Hacker News Reader

That's not how it works. They don't send a guy to look at your databases.

So how do they know if the response with the data a user requests, are all we've got about them, and if indeed where stored the proper way?

As far as I know, you pay for an audit yourself, and then you send them the results.

How difficult would be to pay auditor to close their eyes? Do you need another audit?

Sorry, I don't know the details.

Generally they don't, until something happens that reveals the contrary. Like the Cambridge Analytica fiasco.