It's running on their servers! I prefer to have a VM on my side. In terms of security I don't trust third parties. Or saying it in a different way: can I look at their server configurations before acquiring their services?