You would be surprised. Banking companies / their vendors for instance will outsource to india and Poland. Some of the people in Poland are citizens of Belarus. Us customer data is all over the world (account numbers / ssn / other personal info ).

It may be stored in the us but accessed by people in lcol areas.

Good question. I was required to submit ID to Au10Tix for an Azure vendor account, and noticed that was outsourcing the data to Israel.