Compliance-sensitive enterprises (subject to SOC 2 and ISO 27001 constraints) typically need to assess whether keys are stored with zero knowledge, whether audit logs are tamper-proof, and whether the vendor has passed an independent security audit.