Unfortunately it wasn't my project so I can't speak to it with detail or authority. I was just observing.

It was things like: Where do log statements go? Via what path? Are we sure none of those routers are in the US? Can we spin up new instances of EVERYTHING in a `-ca` region? Can we force traffic for this shop to only use those instances? What about vendors? Can we disable US-only vendors of whatever? What about backups? What things are centralized (which were good to identify)? Can we region those too? Can we disable/bypass them?

And do that for every bit and packet for a very complex system. I think that it launched with a considerable number of features just disabled. Privacy trumped everything.