What makes this one different though, besides being controlled by a non-Microsoft entity? Do they have some policies/mechanisms in place to prevent supply chain attacks?