Where to store encryption keys for the server?

Question

Encryption

Hello!
The server part of a mobile application on .net is being developed and the question arose: how to encrypt user data on the server so securely that no one except the server (ideally) could decrypt them? That is, if the admin gets access to the server that works with the storage, could not get the decrypted data, and so that the developer, having received the dumps from the storage, could not decrypt them either?
Well, it will be absolutely fine if these two, having entered into an agreement, cannot decrypt the dump from the repository in any way.
As I understand it, for this the encryption key will have to be stored on some other server (3d-party), plus configure server authentication (probably by certificate).
The server is a virtual machine, so, unfortunately, you can’t plug any piece of hardware into it.

Answer 1

store the private key in the mobile app, no?
the server room will store encrypted bytes + (possibly) meta-info
ps . if the code can get the decrypted data - it doesn't matter how - then the admin + developer will obviously merge them into one or two.