I see it as if you don't have all the hardware in-office and in-house ALL the software and have the clients go to your place to do whatever it is they do, there

I see it as if you don't have all the hardware in-office and in-house ALL the software and have the clients go to your place to do whatever it is they do, there is no 100% guarantee you will get full security. And even then you have to trust the clients aren’t a risk in themselves... If you want to be full-blown paranoid, you have to trust a) the client's pc manufacturer (including USB connected devices) b) their OS manufacturer c) their browser manufacturer d) all apps that the client runs Then they hook their computer to the internet...