Absolutely, the user and or the company hosting. There is no world where accountability should be zero.