My proofs:
1) the encryption for transfers is not the encryption for storage, in most all US service providers.
If you encrypt data on your end with a private key that you aren't sharing, then that data stays encrypted once stored. Carbonite cannot decrypt it, period. To be able to store the unencrypted version, they would need to have a copy of your private key - which they don't.
2) there have been breaches in access to stored data at Drop Box, Open Drive and others. In the public news. Often due to disgruntled employees or contractors.
Didn't I said repeatedly that since Carbonite does NOT have your key, nobody there can decrypt it?