Evernote, Dropbox, Google Docs. All have TOS and things like Apps can have contracts. Apps has a DoD clearance.

There is a legal distinction between subcontracting out services and sharing data. One that has no difference from paying for a service contact that allows a vendor to login and fix your db.

There are very few situations where EVERYTHING must be internal.

Google Apps is big in education, so "sharing" data under contract must be legal.