If read the right way the responses could still allow for direct access to all their users data through a special API. Direct access to the server itself isn't

If read the right way the responses could still allow for direct access to all their users data through a special API. Direct access to the server itself isn't necessary to get at all the data at will.