For a SaaS app I built, I am using a third-party IDP/IDaaS, and thought about holding all user data as metadata in that directory so the only thing my app datab

For a SaaS app I built, I am using a third-party IDP/IDaaS, and thought about holding all user data as metadata in that directory so the only thing my app database stored was a foreign key for user, and I'd be able to really leverage the warrantied security of the provider. In the end I needed faster access to the user metadata so now am storing in database. Meh. Not sure if first idea was a good one or not - I know that depending on the type of breach, that user info stored in the directory could still be accessed, but was really attracted to the idea of not having a damn bit of it in my own db for purpose of getting just a bit closer to the idea of not leaking it if it's not there.