You can run it on-prem, where you can actually technologically enforce data custody.

Custody enforcement using the cloud hosted product, is mostly contractual, although they do offer some technical features, like encrypting all data using a AWS KMS key in the customer's AWS account.

Still, this relies on trusting that they won't make their own separate copies of the data.