Had similar experience talking to ... someone at fidelity. I can't remember his title, but we were trying to negotiate some data exchange with them. He asked for our development workflow/process, and balked when he saw that a "developer" would also be the same person who had "access" to the database with customer information.
"Developers can not touch the database"
Umm... someone needs to, and we're a small team.
"Developers can not touch the database"
"Why not?"
"They can exfiltrate data".
"So could someone else who has access to the database"
"Developers can not touch the database"
"If we give a non-developer access to the database, by definition, they have access, and therefore the ability to exfiltrate data"
"Developers can not touch the database"
"Can you provide some examples of how other companies who've passed your inspection are making any sort of database changes/upgrades without someone having access to the database?"
"Developers can not touch the database"
And that ended it apparently.
"Developers can not touch the database"
Umm... someone needs to, and we're a small team.
"Developers can not touch the database"
"Why not?"
"They can exfiltrate data".
"So could someone else who has access to the database"
"Developers can not touch the database"
"If we give a non-developer access to the database, by definition, they have access, and therefore the ability to exfiltrate data"
"Developers can not touch the database"
"Can you provide some examples of how other companies who've passed your inspection are making any sort of database changes/upgrades without someone having access to the database?"
"Developers can not touch the database"
And that ended it apparently.