Before signing a contract with a SaaS vendor, an organization must ensure that the vendor has acceptable answers to questions about the storage and protection of the data shared with them because _____.