In reply to Amir Helzer.
Amir,

Let me just grace the elephant in the room:

WPML support constantly gains access to both development and production sites belonging to e-commerce businesses. We trust you with this information, because we often have to. There’s simply too many flaws in WPML and it’s too complex to deal with for most, hence we often need to give your support personal access.

We have given access to our production site a few times due to critical errors. What’s to stop an employee from stealing data and exploiting that data later on, e.g. payment provider API credentials, user data, et cetera?

How can we be sure that our database was completely deleted after it was copied/cloned by your employees? That it won’t be abused?

As I see it, the only responsible thing to do with WPML is to get completely rid of it. Such as headache.