If you go to AWS hosting, the cloudwatch service gives you a happy medium- you have to trust them as they have your ec2 instance, but it doesn't necessarily leave AWS's network.