I think that an outside provider is likely to be more secure than a self-hosted deal run by an internal team, but maybe you've got rock-stars instead of harried desktop guys trying to keep the business afloat 🙂