[oceanparkway]

I would ask them what their ideal setup is and then compare feasibility. There's probably a lot of indirections/hoops you could jump through but if your security concerns are being driven by your customers you should probably ask them. If it is the case that you need to access their unencrypted data then at one point or another you're going to have to do it, the question is which possible way would your customers feel happiest about? On-premises contract, storing encrypted + customer-specific decrypt keys with a managed auth service, etc etc