That’s not how it works. Especially with compliance schemes like ISO27001, Hippa, etc. they require an audit chain through the supply line. Obviously it depends on what data you’re managing to whether your customers care about whether you’re audited, or not, but if you’re selling enterprise software then this is all part of your compliance process. You can’t offload that responsibility, you have to make sure your suppliers comply too.

▲

augment_me 4 hours ago | parent [-]

Maybe it's different in the US, but in the EU you can get certified to be able to handle certain data securely, for example getting SOC/ISO/ESC certifications. When you then are looking for storage solutions you can in practice absolve yourself from liability/gross negligence if you choose a provider that has these certifications. So when an org needs cheap solutions, they find the cheapest compliant provider and hands are clean.

	▲	louthy 4 hours ago \| parent [-]
		If you want to be certified for SOC or ISO in the US you have to check all your suppliers too. You can’t outsource your responsibility if you want to comply. I know this because I have been through it in the US, EU, and UK. If your supplier has these compliance audits in place and has the documentation to prove it, this isn’t “absolving”, it’s literally the diligence process. But a “shell company”, as per your original comment, is not going to reach a compliance threshold to allow the diligence chain to succeed. Just from a business continuity point of view they would fail, but there are plenty of other areas that would be problematic from a compliance standpoint.