If the vendor shares bare metal servers you’ll def want to keep this in mind: https://www.wired.com/story/dark-metal-cloud-computers-invis... - gist is they are some interesting attacks that can be ran on bare metal servers that are re-used