We are offering a high-end simulation product to customers by sending them PC hardware with our pre-installed software. We implemented several layers of security that prevent the customer to read our data (binaries, filesystem, etc), and only allow control of the simulation by plugging in the computer in the local network and interacting via HTTP.
If we offer our application through a Virtual Appliance, do we get the same guarantees that customers will not be able to read the virtual file system and our data? How is the data protection implemented? Because it's a VM running on customer's computer, would it be possible for the customer to save state, read the virtual RAM, and figure out the encryption used?