That is responsibility. You outsource to, let's say, okta, okta takes an insurance. Payment goes down the chain. The accountability to pick okta and check if t

That is responsibility. You outsource to, let's say, okta, okta takes an insurance. Payment goes down the chain. The accountability to pick okta and check if they are, let's say within gdpr is on you!