Very much this. Plus, how easy will instance admin Joe Schmoe fold under external pressure to give access to certain groups, government bodies etc? And how well have Joe Schmoe implemented good security practices on the server and related things? Etc.