Yes, that's right. We're referring to IP whitelisting there. We're also adding (very shortly) site-to-site VPN connections, so users can link their AWS/GCP VPC

Yes, that's right. We're referring to IP whitelisting there. We're also adding (very shortly) site-to-site VPN connections, so users can link their AWS/GCP VPC or even a traditional office/datacenter LAN. Even with a VPN, any sensitive services should have their own auth and logging enabled. Requiring a VPN doesn't remove the need for other forms of security, but it does add a very effective layer of security. We also have a strong business incentive not to violate the trust of our customers. We're hoping to prove that we can be trusted over time, and to use technology to reduce the need for trust.