Out sourcing credentials is critical. I'd go a step further, most apps/websites should out-source all of their personal data. Liability around personal data breaches is only increasing.