Even secrecy-minded orgs like the CIA are moving apps to these platforms. Typically a regulation won't say "no cloud", but e.g. FISMA would require an online infrastructure to pass certain third-party assessments.