Require servers to be hosted domestically. This doesn't prevent exfiltration, but it can be more closely regulated and inspected.

Many countries ask this of US companies, so there's no reason we shouldn't adopt a similar stance.