If a core feature of your software requires security guarantees you can't just say they don't have a "security team" .