I agree with you, I am not going to outsource management of sensitive data to a third party just because they say that they are "100% confidential".

You can't trust anyone until they actually show you proof that they are:

- Trustworthy - Safe.

Both conditions require complete transparency on their infrastructure, protocols and first and foremost data retention policy.