What is the MOST effective way to ensure that a cloud service provider does not access a customer's data stored within its infrastructure?

Using the organization's own encryption tools and data management controls means the customer holds the encryption keys entirely outside the cloud provider's reach, making the data cryptographically inaccessible to the provider even if they have physical or logical access to the underlying storage. This approach implements a 'bring your own key' (BYOK) or 'hold your own key' (HYOK) model where the provider cannot decrypt data without the customer's keys. It is the only purely technical control that removes provider access without relying on trust or contracts.

Contractual agreements are legal controls, not technical ones, and cannot technically prevent a provider from accessing data - they only create legal liability after a breach of trust has already occurred.

Requesting audit logs is a detective control that identifies access after the fact but does nothing to prevent the cloud provider from accessing data in the first place.

Using the cloud provider's own key management service or HSM means the provider still controls or has access to the key material, which does not prevent them from decrypting and accessing the customer's data.