Personal data must be protected, both in your source systems and in your reporting environment. That also means you should not casually store this data under foreign legislation. I assume nobody would suggest storing personal data with a Chinese SaaS company. You would then know for certain that Chinese intelligence services use it to profile people of interest — including human rights activists, whom they also count as terrorists.
For the US, this was not a problem until now. After all, there is the EU-US Data Privacy Framework treaty, which agreed independent oversight of that data. But is the US still complying? Several conditions from this treaty have been removed by Trump and the Supreme Court. The European Commission is still postponing its decision on the validity of the treaty, but there are also court cases underway. And even without a legal ruling: we also know that US intelligence services have an ever broader definition of terrorism.
Do you want to wait until a legal loophole appears that makes it allowed again, or do you already start moving your data to 100% European companies?