As long as they keep the data safe the audit is legal?