> with E2EE the company db is useless to an external attacker.

Depends on who is defined as the other end, it may be that the company db is the other end.