Actually here is your don't-need-a-lawyer answer: As you mention maritime boundaries, which is very clearly a national security issue, it wouldn't even take a court order for ESRI to release it:
Products & Services Privacy Statement Supplement | Esri
Esri will not disclose Customer Data, Administrator Data, Payment Data or Support Data outside of Esri or its controlled subsidiaries and affiliates except (1) as you direct, (2) with permission from an end user, (3) as described in this Products & Services Privacy Statement Supplement or in your agreement(s) with Esri, or (4) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may share Administrator Data with third parties for purposes of fraud prevention.
In your case, I'd stand up an internal Portal for ArcGIS, which gives you the same functionality as AGOL, but you have 100% over the security and release of any data stored within. By internal, I mean on-prem: A portal you host in Amazon could be subject to the same host-state laws.