Deviation reports, protocols, process data. The moment they cross into a vendor's cloud, new questions appear: where is it processed, who holds the audit trail, and can you prove it?