Yeah you don't even have to get silly before you reach impossible. One client's compliance jobsworth demanded a tour of our datacentre (AWS) to inspect physica

Yeah you don't even have to get silly before you reach impossible. One client's compliance jobsworth demanded a tour of our datacentre (AWS) to inspect physical security for low grade employee PII (email, name). I was younger and poorer then so bent over backwards to still get told "er, no thank you" from Amazon. Client's security weren't happy with third party security certifications (of which AWS has most) so they reported up that we were likely hiding something devious. I think they'd had some sort of physical breach in the past but it just makes using an external service supplier untenable if you're going to treat security like it's 1970. I think we still got that contract but it took high-level meetings to ELI5 modern infrastructure's features and limitations. We've had others rock up at third sales meetings (pretty advanced) saying they now "need" source and data design before they sign. One asked me to get a criminal record check. To reiterate, we're storing light employee data and everybody knows and understands that, but some people just seem to treat all data exchange as nuclear waste.