Ask HN: How do you decide which service owns sensitive data?