where the data is actually stored and whether that jurisdiction exposes the company to any additional legal or compliance requirements; whether cloud-computing is permissible for all types of data routinely kept by the company; whether the cloud provider can use any of your data for its own purposes