> What am I missing? To pick a few things I can talk about - sufficient replication to not lose data, data security that actually works (small companies can't

> What am I missing? To pick a few things I can talk about - sufficient replication to not lose data, data security that actually works (small companies can't - and shouldn't - afford disk shredders and internal access audits), targeted obliteration of customer data on request (including getting it out of the backups without rendering the backups worthless), and making sure that your exported data dump which contains massive amounts of personal information is only ever released to the correct user. Doing any one of these things in isolation is not all that hard, because you can trade off against the others (for example, it is dead easy to do a data dump if you don't care about data security). Doing all of them at the same time is a large, expensive development project that would sink any startup.