Signing a DPA that confirms the service provider will not use data to train models, and that commits to data encryption and access logging, often resolves security trust issues more effectively than technology selection.