Data security cluster-$@&?

Yesterday I discovered that one of our vendors stores incredibly sensitive information in a way that is accessible via a URL without any form of authentication. The link is obviously unlisted and includes a long, randomized/non-sequential key, but… that’s it.

When I reached the vendor, their response was that it was safe because the URL is hard to guess and that it’s just like when you share a Google doc via private link. That, apparently, was supposed to reassure me?

I feel like I’m being gaslit here… I’m not insane, right? This is coming from a vendor with a 10-figure valuation, not some tiny little startup. What do you even say to someone who justifies this by saying “don’t worry, it’s just like Google Docs”?