Yeah.

For us, we have a review process internally for every 3rd party we use. We figure out the auth process and how secure is it etc...