I think so? I'm not an expert on the setup or agreement, just worked under that situation. I assume there's a privacy agreement and some level of uptime commitment

Because if not, I feel like this could get the team in legal or at least financial hot water with investors.

Which doesn't mean it doesn't happen, just that it's not normal and okay.