Salesforce, Atlassian, GitHub and to a lesser extent Google, Microsoft and Amazon are only not allowed for private data, no? So there's nothing wrong with storing code on GitHub for instance. Although IPs are private data, do access logs count? If i recall correctly they don't, but I'm really not a lawyer.

Edit: Actually Atlassian are an Australian company, is there an equivalent CLOUD act that makes data transfers impossible?