API is compromised your data isn't... you need to compromise their decryption API and the storage API.

With luck the same sets of staff will not have access to both, et cetera.