I (average user) was given a case of sensitive information and told to edit it/update it/reupload it. Using my work device was the expectation…but I had not been granted any paid software to do so.

The IT guy was like “you can use this website” which was almost certainly a violation given the nature of the data. It was maddening because I knew (I also did not use one of those websites).