No, it literally cannot be both, full stop. There should rigorous, well defined procedures and processes for handling classified data, and chiefly among those should be something along the lines of "don't upload classified documents to a publicly-available internet-connected location/service/filestore/etc". If it's not, a security officer has not done their job.

The north east US is dotted with high (physical) security Amazon data centers . I promise those aren't hosting files you can search Google for, if you know what I mean.