A question I'm asking myself is the security one. Obviously the accessed databases only contain the customer's own information with read-only access. But how do you prevent resource exhaustion / DoS attacks trough overly complicated queries? This is the obvious vector that comes to my mind but I wouldn't be surprised if there were a few other ones similar to it.