Thanks Maxim for the reply. We have evaluated disk based encryption etc, but that does not prevent sysadmins from viewing user data which is a problem for us.

Do you think we could build something using lua and intercept read and wriite call from cache?