Refunds are fine for retail customers, and most SLAs I’ve ever had the need to discuss seem to be based on that model.
If I buy a computer from you for $1000 and it breaks, I’m out $1000, I want my money back. Vendor might be fine with that. If I buy a commercial oven from you for $40,000 and it breaks I’m out the price of the oven, plus half of my sales for a week while it gets repaired, wages for people who are now half useless to my business, and loss of trust and/or customers for my company since I had none of my signature baked goods for the entire week.
What's missing is, some certification level that tells you how secure the data is. So you know what you're buying into?