Yes, but as someone who makes IT decisions for an organization outside the US, it's still a factor. When evaluating services, one factor is "Do they use sound

Yes, but as someone who makes IT decisions for an organization outside the US, it's still a factor. When evaluating services, one factor is "Do they use sound security principles?" Does their API use SSL? How does authentication work? How is my information stored? Etc. Another factor is "Do I trust them with my data?" This has a lot to do with the company's track record, business model, and of course their location. Where are they? What are the privacy laws like there? What is the level of corruption? If government agencies (and their subcontractors) can go to my service provider and secretly demand sweeping access to any "foreigners data", without any sort of due process, why would I do business with that company? I think I'd rather go with a company in a country with strong privacy protections, even for non-citizens, and take my chances with best practices for securing data on the wire. Due process and strong privacy protections are a competitive advantage for a country... The US is royally screwing it's own tech sector with these policies.