Ask HN: Should internal services ever receive raw customer PII?