Why do you need to use a major service though? There's a ton of cloud providers you can use that offer pretty much a similar range of services and are certified, e.g. ISO27001, SoC2.
Major services have major pay outs when majorly bad things happen to their enterprise customers. Finance will not approve a level of risk that would bankrupt your cloud provider for any critical service. I suppose this is mostly immaterial for startups given they don't have the weight or value.
