You don't have to take their word for it. See the SOC audit reports for yourself:
https://servicetrust.microsoft.com/DocumentPage/6ee23fc7-20d...
https://servicetrust.microsoft.com/DocumentPage/6ee23fc7-20d...
In any case, it doesn't much matter. The threads I'm in here are pretty much just me saying I don't trust Microsoft and others saying that I should, so I'll just bow out and leave it at that: we have different opinions.