You'd probably want to get SOC 2 certified at some point, to not turn away a decent amount of potential users.

How do you handle possible prompt injection in emails?