Comment by hartator

> The answer is: we have to, for compliance.

Do they?

I don’t remember seeing any compliance requirements you can’t reasonably push back. This is just overzealous compliance consultants meeting a team that doesn’t really care about their users. People never really question anything.