Only the sender and recipient with the right key can decrypt the content. Neither the cloud provider nor third parties have access to the data.