If the supervisors have root permissions, then they can get anywhere. Root is all powerful. Best way is to store it on removable drives or encrypt it. Which you seem to be talking about already.