Well, if it makes you feel better, a smaller business doing that is a big nothin-burger in some ways. I mean, our financial regulators have all of their data in US cloud service providers -- the same regulators that demand industry submit copious amounts of private data to them for "risk management" reasons. Like in BC, if you have a mortgage with a credit union, that credit union submits your job title, employer, income, strata fees, address, loan amounts, etc etc in plain text to a Microsoft portal -- so it's all up for grabs by the USA, through the regulators that are claiming they 'reduce' risk.
So even if you have a bank/CU that's largely sovereign in its own stack, they'll STILL have exposure to this crap because our govt is so janked.