How much can you trust a third party to take your complete data set, full of sensitive information, and treat it correctly? How long will they store it for? Who can access it while it’s being processed? What gets output in their internal logs? They’re asking for a lot of blind faith