> Having all their business data logged doesn't sound like a condition that any reasonable customer should agree to. Any business that uses SaaS or externally-

> Having all their business data logged doesn't sound like a condition that any reasonable customer should agree to. Any business that uses SaaS or externally-hosted software agrees to this. The question is whether your vendor has a reasonable access policy for that data, and what "reasonable" means hinges a lot on your vertical and the kind of data you're storing. PCI is a completely different ballgame than button clicks for example. Increasingly, plenty of non-SaaS products work this way (e.g. Tesla cars, OnStar, your iPhone, apps in the Windows Store, etc.) Again the question isn't so much about "whether" to collect usage and bug reporting data, it's about getting the defaults right and educating concerned users to tweak them to a level where they are more comfortable. > also tells them that you think they're so stupid that they don't know the difference between a bug and a user error This is literally the case that OP came to us to solve