Also some of us here work at public companies and these systems are under scope since finance needs away to share/edit financial documents with each other. These big firms have soc1s. Running our own infra would put that infra under scope which is a huge burden.