you do not have to be a data vendor to have sensitive data on your servers