Having thought about this a little more, it's clear that server-side storage is not compatible with Zero Data Retention (ZDR). However, in non-ZDR settings, it seems likely that the providers are capturing all that data anyway?

> a per user key would have solved this issue for sure

It would have helped with PII leakage, but not with plain-text trace extraction attacks, right?

Per user encryption key ties it with the user session (assuming you do authentication properly), no one else can access it. User being able to see the information is not really an attack vector in this case.

The compliance rules at times are outdated and people skirt around them by following the worded rule instead of the intent.