But smart IT departments should be asking more questions than that, and developers should be prepared to answer them. Just saying your app encrypts its data isn’t enough.