I agree that would be an awkward situation for myself and SO, but I disagree that it would represent a security issue. If the data is being sent to the vendor,

I agree that would be an awkward situation for myself and SO, but I disagree that it would represent a security issue. If the data is being sent to the vendor, I believe we should be able to audit that data. IMHO, deciding otherwise is giving far too much power to the vendor.