Safety depends on the controls and operating discipline around the arrangement. A sound service defines access permissions, privileged-account handling, change approval, audit evidence, incident escalation, backup recovery and security responsibilities. Information-security certification, such as ISO/IEC 27001, may provide additional assurance, but it does not remove the need for the client to assess the provider, define the scope and maintain governance.