In my experience, that's rarely a good idea. No documentation means no ability to do regular monitoring or tie records together over years, irrespective of fund

In my experience, that's rarely a good idea. No documentation means no ability to do regular monitoring or tie records together over years, irrespective of funding. Simply put, not ideal. The way it's handled in the US is to simply require auth on the site databases.