I think you just described SOC2, which your dumb-as-fuck customers will insist you do anyway because their even-dumber-than-that customers insist on it.