The last thing you want is a vendor that lies to you about its security practices.