There are many contractual commitments to privacy on all of the big platforms. Like any tool, the wielder can make bad implementation choices. (And I can assure you, on-prem Edu IT is a shitshow)

> E.g. for protected government data, you have to run in amazon's govcloud.

Not really. Many .gov workloads are fine in commercial cloud. It depends on your compliance requirements. Sometimes there are downsides too - some services aren’t available. At one point, Azure Gov required separate credentials.