Data security for third-party providers