Have you considered the shipping companies too? We found out by bitcoiners working at DHL that basically every employee can just find a company account that ships and get all shipment data if there is a company account. We decided to therefore do manual shipments without any account with shippers when we started. Specifically because of this risk.