My response is the same: set up a system where the per-user encryption is unbreakable by the company. The decryption happens only locally to the user. That way you can always comply fully with any court order, secret or open. And people’s stuff is still theirs.
