We'll likely need it for SOC2 reporting