Yep.
The core data should sit behind some kind of service that enforces legal, compliance, and security policies.
Then tools that access the data in a compliant way should be given a lot of flexibility for what tech stacks they use to process the data.
Not saying that isn't normal (been there, done that... thanks FINRA), but that's the reason.