I think this could be improved by carving out some minor exceptions for applications under development or starting off, perhaps with a low user limit to prevent

I think this could be improved by carving out some minor exceptions for applications under development or starting off, perhaps with a low user limit to prevent abuse. Their FAQ says you can avoid reviews if you only have a single user, but it doesn't seem unreasonable that you could have a team of 2 or 3 people working on something. Once you have something working you'd probably invite close friends and family as well. Although you can work around that by using G Suite accounts, it kinda sucks that you're forced to pay. A scaling system based on number of users and other factors would probably be better. Look at the list of requirements for a security audit [0]. I'd imagine many small businesses would struggle to sort out everything listed there. I'm not a fan of removing user choice. If someone has established trust out-of-band then they should be able to opt-in after acknowledging that they accept and understand the risks. But I guess we need big daddy Google to step in and protect us, since we're too dumb to critically asses the situation. Something that nobody seems to be mentioning is that you need to perform these security assessments on a yearly basis. Talk about drastically raising the barrier to entry... [0] https://support.google.com/cloud/answer/9110914#assessment-includes https://support.google.com/cloud/answer/9110914#assessment-i...