They should know and expect that. It's a pretty standard request from enterprises' IT and/or Compliance depts when signing deals that involve storing data outside the firewall.