>If you don't trust them, then no policy is enough.

No policy is enough, period. There should be technical and legal solutions to it.