One last thing I forgot to mention that yes, from the security point of view it does make sense to have such setup but there are many different ways how this can be tackled, rather than having all your data stored at your developer.