None of this matters if you're literally sending sensitive data to someone else's server.