Yes, that is a good point. However, paypal is regulated by banking regulation, Sarbanes-Oxley, compliance rules for handling credit cards, and specific legislation by different countries for privacy and handling personal information. The US bureaucracy has ITIL and procedures.