@sarahjamielewis A tad confused by the first sentence here. I mean backing up a security/privacy claim with the presence of cryptography is a good thing right? But if its 100% policy based that would imply the absence of cryptography not the presence of cryptography?