All that sounds good, but it still doesn't all you to prove no access has occurred. Sure, the data is "encrypted" (although even that's problematic) and access is logged, but the application servers must have access to the keys, and someone must have production credentials. What's preventing that person from attaching a debugger and grabbing the keys? Better yet, what's preventing someone from stealing the sellers' session, and making it look as if the seller's accessing the data? All the access might be logged, but how do you know whether the logging server has been tampered with? Maybe you do your evil deeds when the server is down for "unplanned maintenance".