Yep, that's what i said with collocation, buy your hardware and host it or at least as much as critical components as you can owned networks, for the rest find a provided that resists at first and second level cease and desists ( otherwise i said bulletproof because they don't take in consideration any kind of cease and desists but only lawsuits and there it gets tricky, those are provided usually used by sec agencies, malwares provider, bots C&C etc ), you are done or, at least, the core is secured, the rest you can handle it in many ways, no need to rely on public "clouds"

also, as long as the hardware is yours, you are sure about data encryption / sanitization and all, thing that you can't know with a provider, they may have unencrypted snapshots available for the " enemy ", even when they tell you that they don't have a backup anymore, be sure, they do have it, just, they won't take it out for a simple request, for that they tell (you) look the policy, data expired sorry, but for the others..... think