It's fairly common in large organizations, even progressive internet-focused ones, to have a rule of "no sensitive/confidential data on third-party systems that haven't been through a security audit."

Unfortunately, some less-progressive companies leave off the last bit and just ban everything.