We went through this process some time ago. It was resolved with a direct conversation between our security and data experts with those from Apptio. It was limited to Apptio providing answers to our questions on data protection and a couple documents as evidence.