> Given that I understand all the bad things that a business can do, how do I structure a relationship with a service provider such that I get the benefit of th

> Given that I understand all the bad things that a business can do, how do I structure a relationship with a service provider such that I get the benefit of their service, and avoid the bad stuff? What tools can I use to ensure our interests remain aligned? Has any business really succeeded in keeping business information confidential while outsourcing operation of that information? It seems like at a minimum you'd need a PCI-DSS/HIPAA-style audit regime, which I haven't seen the likes of MS granting access for (why would they?); even then those schemes aren't great at protecting confidentiality. Core business trade secrets get leaked all the time; the idea that a company would manage to protect stuff that's proprietary but peripheral, like how they use their workflow tools, seems like wishful thinking.