Ideally I would like to isolate everything if cost was no issue, but since it is startup capital I want to ensure I spend less and still get a secure architecture. I know that I can secure communication between services with access keys and OAuth 2, but I am unsure if this is enough. My system involves customer data that needs to be protected but is not that sensitive other than it needs to be compliant with GDPR. I am not legally bound to do isolation. What would you choose yourself? If I went with AWS I would have isolation (VPC) included with most services at the same cost, however I am not experienced in using that.