What can I reasonably be told about how my data is kept safe?
I have sensitive data held by a UK company "A" who uses a database software that was recently hacked at another company "B" and has been a few times recently elsewhere. I am concerned that with the vulnerability of the database software, my data with A is vulnerable to a similar hack. I asked the DPO for some reassurance of how company A is protecting my (and other people's) data and they said they can't disclose that for security reasons but they're "doing all they can" and "following external advice".
I understand this reasoning to a point, but surely there is some degree of reassurance I can be given of the specifics of this beyond being fobbed off with platitudes? Is it reasonable to ask of a company that stores my data how it protects that? Or are they really okay to be completely vague and unreassuring like this?