What would be in violation exactly? Not clear on this. How would regulators investigate? Do they require full access to your database/ backend?