GDPR on our side too, we need to reduce subcontractors as much as possible to handle all the requirements you listed. Also, we have to renegotiate with our own customers every time we want to had a new subcontractor, so we avoid doing so at all costs.
I like the prefect.io approach to have the control plane on the external provider, with the data and workers being run on the customer infrastructure. It seems fair for both sides:
- as the subcontractor, you keep trace of the real usage, without having to handle end user data which is a pain to manage, so you don't have to offer outrageous license pricing to compensate for being stolen (looking at you Grafana) .
- as the company, you comply with gdpr, while alleviate the operating costs, and also supporting the companies providing the tooling you need.