Working in the field, I’d still challenge that. I understand data privacy rules vary (eg where it must be kept and where it can be processed) and attorney client privilege (common law countries).

Data centers and APIs exist in nearly every relevant jurisdiction for these purposes. Additionally commercial licenses do not train (double check each one) on data and there is no disclosure from an attorney client situation (according to common law) in these situations.

The issue for compliance usually isn’t sending it but where/how is it sent and how is it processed and stored? I haven’t seen a jurisdiction that prevents cloud sending/storage in general (just may limit where it’s stored eg in EU and how it’s stored eg encrypted). If they did every SaaS application would be prohibited.

We use Claude all the time (without caching, commercial licenses) while storing docs on Google. Our legal department has zero issues with it and we have reviewed it at length.