A legal or regulatory requirement that specific data never be processed outside a defined boundary — on-premises, a specific VPC, or fully air-gapped.
Not a preference; a hard architectural fact that rules out entire classes of vendor and deployment choice regardless of how well they otherwise fit.