> Shout out to companies with very strict assessments, who actually pay attention and weed out companies with bad practices. We do B2B software. All of our cus

> Shout out to companies with very strict assessments, who actually pay attention and weed out companies with bad practices. We do B2B software. All of our customers (small community banks) have been incredible hard-asses regarding PII visibility. As they should be. Even in cases where our customers use a "cloud" solution, it's with some niche 3rd party vendor that would never grant access to someone outside the secret club. Every one of our product installations is effectively an "on-prem" deal. All of the logging information that we get to see is redacted for PII by the customer's instance before it leaves their secure context. This is a zero-tolerance policy too. We anonymize even the most generic facts and ensure our hashes are salted as specifically as feasible. There are some cases where this burns us (e.g. knowing that the SSN contained a non-numeric digit could be very helpful at troubleshooting time), but on the other hand everyone sleeps better at night knowing that PII is not leaking out into 3rd party buckets arbitrarily. I would say that being very cautious about PII has opened up more opportunities for us. Our organization operates under the pretense that if any one of our customers were to become compromised by way of our product (or consultation per the product), we are instantly dead and put out of business. We don't sell ourselves exactly this way on sales calls, but we do make it clear that PII is the #1 concern in our minds. For us, it is analogous to safety on a construction site or nuclear power plant.